« cette manœuvre installe des trojans comme CornFlake »
CornFlake
CornFlake is a Go-based remote access trojan (RAT) targeting Windows systems.
Profile source: Mallory opens in a new tabCornFlake
Family profile
CornFlake is a Go-based remote access trojan (RAT) targeting Windows systems. It is assessed as Storm-2945’s primary persistent implant in the CaptiveCrunch espionage campaign, which has been linked to the Russia-aligned Midnight Blizzard (APT29) threat actor. The campaign targeted corporate travelers through compromised captive-portal infrastructure at hospitality and conference venues, using ClickFix-style fake browser or operating-system update lures to persuade victims to execute the malware. CornFlake presents a deceptive progress interface during installation and establishes redundant persistence through Windows services, Run-key entries, scheduled tasks, and a watchdog mechanism that can restore removed persistence. It communicates with command-and-control infrastructure through an encrypted channel and supports remote shell access, host reconnaissance, keylogging, clipboard monitoring, screenshot capture, microphone and webcam surveillance, browser credential and cookie theft, Microsoft 365 session-token theft, removable-media monitoring, and file exfiltration.
Capabilities
- Credential Theft
- Defense Evasion
- Exfiltration
- Keylogging
- Persistence
- Post Exploitation
- Reconnaissance
- Session Hijacking
Reported operators
Threat actors
4 named in public reportingMicrosoft also found evidence that the group used AI tools to assist operations, including the development of the CornFlake and ChocoShell malware.
One of the malware strains it delivers is CornFlake. Described as "a full-featured Windows RAT" written in Go, CornFlake is the SVR's go-to persistent implant in these hospitality network attacks.
One of the malware strains it delivers is CornFlake. Described as "a full-featured Windows RAT" written in Go, CornFlake is the SVR's go-to persistent implant in these hospitality network attacks.
MITRE ATT&CK
CornFlake in ATT&CK
44 distinct techniquesTechniques
44 techniques T1123 Audio Capture T1056.001 Keylogging T1204.002 Malicious File T1189 Drive-by Compromise T1113 Screen Capture T1071 Application Layer Protocol T1562 Impair Defenses T1547.001 Registry Run Keys / Startup Folder T1070 Indicator Removal T1557 Adversary-in-the-Middle T1204 User Execution T1219 Remote Access Tools T1125 Video Capture T1041 Exfiltration Over C2 Channel T1053 Scheduled Task/Job T1070.004 File Deletion T1543.003 Windows Service T1036 Masquerading T1071.001 Web Protocols T1134 Access Token Manipulation T1555 Credentials from Password Stores T1059 Command and Scripting Interpreter T1574 Hijack Execution Flow T1082 System Information Discovery T1053.005 Scheduled Task T1115 Clipboard Data T1005 Data from Local System T1539 Steal Web Session Cookie T1566 Phishing T1547 Boot or Logon Autostart Execution T1120 Peripheral Device Discovery T1105 Ingress Tool Transfer T1565.001 Stored Data Manipulation T1025 Data from Removable Media T1556.009 Conditional Access Policies T1059.003 Windows Command Shell T1497.001 System Checks T1205.001 Port Knocking T1059.001 PowerShell T1091 Replication Through Removable Media T1573 Encrypted Channel T1555.003 Credentials from Web Browsers T1083 File and Directory Discovery T1021.001 Remote Desktop Protocol
