'GoldenSpy' Malware Targets Businesses Operating in China

guest · Jun 25, 2020

'GoldenSpy' Malware Targets Businesses Operating in China
June 25, 2020
https://www.securityweek.com/goldenspy-malware-targets-businesses-operating-china

Dubbed GoldenSpy, the malware was observed as part of a campaign that supposedly started in April 2020, but some of the identified samples suggest the threat has been around since at least December 2016.

One of the compromised organizations, a global technology vendor that conducts government business in the US, Australia and UK, and which recently opened offices in China, became infected after installing “Intelligent Tax,” a piece of software from the Golden Tax Department of Aisino Corporation, which a local bank required for paying local taxes.

“Basically, it was a wide-open door into the network with SYSTEM level privileges and connected to a command and control server completely separate from the tax software’s network infrastructure,” Trustwave’s Vice President of Cyber Threat Detection & Response Brian Hussey explains.
Click to expand...

The malware was found to be digitally signed by a company called Chenkuo Network Technology, and to operate completely independent of the tax software.
On the compromised machines, GoldenSpy is downloaded and executed two hours after the tax software has been installed. The malware was observed installing two identical versions of itself, as persistent autostart services, and uses an exeprotector module to ensure persistence.
Click to expand...

Trustwave: The Golden Tax Department and the Emergence of GoldenSpy Malware

Trustwave SpiderLabs has discovered a new malware family, dubbed GoldenSpy, embedded in tax payment software that a Chinese bank requires corporations to install to conduct business operations in China
Click to expand...

guest · Jul 1, 2020

GoldenSpy' Malware Uninstaller Delivered to Victims Following Public Exposure
July 1, 2020
https://www.securityweek.com/golden...r-delivered-victims-following-public-exposure

Last week, Trustwave published information detailing the manner in which a hidden backdoor had been delivered to organizations via Intelligent Tax, a piece of software from Aisino Corporation that is required by a Chinese bank.

On June 28, just three days after Trustwave’s report went public, the Aisino Intelligent Tax product was observed silently pushing a new file onto infected systems, “AWX.exe.” This file was specifically designed to remove GoldenSpy and all traces of compromise, including registry entries and the malware’s files and folders, after which it would delete itself from the system.

“In our testing, this GoldenSpy uninstaller will automatically download and execute, and effectively, will negate the direct threat of GoldenSpy in your environment, however, as the deployment of this uninstaller is delivered directly from the supposedly legitimate tax software, this has to leave users of Intelligent Tax concerned about what else could be downloaded and executed in a similar manner,” Trustwave notes.
Click to expand...

Analysis of the uninstaller also revealed that it removes GoldenSpy following the exact malware removal steps that Trustwave included as recommendation in their report. This shows once again that the actor is fully aware of the attention it has received and wants to ensure it can hide its tracks to hinder further investigations.
Click to expand...

Trustwave: GoldenSpy: Chapter Two – The Uninstaller

On June 25, 2020 Trustwave SpiderLabs published research showing that the Intelligent Tax software, published by Aisino Corporation and required by a Chinese bank, actually contained a hidden backdoor that surrendered complete command and control of the victim’s network. This story received international news coverage and was widely discussed in security circles. To review the original blog post click here.
Click to expand...

Rasheed187 · Jul 4, 2020

mood said: ↑

'GoldenSpy' Malware Targets Businesses Operating in China
June 25, 2020
https://www.securityweek.com/goldenspy-malware-targets-businesses-operating-china

Trustwave: The Golden Tax Department and the Emergence of GoldenSpy Malware
Click to expand...

Scary stuff, and once again a reminder to always use behavior blocking software. Don't blindly trust any app!

guest · Jul 16, 2020

Malware stashed in China-mandated software is more extensive than thought
July 14, 2020
https://arstechnica.com/information...ated-software-is-more-extensive-than-thought/

Three weeks ago, security researchers exposed a sinister piece of malware lurking inside tax software that the Chinese government requires companies to install. Now there’s evidence that the high-stealth spy campaign was preceded by a separate piece of malware that employed equally sophisticated means to infect taxpayers in China.

The malware is able to bypass the User Account Control, the Windows mechanism that requires users to give their approval before software can install programs or make other system changes. Once that’s done, GoldenSpy can install modules with System-level privileges. Trustwave published its findings on Tuesday here.
Click to expand...

The discovery comes three weeks after Trustwave exposed GoldenSpy, a piece of advanced spyware company researchers found installed on the network of a large multinational technology company that had just opened offices in China. Like GoldenHelper, GoldenSpy employed the same installation modus operandi—through the Golden Tax Project.

Unlike the investigation into GoldenSpy, Trustwave researchers have yet to find samples of the final payload installed by GoldenHelper. The filename is taxver.exe.
Click to expand...

Trustwave: GoldenSpy Chapter 4: GoldenHelper Malware Embedded in Official Golden Tax Software

Directly preceding GoldenSpy, another malware family was used to covertly access the networks of companies doing business in China.
Click to expand...

guest · Jul 24, 2020

FBI warns US companies about backdoors in Chinese tax software
Following the GoldenHelper and GoldenSpy malware reports, the FBI is now warning US companies operating in China
July 24, 2020
https://www.zdnet.com/article/fbi-warns-us-companies-about-backdoors-in-chinese-tax-software/

The US Federal Bureau of Investigation has sent an alert on Thursday warning US companies about backdoor malware that is silently being installed on the networks of foreign companies operating in China via government-mandated tax software.
The backdoors allow threat actors to execute unauthorized code, infiltrate networks, and steal proprietary data from branches operating in China.

Unfortunately, these are the only government-authorized tax software service providers allowed to operate VAT software in China, officials said, suggesting that any foreign company operating in China was most likely affected by this issue.
FBI ALERT LINKED TO GOLDENHELPER AND GOLDENSPY REPORTS
The FBI alert also listed two separate incidents where the infected companies have discovered the malware's presence on their networks.
Click to expand...

The FBI warns US companies that the backdoor malware installed on their systems has dangerous capabilities that may allow "cyber actors to preposition to conduct remote code execution and exfiltration activities on the victim's network."

Indicators of compromises, such as malware file hashes and network communication URLs, that may help companies identify the presence of any of the two backdoor versions are available in Trustwave's GoldenHelper and GoldenSpy reports.
Click to expand...

guest · Aug 17, 2020

Multiple Uninstallers Released for China-Linked 'GoldenSpy' Malware
August 17, 2020
https://www.securityweek.com/multiple-uninstallers-released-china-linked-goldenspy-malware

The GoldenSpy malware was initially detailed in late June, and was likely deployed since April 2020, via an official tax application that foreign companies doing business in China are required to install. The financial software worked as expected, but it also installed a hidden backdoor.
Called GoldenSpy, the backdoor was later found to have been preceded by GoldenHelper, another malware family silently installed via official Chinese tax software.

Today, Trustwave revealed that a total of five GoldenSpy uninstallers have been released to date, some of which have been uploaded to public repositories, thus increasing their detection rates.

“[...] What we found is that they are continuing to push new GoldenSpy uninstallers – so far we have discovered five variants totaling 24 uninstaller files,” Trustwave says.
Click to expand...

The investigation also revealed that the code would use the IP 39[.]98[.]110[.]234 for a third stage beacon, and the security researchers linked the address to Ningbo Digital Technology Co., Ltd, a company that claims to provide technical support for professional companies and technology service providers.
Ningbo Digital Technology says it’s offering the uninstaller as “Enterprise service environment detection and cleaning software.”

“Based on these findings, we can say that Ningbo Digital Technology Co., Ltd is involved with the development of the ‘GoldenSpy Uninstaller’ and ningzhidata[.]com serving from CDN servers,” Trustwave concludes.
Click to expand...

Trustwave: GoldenSpy Chapter 5 : Multiple GoldenSpy Uninstaller Variants Discovered

This research depicting regular improvements of the GoldenSpy uninstaller should serve as a wakeup call for organizations because it proves any actions including implanting and extracting malware can be taken covertly and at the will of the attacker with the help of the updater module without impacting the functionality of the Golden Tax software.
Click to expand...

Log in or Sign up

'GoldenSpy' Malware Targets Businesses Operating in China

guest Guest

guest Guest

Rasheed187 Registered Member

guest Guest

guest Guest

guest Guest

Log in or Sign up

'GoldenSpy' Malware Targets Businesses Operating in China

guest Guest

guest Guest

Rasheed187 Registered Member

guest Guest

guest Guest

guest Guest

Useful Searches