QuartzLine: A working PDF viewer with a backdoor inside

QuartzLine (tracked by Mandiant as CLOUDHAZE) is malware posing as a working Windows PDF viewer. It hides a backdoor that lets an attacker run commands on the device and install more malware.

TL;DR

• QuartzLine is a working PDF viewer with a backdoor hidden inside. In public analysis so far, the attacker never sent a command in any traffic researchers could decrypt.
• In customer environments, we’ve seen the attacker run what behaves like a Chrome data stealer, push a new build, and drop a second-stage remote access trojan (RAT).
• If your DNS filter or proxy blocked these domains, the device that tried to connect is still infected. Find it, isolate it, remove the malware and its scheduled tasks, and reset the user’s credentials.

How does QuartzLine work?

QuartzLine (tracked by Mandiant as CLOUDHAZE) is malware posing as a Windows PDF viewer. Since the viewer works, users have no reason to uninstall it. QuartzLine has shown up as paperline.exe (the original build) and as fielddesk.exe (a later build). It was signed with a legitimate extended validation (EV) code-signing certificate issued to Guangzhou Guoying Communication Technology Co., Ltd., which has since been revoked.

On October 9, Rogue Authority published an independent teardown of the QuartzLine “zenith” backdoor. It found that the hidden module can run any Windows command and tamper with Chromium-based browser profiles. 

It also cracked the extra layer of scrambling inside the backdoor’s HTTPS traffic. The installer it analyzed has the same hash as one we found in a customer environment, and three of its command-and-control (C2) domains match ones we’ve seen.

Every server reply it could decrypt said there was nothing to do, though, and public sandboxes scored the file as low risk or clean. Beyond that teardown, a MalwareBazaar entry, and paywalled reporting, there isn’t much out there.

In customer environments, the attacker does send commands. In one case, they were pulling Chrome data within a week of install and dropped a second-stage remote access trojan (RAT) a couple weeks later. In another environment, the RAT pulled down a third payload, IronBark, the same day.

What it looks like in a real environment

At first glance, QuartzLine looks like the potentially unwanted PDF and productivity apps many security teams see all the time. They’re annoying and hook themselves in aggressively, but they’re a risk some organizations are willing to accept.

QuartzLine is the case defenders worry about, where that grayware turns out to be a real backdoor. It fits the same pattern as the ManualFinder decoy apps and the fraudulent code-signing certificates behind fake PDF apps we’ve written about before, though we haven’t tied it to the same operators.

In at least four cases, the download passed through a redirector domain, and in two we confirmed it started with a Google Ads click. In others, we confirmed the user downloaded it but couldn’t see how they got there. Where we could see the search terms, users weren’t looking for a PDF viewer at all. They searched for things like a consent form or a wallpaper, landed on a third-party site, clicked an ad there, and got a working viewer with a backdoor inside.

In one environment, the full timeline looked like this:

• September 22: A user downloads QuartzLine_1.<version>.exe. Chrome pulls it from an Amazon Web Services (AWS) S3 bucket, linked from a referring site. The installer copies itself to %LOCALAPPDATA%\QuartzLine, creates a scheduled task named QuartzlineUpdateCheck, and starts checking in with westbeavers[.]com.
• September 29: The attacker drops chrome-history-summarizer-v0.0.1.exe, which uploads an archive of the user’s Chrome browsing history to an S3 bucket.
• October 5: A file named quartzline_takeover_carrier.exe lands on disk and deletes itself within a second.
• October 9: A PowerShell script, replaceInPlace.ps1, swaps quartzline.exe for a new build.
• October 10: A second script, deployApp.ps1, drops caira.exe, a RAT, plus a second scheduled task, CairaServiceCheck.
• October 14: The host looks up three new C2 domains.

How Expel detects QuartzLine

The first wave hit our queue on the evening of Friday, October 9, when the attacker pushed the second-stage RAT to infected hosts across multiple customers at once. A couple of analysts on shift escalated the issue to our Global Response Team. Together, they worked out what was going on, started shutting it down, and handed the next shift a watch list of the binaries and domains. On October 13, our SOC flagged the cluster to our threat intel team, which ingested internal and external indicators that same day, built endpoint and network detections, pushed them to testing within hours, and moved them to production on October 14.

Since then, CLOUDHAZE detections have fired dozens of times across customers in multiple industries, and several are confirmed incidents. We catch it on the endpoint (the implant itself) and on the network (contact with its C2 servers). 

Our SOC has investigated every hit and shared what we found with affected customers in Expel Workbench™, including the indicators below.

Why a blocked QuartzLine connection still means an infected device

QuartzLine runs with the user’s privileges, and the attacker can run any command they want through it. By the time the second-stage RAT landed in the environment above, the attacker had already sent Chrome data off the host and had a persistent foothold for weeks. As a precaution, treat any browser-stored passwords, cookies, and session tokens on an infected device as exposed.

A lot of the alerts we’re seeing come from DNS filters and web proxies blocking traffic to the C2 domains. Blocking that traffic is the right call. The device that made the request is still infected, though, and it’ll keep trying to connect every time the scheduled tasks run. In at least one case, we couldn’t trace the blocked traffic to any device with an endpoint detection and response (EDR) agent, so the network block was the only signal anyone had.

If one of our CLOUDHAZE alerts fired on traffic your tools already blocked, this is why we flagged it.

How to remove QuartzLine

1. Find the device. Map the source IP from your DNS or proxy logs to a host. Start with unmanaged devices and anything without EDR coverage.
2. Check for the scheduled tasks QuartzlineUpdateCheck, CairaServiceCheck, and IronbarkUpdateCheck.
3. Remove the apps from %LOCALAPPDATA%\QuartzLine, %LOCALAPPDATA%\Caira, and %LOCALAPPDATA%\IronBark and delete the scheduled tasks, or reimage the host.
4. Reset credentials and sign out active sessions for anyone who used an affected device.
5. Block the domains and hashes below at DNS, proxy, and EDR. C2 requests go to paths under /quarry/ (we’ve seen /quarry/geode and /quarry/talc, and the Rogue Authority teardown lists more), which is useful for proxy hunting. The teardown also notes that the backdoor sends no User-Agent header, which is unusual for desktop software.

Indicators of compromise

File names vary by deployment, so match on hashes and domains first.

Both task commands may also carry a –uid= value that’s unique to each infected host, so match on the task name and path, not the full command line.

What’s next?

If you have questions or see signs of this activity in your environment, reach out to our team.