ChrysalisMalware
According to Rapid7, Chrysalis is a custom, feature-rich backdoor. Its wide array of capabilities indicates it is a sophisticated and permanent tool, not a simple throwaway utility. It uses legitimate binaries to sideload a crafted DLL with a generic name, which makes simple filename-based detection unreliable.From MISP Galaxy
Last reported 2 months ago, by Elastic Security Labs5 reports
ATT&CK techniques
5 techniques · each with the sentence it comes from- T1071.004DNS
“| Command & Control | DNS | T1071.004 |”
- T1195Supply Chain Compromise
“Lotus Blossom executed a supply chain compromise of Notepad++ update infrastructure:”
- T1195.002Compromise Software Supply Chain
“| Initial Access | Supply Chain Compromise | T1195.002 |”
- T1204.002Malicious File
“| Execution | User Execution | T1204.002 |”
- T1543.003Windows Service
“| Persistence | Windows Service | T1543.003 |”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
Benchmarking the Agentic SOC: How we evaluate LLMs for security workflows“The scenario is the Chrysalis backdoor campaign we detailed in our earlier Attack Discovery post: a DLL side-loading attack on a Windows host, srv-win-defend-01, where a legitimate-looking BluetoothService.exe loads a malicious log.dll.”
-
Benchmarking the Agentic SOC: How we evaluate LLMs for security workflows“The scenario is the Chrysalis backdoor campaign we detailed in our earlier Attack Discovery post: a DLL side-loading attack on a Windows host, srv-win-defend-01, where a legitimate-looking BluetoothService.exe loads a malicious log.dll.”
-
Elastic Workflows GA: automation where your security data already lives“The Chrysalis APT workflow shows Agent Builder integration in action.”
-
Security Automation with Elastic Workflows: From Alert to Response“This is the pattern demonstrated in the Chrysalis APT blog post: a two-step workflow hands the entire Attack Discovery to an agent, and the agent calls workflow-backed tools to verify malware hashes, search logs, check the on-call schedule, create a case, and spin up a Slack chan…”
-
Speeding APT Attack Confirmation with Attack Discovery, Workflows, and Agent Builder“9:15 AM: The Non-Event - A headline breaks: "Chrysalis Backdoor: A Deep Dive into Lotus Blossom." Your CISO sends a Slack message: "Are we affected?"”
Indicators in its reports
named in the reports above- create[.]casein 3 reports
- create[.]channelin 3 reports
- output.case[.]idin 1 report
- kibana.alert.rule[.]namein 1 report
- output[.]idin 1 report
- api.skycloudcenter[.]comin 1 report
- web[.]searchin 1 report
Copy these 7 indicators · defanged
Thanks — we review every report.