Tonnerre Malware
The Tonnerre Malware is a malicious second-stage payload that comes with the Foudre Malware. These threats are part of the notorious Infy operation, also known as Prince of Persia. The operation is managed by Iranian hackers, and cybersecurity researchers believe that these criminals are backed by the Islamist state. State-backed hackers are not anything out of the ordinary as the scope of cyberwarfare has only grown in recent years.
What is Tonnerre Malware?
To put it simply, Tonnerre Malware is a Trojan infection. Trojan infections are categorized by their one specific feature – stealth. They usually enter the target system disguised as something else. Tonnerre Malware is downloaded onto the compromised system by Foudre Malware, and the saying “after lightning comes thunder” acquires a new meaning here because that is what those words mean: Foudre and Tonnerre are “lightning” and “thunder” in French. So, both malware threats are inseparable components of the malicious operation that is used for cyber espionage.
Tonnerre Malware is considered to be an upgrade to Foudre Malware. Although the list of its performance tricks is not severely limited, it is mostly known for recording sounds from the affected computer’s environment. There have been several versions of this malware detected since August 2018, when it was first used by Foudre Malware. The version we are currently dealing with is Tonnerre 11.
What Does Tonnerre Malware Do?
When this malicious component is downloaded and dropped on the affected system, Tonnerre Malware behaves like a true Trojan and tries to pass for a legitimate software application. The current version of this malware pretends to be a program called “Synaptics.” The malicious file is over 56MB, and some might think that a file this large would be hard to miss. However, that is the trick here: quite a few security vendors ignore the file because their security apps are not programmed to scan such big files. They just dismiss a file that large, and that is one of the ways how Tonnerre Malware avoids detection.
When the coast is clear, the malicious actor runs its repertoire, which includes the following:
- Receiving and executing commands from its command & control center (C2)
- Recording audio
- Snapping screenshots
- Stealing files from folders and external devices
Needless to say, Tonnerre Malware connects to its C2 behind the victim’s back. It establishes a secure connection with a remote server and then receives instructions on what to do next. That is why sometimes it is hard to say how a certain version of a Trojan behaves because its behavior may differ based on what the attacker wants it to do.
As far as we know, when Tonnerre Malware establishes the said connection, it transfers the data collected about the victim and downloads updates to upgrade itself. It may also get an additional C2 that would transfer additional commands associated with stealing and storing data from external drives (the malware might even snatch files from the Recycle Bin!).
Tonnerre Malware also uses both HTTP and FTP protocols to communicate with its C2 servers. The FTP server password that the malware uses to access the server is already hardcoded in the infection. However, for the username, Tonnerre Malware uses the name of the compromised computer. It allows the attacker to keep track of the infection rate and see when a connection attempt from each affected system was made.
So, to take everything into account, there are five stages or forms to Tonnerre Malware. They can be narrowed down to these points:
- Installation and updates.
- File collection.
- C2 connection and file exfiltration.
- File collection from removable devices.
- Sound recording.
How to Deal with Tonnerre Malware
Since this is a stealthy malware infection used for state-level espionage, a regular end-user may not be able to stop its proliferation. However, employing the most common cybersecurity practices and keeping an eye out for odd spam emails would help avoid such threats. Also, anyone concerned with their cybersecurity should invest in a reliable anti-malware tool. Infections like Tonnerre Malware are hard to spot but reviewing your system’s status and scanning it with a security tool of your choice can make it safer.
