Threat Profile
| Threat Name | CornFlake |
|---|---|
| Threat Type | Remote Access Trojan (RAT) |
| Platform | Windows (PE executable) |
| File Type | Windows PE (Portable Executable), typically compiled Go binary |
| Programming Language | Go (Golang) |
| Attribution | Storm-2945 (subcluster of Midnight Blizzard / APT29) |
| First Observed | 2025 (intelligence updated August 2026) |
| Known Aliases | CornFlake (primary), no widespread secondary names |
| Communication Protocol | TLS-wrapped TCP, JSON/binary messaging with AES-256-GCM encryption |
| Persistence Mechanism | Registry Run keys, scheduled tasks, service installation |
| Primary Targets | Government, defense, diplomatic entities; lateral spread to adjacent systems |
| Detection Rate | Moderate (~40–60% by generic heuristic engines); evolving variants evade signature-only scanners |
How It Spreads
CornFlake typically arrives through spear-phishing emails that impersonate trusted colleagues, vendors, or government agencies. The initial message contains either a malicious Office document with embedded macros or a link to a compromised website hosting an infected installer. Because the malware is compiled in Go—a language less commonly scrutinized by older antivirus signatures—it can slip past mail gateways that rely on pattern matching alone. Once the victim opens the attachment or runs the downloaded executable, CornFlake installs silently in the background, often displaying a decoy document or fake error message to hide the fact that anything unusual has occurred. After establishing its foothold on the first machine, CornFlake can propagate laterally across a local network. The attackers use stolen credentials harvested by the trojan's keylogging and password-dumping modules to authenticate to neighboring Windows systems, dropping copies of the payload into shared folders or using Windows Management Instrumentation (WMI) and PsExec-like techniques to execute remotely. Home offices that share drives with a main PC and small businesses with flat network topologies are especially vulnerable to this sort of internal spread. Common distribution vectors include: - **Spear-phishing attachments** — Word, Excel, or PDF files with embedded macro downloaders - **Watering-hole compromises** — legitimate websites infected with drive-by download scripts targeting specific visitor demographics - **Supply-chain insertion** — trojanized third-party software updates or installer bundles - **Lateral movement** — SMB file-copy and remote execution after credential theft on an already-compromised network - **Removable media** — USB drives carrying autorun payloads (less common but observed in air-gapped target scenarios)What It Does On Your Machine
Once executed, CornFlake performs an initial reconnaissance sweep: it collects the computer name, operating-system version, installed antivirus products, CPU and memory details, local user accounts, and the current user's privilege level. This system-information packet (identified in telemetry as opcode 0x5A) is immediately encrypted and sent to the attacker's command-and-control (C2) server over a TLS-encrypted TCP connection. The malware then registers persistence by writing itself into the Windows Registry under a Run key or creating a scheduled task that launches the payload at every logon or on a daily timer. A persistence-confirmation report (opcode 0x9E) is transmitted back to the C2 server once these modifications succeed. The trojan's communication design is particularly robust. Inside the outer TLS tunnel, CornFlake performs a custom handshake using length-prefixed JSON messages: the implant sends a "hello" beacon (0xAB), the server replies with an acknowledgment (0xAC), and the two parties then derive a unique AES-256-GCM session key via ephemeral Elliptic Curve Diffie-Hellman (P-256 ECDH) combined with a hardcoded secret baked into the malware binary. This layered encryption makes traffic analysis difficult—even if you capture the network packets, the command payloads inside the TLS stream remain opaque without the session key. Every 18 to 41 seconds (randomized to evade simple heartbeat-interval detection), CornFlake sends an encrypted heartbeat message (opcode 0xE7) with an empty payload to signal that it remains active and ready for tasking. Between heartbeats, the malware listens asynchronously for commands from the C2 server. Observed capabilities include file upload and download, process creation and termination, registry manipulation, screenshot capture, keylogging, and the ability to load additional plugin modules in memory without touching disk. Because the trojan is written in Go, its single executable bundles the entire Go runtime, resulting in larger file sizes (typically 5–12 MB) but also making reverse engineering more tedious for defenders. Below is a simplified illustration of observed file-system and registry artifacts from sandbox analysis:Manual Removal — Step by Step
Boot into Safe Mode with Networking
Restart the computer and press F8 (or Shift + restart on Windows 10/11, then Troubleshoot → Advanced → Startup Settings → Restart → 5). Safe Mode loads only essential drivers, preventing most malware—including CornFlake's persistence hooks—from launching automatically.
Run a Full Scan with Updated Antivirus
Update your antivirus definitions while in Safe Mode (use a USB drive with offline definitions if you remained fully offline). Launch a full system scan. Modern engines from Kaspersky, Bitdefender, ESET, and Malwarebytes have signatures for CornFlake, though detection names vary. Quarantine or delete every flagged item.
Inspect and Remove Persistence Entries
Open Registry Editor (regedit.exe) and navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. Look for entries with suspicious names (e.g., "WindowsDefender," "SystemUpdate") pointing to executables in Temp or Roaming folders. Delete the registry value, then locate and delete the referenced .exe file. Also open Task Scheduler (taskschd.msc) and review the task list for any unfamiliar entries that launch scripts or executables at logon.
Check Startup Folder and Services
Navigate to C:\Users\ and delete any .lnk or .exe files you don't recognize. Then open Services (services.msc) and look for entries with generic names and suspicious paths. Right-click, select Properties, and set Startup type to Disabled if the service is unfamiliar. Note the executable path and delete the file afterward.
Clear Temporary Files
CornFlake often stages itself in %TEMP% or %LOCALAPPDATA%. Open Disk Cleanup (cleanmgr.exe), select your system drive, check Temporary files and Temporary Internet Files, and run the cleanup. Alternatively, manually delete the contents of C:\Users\ and C:\Windows\Temp.
Reset All Passwords
Because CornFlake includes keylogging capabilities, assume every password typed since infection is compromised. Use a separate, known-clean device (a phone or another computer) to change passwords for email, banking, social media, and work accounts. Enable two-factor authentication wherever possible.
Review Installed Programs
Open Control Panel → Programs and Features and sort by Install Date. Uninstall any applications installed around the time symptoms began, especially those with generic publisher names or no publisher listed. CornFlake may have arrived bundled with a trojanized installer.
Check Browser Extensions and Proxy Settings
Open each installed browser, navigate to the extensions/add-ons page, and remove anything unfamiliar. Then check Internet Options → Connections → LAN settings to ensure no proxy server is configured (unless you intentionally use one). Malware sometimes routes traffic through a local proxy to intercept HTTPS.
Reboot, Scan Again, and Monitor
Restart into normal mode and run one final full scan with your antivirus and a secondary on-demand scanner like Malwarebytes or HitmanPro. If both come back clean, monitor Task Manager (Ctrl+Shift+Esc) and Resource Monitor for unusual CPU, disk, or network activity over the next few days. Watch for unexpected outbound connections on port 443 or DNS queries to unfamiliar domains.
Prevention
- Maintain up-to-date antivirus with behavioral detection. Choose a security suite that includes heuristic and machine-learning engines, not just signature matching. Golang malware like CornFlake can evade older pattern-based scanners.
- Enable and configure Windows Firewall (or a third-party firewall). Block inbound connections by default and review outbound rules to prevent unknown executables from phoning home. Consider an application-control whitelist if you run a business environment.
- Disable macros in Office documents by default. Navigate to File → Options → Trust Center → Trust Center Settings → Macro Settings and select "Disable all macros with notification." Only enable macros for documents from verified, trusted sources.
- Train yourself and employees to recognize phishing. Verify sender addresses carefully, hover over links before clicking, and never open unexpected attachments. When in doubt, contact the purported sender through a separate communication channel.
- Keep Windows and all software fully patched. Enable automatic updates for the operating system, browsers, and third-party applications. Attackers often exploit known vulnerabilities in outdated software to deliver initial payloads.
- Use a standard (non-admin) account for daily tasks. Run as a local administrator only when installing legitimate software. This limits malware's ability to write to system directories and install persistent services.
- Implement network segmentation. If you operate a small business or home office with multiple devices, isolate work systems from personal gadgets and guest Wi-Fi. Use VLANs or separate subnets to prevent lateral movement.
- Back up critical data offline. Store regular backups on an external drive that is disconnected when not in use, or use a cloud service with versioning and ransomware rollback features. This won't prevent infection, but it ensures you can recover without paying a ransom or losing files.
When Computer Repair Roswell removes malware from your machine, we guarantee our work for ninety days. If the same infection reappears within that window—and you haven't introduced new risk by disabling antivirus or visiting suspect sites—we will re-clean the system at no additional charge. We stand behind every repair.