ESET Research: Cyberespionage group Winnti creates a backdoor targeting Microsoft SQL server

MONTREAL – ESET research has just analyzed a sample from a new backdoor called skip-2.0 by its authors. The backdoor is a recently discovered addition to the arsenal of the notorious cyberespionage group Winnti. Specifically, skip-2.0 targets MSSQL Server 11 and 12, allowing the attacker to connect to any MSSQL account with a magic password – while automatically hiding these connections from the logs. Such a backdoor could allow an attacker to stealthily copy, modify or delete database content. This could be used, for example, to manipulate in-game currencies for financial gain. The Winnti operators are known to have dabbled maliciously with databases of in-game currencies in the past.

“This backdoor allows the attacker not only to gain persistence in the victim's MSSQL Server through the use of a special password, but also to remain undetected thanks to the multiple log and event publishing mechanisms that are disabled when that password is used,” explains Mathieu Tartare, ESET researcher investigating the Winnti Group. “We tested skip-2.0 against multiple MSSQL Server versions and found that we were able to log in successfully using the special password only with MSSQL Server 11 and 12. Even though MSSQL Server 11 and 12 are not the most recent versions, they are the most common ones,” adds Tartare.

ESET has observed multiple similarities between skip-2.0 and other known tools from the Winnti Group’s arsenal, such as a VMProtected launcher, its custom packer, and an Inner-Loader injector using the same hooking procedure. “This leads us to think that skip-2.0 is also part of that toolset,” says Tartare.

ESET researchers have been tracking the activities of the Winnti Group for some time. The group has been active since at least 2012 and is held responsible for high-profile supply-chain attacks against the video game and software industry. ESET has recently published a whitepaper that updates our understanding of the arsenal of the Winnti Group and exposes a previously undocumented backdoor called PortReuse.

The blog post “Winnti Group's skip-2.0: a Microsoft SQL Server backdoor” offers technical details describing more functionalities of this backdoor, as well as its similarities to the Winnti Group’s known arsenal – in particular, with the PortReuse and ShadowPad backdoors.

Make sure to follow ESET research on Twitter for the latest news from ESET Research.