QuartzLine: A working PDF viewer with a backdoor inside

QuartzLine (tracked as CLOUDHAZE by Mandiant) is a malicious Windows PDF viewer that conceals a backdoor enabling command execution and malware deployment. It has been observed under filenames paperline.exe and fielddesk.exe, signed with a revoked EV certificate. Distribution occurs through malvertising, where users are tricked into downloading the viewer from AWS S3 buckets. After installation, QuartzLine establishes persistence via scheduled tasks and communicates with its command-and-control infrastructure. Attack chains include Chrome data theft shortly after infection and subsequent deployment of second-stage RATs such as Caira and IronBark. The backdoor runs with user-level privileges and supports arbitrary Windows command execution.

QuartzLine enables attackers to maintain persistent access on infected Windows systems with user-level privileges. It facilitates arbitrary command execution and deployment of additional malware, including remote access trojans, which can lead to data theft (e.g., Chrome browser data) and further compromise. The use of a revoked legitimate EV certificate may aid in evading detection. The malware's persistence and communication with command-and-control infrastructure allow ongoing attacker control.

No official patch or remediation is available for QuartzLine as it is malware rather than a software vulnerability. Mitigation focuses on preventing infection by avoiding downloads from untrusted sources and malicious advertisements. Security teams should block known malicious domains and hashes associated with QuartzLine, monitor for scheduled tasks indicative of persistence, and use endpoint detection tools to identify and remove the malware. Since the malware uses a revoked EV certificate, validating code-signing certificates and blocking those revoked can help reduce risk.