BellaCPP: The C++ Malware That’s Redefining Cyber Threats (0penBuckets)

Unmasking a Sophisticated Variant of BellaCiao Malware

Cybersecurity researchers have unveiled a new twist in the BellaCiao malware family with the discovery of BellaCPP—a C++ adaptation of the original .NET-based malware. This evolution of malware demonstrates how advanced persistent threat (APT) groups like Charming Kitten are continuously refining their attack tools to stay ahead of defenders. Here’s an in-depth look at this emerging threat.

The Rise of BellaCiao: A Malware Pioneer

BellaCiao first emerged in late April 2023, making waves with its stealthy blend of persistence and covert tunneling capabilities. Publicly attributed to the Charming Kitten APT group, the malware gained attention for its sophisticated techniques and revealing PDB paths, which often hinted at targeted entities and regions.

Through the analysis of historical records, researchers uncovered a versioning scheme embedded within BellaCiao’s PDB paths. Strings like “MicrosoftAgentServices,” followed by integers, showcased the malware’s development progress over time. This systematic versioning underscores how Charming Kitten has matured its arsenal to ensure adaptability and effectiveness.

A New Player: BellaCPP Discovered in the Wild

The latest discovery of BellaCPP came during an investigation of an intrusion on a machine in Asia that already harbored the .NET version of BellaCiao. A deeper dive into the suspicious files revealed a reimplementation of BellaCiao—this time written in C++ and designed to function as a Windows service.

This new variant, disguised as “adhapl.dll” and located in the C:\Windows\System32 directory, follows a similar behavioral pattern as its predecessor. With a file size of just 17.50 KB, BellaCPP is deceptively lightweight but packs a potent punch.

How BellaCPP Operates: A Deceptive Execution Path

BellaCPP’s operations are initiated through its exported “ServiceMain” function. Its workflow includes the following steps:

1. String Decryption: Using XOR encryption with a key (0x7B), it decrypts critical strings, including paths and function names like:
   • C:\Windows\System32\D3D12_1core.dll
   • SecurityUpdate
   • CheckDNSRecords
2. Dynamic Loading: It loads the decrypted DLL and resolves the functions of the decrypted strings using GetProcAddress.
3. Domain Generation: Similar to the .NET version, BellaCPP creates domains using this pattern: <5 random letters><target identifier>.<country code>.systemupdate[.]info.
4. Function Execution: It calls CheckDNSRecords to verify an IP address and subsequently triggers SecurityUpdate with specific arguments when the match occurs.

While researchers couldn’t retrieve the associated D3D12_1core.dll file for analysis, they assessed with medium confidence that the DLL’s role involves creating SSH tunnels. This functionality mirrors the behavior of older BellaCiao samples, albeit without incorporating a webshell.

The Curious Case of PDB Analysis

BellaCiao’s PDB paths remain a treasure trove of intelligence for researchers. These paths often reveal clues about the malware’s intended targets and its operational scope. Intriguingly, the earlier versions lacked versioning, but subsequent iterations included identifiers like “MicrosoftAgentServices2” and “MicrosoftAgentServices3.”

This evolution reflects the malware developer’s intention to maintain a robust and adaptable toolkit, enabling Charming Kitten to refine their attacks and evade detection effectively.

Charming Kitten’s Signature: Attribution Insights

The connection to Charming Kitten is drawn from several factors:

• BellaCPP’s workflow closely mimics BellaCiao’s core features.
• Domains generated by BellaCPP align with those previously attributed to Charming Kitten.
• The coexistence of BellaCPP and BellaCiao samples on the same compromised machine reinforces the link.

With these indicators, researchers attribute BellaCPP to Charming Kitten with medium-to-high confidence, marking another milestone in the group’s continuous efforts to enhance their cyber arsenal.

Lessons Learned: Defending Against Evolving Threats

The discovery of BellaCPP underscores the critical importance of thorough network investigations and proactive threat hunting. Attackers are becoming increasingly adept at deploying novel malware variants that evade traditional security measures.

For organizations, this means:

• Regularly updating threat intelligence feeds to include emerging threats.
• Employing advanced endpoint detection and response (EDR) tools.
• Conducting routine audits of system files and network activity.

As malware families like BellaCiao evolve, staying one step ahead requires vigilance, collaboration, and cutting-edge defenses.

Conclusion

BellaCPP exemplifies how APT groups are advancing their techniques to maintain a foothold in compromised environments. For cybersecurity professionals, understanding these evolving threats is paramount in defending critical systems and data. Charming Kitten’s latest innovation serves as a stark reminder that the battle against cyber adversaries demands constant innovation and adaptation.