China's APT hackers move to ransomware attacks

guest · Jan 4, 2021

China's APT hackers move to ransomware attacks
January 4, 2021
https://www.bleepingcomputer.com/news/security/chinas-apt-hackers-move-to-ransomware-attacks/

Security researchers investigating a set of ransomware incidents at multiple companies discovered malware indicating that the attacks may be the work of a hacker group believed to operate on behalf of China.

Although the attacks lack the sophistication normally seen with advanced threat actors, there is strong evidence linking them to APT27, a group normally involved in cyber espionage campaigns, also known as TG-3390, Emissary Panda, BRONZE UNION, Iron Tiger, and LuckyMouse.
Click to expand...

Abusing Windows BitLocker
The attacks happened in 2020 and directly targeted at least five companies in the online gambling sector that operate globally and successfully encrypted several core servers.

Analyzing the attacks revealed malware samples linked to DRBControl, a campaign described earlier this year in a report from Trend Micro and attributed to APT27 and Winnti, both groups active since at least 2010 and associate with Chinese hackers. If APT27 focuses on cyberespionage, Winnti is known for its financial motivation.
Click to expand...

In a joint report shared with BleepingComputer, Profero and Security Joes share evidence pointing to these two groups saying that they found a sample of the Clambling backdoor similar to the one used in the DRBControl campaign.
Click to expand...

Although a cyberespionage group engaging in a financially-motivated campaign is unusual, this attack would not be the first time APT27 deploys ransomware on victim systems.
Researchers at Positive Technologies attributed a Polar ransomware attack from April 2020 to APT27, based on the use of malware normally used by this group.
Click to expand...

APT27 Turns to Ransomware

At the peak of the COVID-19 pandemic and economic crisis, our Global Incident Response and Cyber Crisis Management teams were engaged on several fronts around the world, fighting cybercrime, and even nation-state actors.

The following report tells the story of one of these engagements and how again, the thin line between nation-states and cybercrime was crossed.

The full report “APT27 Turns to Ransomware” can be downloaded directly (un-gated) from the following link:
https://shared-public-reports.s3-eu-west-1.amazonaws.com/APT27+turns+to+ransomware.pdf
Click to expand...

Log in or Sign up

China's APT hackers move to ransomware attacks

guest Guest

Log in or Sign up

China's APT hackers move to ransomware attacks

guest Guest

Useful Searches