Chrommme

Chrommme is a Windows‑based backdoor engineered with the Microsoft Foundation Class (MFC) framework, first publicly documented by security researchers in June 2021. The tool exhibits typical post‑exploitation behaviors: it establishes persistent remote access to infected hosts through dynamically generated command and control (C2) channels that reuse infrastructure elements previously associated with the Gelsemium malware family. Initial reconnaissance involves credential dumping, system enumeration, and port scanning; once privileged escalations succeed, Chrommme can download additional payloads, execute arbitrary binaries, exfiltrate data via HTTP or encrypted sockets, and maintain persistence via registry run keys and scheduled tasks. Operational reports suggest the botnet architecture is modular: a core daemon handles basic C2 communication, while pluggable modules enable additional functionality such as lateral movement using SMB shares, keylogging, and cryptocurrency mining overlays. The MFC origin of the binary leads to a higher likelihood of being discovered through static analysis of resource sections that often contain string obfuscation or embedded certificates, yet its dynamic payload loading complicates signature‑based detection. In environments with high outbound restrictions monitoring suspicious HTTP/HTTPS traffic to newly registered domains—especially those registered within 30 days—will reveal typical interaction patterns for Chrommme. The overlap in infrastructure with Gelsemium indicates that threat actors reuse compromised web servers, phishing landing pages, and command modules, thereby increasing the potential impact surface. In practice, attackers leveraging Chrommme can achieve covert persistence, exfiltrate sensitive data, or deploy secondary modules to expand their foothold in a target network. Threat Summary: Chrommme is a Microsoft Foundation Class‑based Windows backdoor first detected in June 2021 that shares command & control infrastructure with the Gelsemium malware family. The tool provides persistent remote access, payload deployment, and data exfiltration capabilities across compromised hosts. Organizations should monitor for anomalous outbound HTTP/HTTPS traffic to newly registered domains and block unknown executable downloads from untrusted sources. Key Capabilities: - Remote command execution via C2 channels - Persistence through registry run keys and scheduled tasks - Dynamic payload download and execution (binary injection, DLL hijacking) - Data exfiltration over encrypted HTTP/HTTPS streams - Lateral movement using SMB shares and credential theft - Potential cryptomining module integration - Use of obfuscated or self‑packing techniques to evade static detection - Sharing of infrastructure with Gelsemium (common C2 servers, phishing sites) Recommended Actions: - Deploy IDS/IPS signatures targeting known Chrommme traffic patterns and URL registrations. - Enforce strict outbound filtering; block HTTP/S requests to domains registered within the last 30 days. - Enable application whitelisting to prevent execution of unsigned MFC binaries. - Conduct regular endpoint runtime monitoring for unusual SMB activity, credential dumping tools, and persistence artifacts (registry Run keys, scheduled tasks). - Apply network segmentation to limit lateral movement and isolate critical assets. - Train users to recognize phishing emails that may deliver Gelsemium/Chrommme payloads. Confidence Assessment: The available data confirms Chrommme’s existence as a Windows backdoor discovered in mid‑2021 and its infrastructural overlap with Gelsemium. While core capabilities such as persistence and remote execution are well understood, details on the full command set, encryption methods, and deployment vectors remain speculative without additional samples or detailed field reports. Suggested Tags: ["malware", "backdoor", "Windows", "MFC”, “infrastructure overlap”, “Gelsemium”, "remote access trojan"] MITRE Techniques: ["T1059", "T1071", "T1048", "T1105", "T1086", "T1078", "T1083", "T1134"]