SUGARUSH

Executive Summary

SUGARUSH is a minimalist Windows backdoor that creates a reverse shell over TCP to a hard‑coded C2 address, permitting attackers to execute arbitrary commands on infected hosts. Detected in a late‑2020 campaign targeting Israeli companies, it demonstrates the threat actors’ use of custom tools for stealthy persistent access.

SUGARUSH is a lightweight custom backdoor that was first uncovered by Mandiant during analysis of the UNC3890 (C0010) campaign, which focused on Israeli companies in late 2020. The code establishes a persistent reverse‑shell connection over TCP to a hard‑coded command‑and‑control (C2) address, enabling the attacker to obtain interactive control of the infected Windows host. Once the connection is established, SUGARUSH accepts and executes arbitrary shell commands, allowing the adversary to run utilities, harvest credentials, and exfiltrate data through the same channel. The tool’s minimal footprint and use of a fixed IP/port profile suggest it is designed for stealth, avoiding detection by signature‑based scanners while still providing robust interactive capabilities. The inclusion of SUGARUSH in the UNC3890 campaign illustrates the actors’ preference for “homegrown” footholds that can be tailored to mission requirements. By embedding this backdoor into compromised systems, threat actors extend their access window and can pivot laterally within targeted networks, thereby amplifying the overall damage potential.

Key Capabilities

• Establishes a reverse‑shell connection over TCP to a hard‑coded C2 endpoint
• Provides interactive Windows command execution via shell
• Exfiltrates data through the same channel
• Possibly uses minimal persistence mechanisms (e.g., scheduled task) – not confirmed

ATT&CK Techniques

Recommended Actions

• Implement outbound filtering to block connections to known SUGARUSH C2 IP addresses and ports
• Deploy host‑based intrusion detection to flag reverse‑shell behavior such as unexpected TCP traffic from executables on unusual ports
• Maintain updated malware signatures for the SUGARUSH binary in antivirus/EDR solutions
• Conduct regular log reviews for evidence of remote command execution and anomalous outbound connections

Suggested Tags