Ghostwave: The rising commodification of high tech 'spytools' for Chinese scammers ?
Brief access to an open dashboard that shows a C2 framework for the famous exploit chain, proofs commodification of powerful malware is moving ahead quickly and gives a glimpse into the future.
The story of Coruna and DarkSword has been already extensively reported on. Here is the brief: A highly sophisticated exploit chain for iOS and other mobile operating systems, that allegedly is based on a cyber weapon developed by the US company L3Harris/Trenchant. About two years ago it made its way into the hands of Russian cyber operatives before landing on the open black market. The original appearance of the malware kit was significant as it combined a set of exploits and zero-days to blast through iOS protections that were quite novel. Apple fixed most of them.
A lot has been written about the technical side and if you are up for it, you can find a lot on Github, especially on Coruna. But not so much is known concerning the actual ‘power user side experience’ of those exploit kits. Now, thanks to Shadowbyte we actually got access to a fully fleshed out dashboard and operating instance of a new(ish) version of this notorious exploit-chain.
We will do a tour through the UI elements, some of the back-house components and talk about the potential users. We found two instances of this system. One based on a server in Iceland (where the original UI we accessed), one in The Netherlands (both are not operational anymore of the time of this writing).
Nexus Command: The Dashboard
First, the whole system seems to be based on the popular NexusC2 framework for setting up Command-and-Control infrastructure. In that sense, the dashboard is just a graphical front-end. It looks nice but also pretty vibe coded. Though, these days that is not so out of the ordinary. AI presents itself as a perfect tool to rapidly build UI endpoints for the web. It officially calls itself ‘coruna-lab-v1'. All the pictures in this post are from the Iceland based host.
