CryptoWaters
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
13 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
"iVerify, which is tracking the malware framework that uses the exploit kit under the name CryptoWaters, said it has similarities to previous frameworks developed by threat actors affiliated with the U.S. government" | Apple on Wednesday backported fixes for a security flaw in iOS, iPadOS, and macOS Sonoma to older versions after it was found to be used as part of the Coruna exploit kit. The vulnerability, tracked as CVE-2023-43010, relates to an unspecified vulnerability in WebKit that could result in memory corruption when processing maliciously crafted web content.
"iVerify, which is tracking the malware framework that uses the exploit kit under the name CryptoWaters, said it has similarities to previous frameworks developed by threat actors affiliated with the U.S. government"
"iVerify, which is tracking the malware framework that uses the exploit kit under the name CryptoWaters, said it has similarities to previous frameworks developed by threat actors affiliated with the U.S. government"
"iVerify, which is tracking the malware framework that uses the exploit kit under the name CryptoWaters, said it has similarities to previous frameworks developed by threat actors affiliated with the U.S. government"
"iVerify, which is tracking the malware framework that uses the exploit kit under the name CryptoWaters, said it has similarities to previous frameworks developed by threat actors affiliated with the U.S. government"
"iVerify, which is tracking the malware framework that uses the exploit kit under the name CryptoWaters, said it has similarities to previous frameworks developed by threat actors affiliated with the U.S. government"
Dynamo CVE-2020-27950 PE (infoleak)
Rocket CVE-2024-23296 PPL Bypass
Neutron CVE-2020-27932 PE
Codename CVE Type buffout CVE-2021-30952 WebContent R/W
jacurutu CVE-2022-48503 WebContent R/W
Sparrow CVE-2024-23225 PPL Bypass
IronLoader CVE-2023-32409 WebContent sandbox escape
Techniques & procedures
24 distinct techniques documented for this family, organized by ATT&CK tactic.
Reconnaissance
2 techniques
Reconnaissance
Initial Access
3 techniques
Initial Access
GTIG tracked the use of the exploit in highly targeted attacks by a surveillance vendor’s customer, in Ukrainian watering hole campaigns by UNC6353, and later in broad-scale attacks by Chinese financial threat actor UNC6691
Execution
3 techniques
Execution
It uses a custom JavaScript framework and loaders to deliver tailored exploits.
Privilege Escalation
3 techniques
Privilege Escalation
"heap spraying with 16-element arrays... allocates 40 MB... fills JIT memory with predictable patterns using a JIT spray of repeated x += 1 statements"
Stealth
7 techniques
Stealth
"Phase 3: defeating ASLR via dyld shared cache scanning... locates WebCore... reads __TEXT segment headers... determine their load addresses"
Its final payload PlasmaLoader targets banking data, cryptocurrency wallets, and other sensitive information, using encrypted communications and a custom domain generation algorithm seeded with "lazarus."
"heap spraying with 16-element arrays... allocates 40 MB... fills JIT memory with predictable patterns using a JIT spray of repeated x += 1 statements"
It removes traces of the attack, selects a target process, injects a stager, and executes it to deploy the final malware.
The payload then decrypts and processes multiple layers of data using ChaCha20 and LZMA compression, revealing structured containers that store files and instructions.
"Anti-analysis checks... aborts if Lockdown Mode is detected... skips execution in private browsing... verifies a real WebKit rendering engine... checks for RTCPeerConnection... reports... 1003 means a sandbox was detected"
The launcher handles post-exploitation tasks. Instead of re-running the exploit, it reuses existing kernel access created earlier to read and write memory. It removes traces of the attack, selects a target process, injects a stager, and executes it to deploy the final malware.
Discovery
2 techniques
Discovery
Collection
1 technique
Collection
Command and Control
4 techniques
Command and Control
"reports the outcome to the C2 via a GET request to <base_url>?e=<code>"
UNC6691 has been observed weaponizing the exploit to deliver a stager binary codenamed PlasmaLoader (aka PLASMAGRID) that's designed to decode QR codes from images and run additional modules retrieved from an external server.
IOCs tracked for this family
72 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.