New Chinese Spyware Being Used in Widespread Cyber Espionage Attacks

Cyber Security

Products You May Like

A threat actor presumed to be of Chinese origin has been linked to a series of 10 attacks targeting Mongolia, Russia, Belarus, Canada, and the U.S. from January to July 2021 that involve the deployment of a remote access trojan (RAT) on infected systems, according to new research.

The intrusions have been attributed to an advanced persistent threat named APT31 (FireEye), which is tracked by the cybersecurity community under the monikers Zirconium (Microsoft), Judgement Panda (CrowdStrike), and Bronze Vinewood (Secureworks).

Stack Overflow Teams

The group is a “China-nexus cyber espionage actor focused on obtaining information that can provide the Chinese government and state-owned enterprises with political, economic, and military advantages,” according to FireEye.

Positive Technologies, in a write-up published Tuesday, revealed a new malware dropper that was used to facilitate the attacks, including the retrieval of next-stage encrypted payloads from a remote command-and-control server, which are subsequently decoded to execute the backdoor.

The malicious code comes with the capacity to download other malware, potentially putting affected victims at further risk, as well as perform file operations, exfiltrate sensitive data, and even delete itself from the compromised machine.

“The code for processing the [self-delete] command is particularly intriguing: all the created files and registry keys are deleted using a bat-file,” Positive Technologies researchers Denis Kuvshinov and Daniil Koloskov said.

Enterprise Password Management

Also worthy of particular note is the malware’s similarities to that of a trojan named DropboxAES RAT that was put to use by the same threat group last year and relied on Dropbox for its command-and-control (C2) communications, with numerous overlaps found in the techniques and mechanisms used to inject the attack code, achieve persistence, and the mechanism employed to delete the espionage tool.

“The revealed similarities with earlier versions of malicious samples described by researchers, such as in 2020, suggest that the group is expanding the geography of its interests to countries where its growing activity can be detected, Russia in particular,” the researchers concluded.

Products You May Like

Articles You May Like

Mismatched Season 2 Trailer Release Date Set for September 21
Amazon Great Indian Festival 2022 Sale Goes Live: Best Offers on TVs, Accessories
Flipkart Big Billion Days 2022 Sale: Best Smartphone Offers
Google Pixel 7, Pixel 7 Pro Pre-Orders Start on October 6, Pixel Watch Launch Also Teased
Tech stocks just had their worst two-week stretch since the start of the pandemic

Leave a Reply

Your email address will not be published.