Tinymet

TinyMet is a type of malware, specifically a tiny, flexible Meterpreter stager, that can infiltrate systems and cause significant damage. It has been used by threat actors like GOLD TAHOE to retrieve the TinyMet Meterpreter stager in Clop ransomware incidents. This harmful program can infect your system through suspicious downloads, emails, or websites and once inside, it can steal personal information, disrupt operations, or even hold your data hostage for ransom. The malware was observed being executed with the command c:\intel\wsus.exe 1 91.214.124[.]20 43434, indicating a reverse HTTP connection, and connected to a malicious IP address by either renaming a binary or providing specific arguments. The investigation into these incidents revealed that the threat actor has a possible link to the TinyMet Payload v0.2. This payload was previously used by Clop Ransomware as a precursor for the TA505 Post-Exploitation Operation. The use of this payload indicates a sophisticated level of attack planning and execution, suggesting that the threat actors are experienced and highly skilled. Our team discovered a file named wsus.exe, which appears to be a version of TinyMet, along with three additional files that were created and executed on the first compromised system. This file primarily operates as a version of TinyMet—an open-source Meterpreter stager—but the actors also have the option to store and execute any binary loaded into the table. This flexibility allows the threat actors to adapt their approach based on the specific vulnerabilities of the targeted system.