Procedure examples

SPAWNCHIMERA has extracted the device’s Linux kernel image (vmlinux).

SPAWNCHIMERA has encoded a private key with XOR. SPAWNCHIMERA has also encrypted data to be extracted using AES encryption.

SPAWNCHIMERA has modified the boot process files within `/tmp/coreboot_fs/bin/init` to establish persistence.

SPAWNCHIMERA has monitored and filtered network traffic on compromised edge devices, allowing legitimate traffic to pass while redirecting attacker-controlled traffic to infrastructure under adversary control.

SPAWNCHIMERA has executed only in memory and hooked itself into existing processes on the victim device to include the web process.

SPAWNCHIMERA has searched for running processes to include web or dsmdm.

SPAWNCHIMERA has searched the contents of two Python files scanner.py and scanner_legacy.py by searching for specific lines and replacing them with values that reduce their ability to track mismatches or new files.

SPAWNCHIMERA has deleted generated files and folders from victim devices.

SPAWNCHIMERA has updated the timestamp using the `touch` command.

SPAWNCHIMERA has obtained system information such as release, uptime, and current time.

SPAWNCHIMERA has decoded a XOR encoded private key.

SPAWNCHIMERA has fixed a buffer overflow vulnerability (CVE-2025-0282) by hooking the strncpy function and limiting the size to 256 to prevent other actors from leveraging the exploit. SPAWNCHIMERA has converted its process name to hexadecimal and verifies an added value which is triggered when the first byte of the source copied to the fixed strncpy function matches `0x04050203`.

SPAWNCHIMERA has created web shells that facilitate actions on the victim host.

SPAWNCHIMERA has checked where SELinux is enabled on the targeted host.

SPAWNCHIMERA has generated RSA keys against modified files to sign the manifest file, so they appear legitimate.

SPAWNCHIMERA has leveraged IPC using a UNIX domain socket between the dsmdm process and the web process.

SPAWNCHIMERA has the ability to bind on a localhost and listen on port 8300.

SPAWNCHIMERA has created SSH tunnels to facilitate C2 communications.

SPAWNCHIMERA can persist across system upgrades by hijacking the execution flow of dspkginstall, a binary used during the system upgrade process.

SPAWNCHIMERA has been compiled as a Position Independent Executable (PIE) to use a third-party library for injection.

SPAWNCHIMERA has used delayed execution to pause for a defined interval before performing environment discovery, repeatedly checking for specific processes, such as the `dslogserver` process, prior to continuing execution.

SPAWNCHIMERA has modified the Ivanti Integrity Checker Tool to evade detection.

SPAWNCHIMERA has disabled logging and log forwarding on Ivanti devices targeting the `dslogserver` process.