Chinese Hackers Escalate Attacks Against India and Hong Kong Amid Tensions

mood · Jul 21, 2020

Chinese Hackers Escalate Attacks Against India and Hong Kong Amid Tensions
July 21, 2020
https://thehackernews.com/2020/07/chinese-hackers-hong-kong-india.html

An emerging threat actor out of China has been traced to a new hacking campaign aimed at government agencies in India and residents of Hong Kong intending to steal sensitive information, cybersecurity firm Malwarebytes revealed in the latest report shared with The Hacker News.

Attributing the attack with "moderate confidence" to a new Chinese APT group, Malwarebytes said they were able to track their activities based on the "unique phishing attempts" designed to compromise targets in India and Hong Kong.

"The lures used in this campaign indicate that the threat actor may be targeting the Indian government and individuals in Hong Kong, or at least those who are against the new security law issued by China," the firm said.
Click to expand...

Using Spear-Phishing to Install MgBot Malware
The emails come attached with a "Mail security check.docx" purportedly from the Indian Government Information Security Center. Upon opening, it employs template injection to download a remote template and execute a heavily obfuscated variant of Cobalt Strike.
But a day after the aforementioned attack, the operators swapped out the malicious Cobalt Strike payload for an updated version of MgBot malware.
A RAT With Several Capabilities
The dropped loader ("ff.exe") masquerades as a Realtek Audio Manager tool and contains four embedded resources, two of which are written in Simplified Chinese.

Ultimately, it's this final malware executable ("pMsrvd.dll") that's used to conduct the malicious activities, which it does by posing as a "Video Team Desktop App."
Click to expand...

Malwarebytes: Chinese APT group targets India and Hong Kong using new variant of MgBot malware

mood · Sep 24, 2021

Report: Suspected Chinese Hack Targets Indian Media, Gov't
September 23, 2021
https://www.securityweek.com/report-suspected-chinese-hack-targets-indian-media-govt

The Insikt Group, the threat research division of Massachusetts-based Recorded Future, said the hacking group, given the temporary name TAG-28, made use of Winnti malware, which it said is exclusively shared among several Chinese state-sponsored activity groups.

In its report, the Insikt Group suggested the cyberattack could be related to those border tensions.

“As of early August 2021, Recorded Future data shows a 261% increase in the number of suspected state-sponsored Chinese cyber operations targeting Indian organizations and companies already in 2021 compared to 2020,” the organization said in a report.
The Insikt Group said it detected four IP addresses assigned to the Bennett Coleman And Co. Ltd. media company in “sustained and substantial network communications” with two Winnti servers between February and August.
It said is observed approximately 500 megabytes of data being extracted from the network of the privately owned Mumbai company, whose publications include The Times of India.
Click to expand...

As the group was investigating the Bennett Coleman hack, it said it also identified a compromise in June and July of the Unique Identification Authority of India, or UIDAI, the government agency that oversees the national identification database.

In that case, it detected about 10 megabytes of data downloaded from the network and almost 30 megabytes uploaded, “possibly indicating the deployment of additional malicious tooling from the attacker infrastructure.”
It suggested such a database could be used by hackers to identify “high-value targets, such as government officials, enabling social engineering attacks or enriching other data sources.”
Click to expand...

Insikt Group: China-Linked Group TAG-28 Targets India’s “The Times Group” and UIDAI (Aadhaar) Government Agency With Winnti Malware

Following this theme of Chinese targeting of Indian entities, we have identified further suspected intrusions targeting the Indian media conglomerate Bennett Coleman And Co Ltd (BCCL), commonly known as “The Times Group”; the Unique Identification Authority of India (UIDAI); and the Madhya Pradesh Police department. The UIDAI is the Indian government agency responsible for the national identification database, more commonly called “Aadhaar”, which contains private biometric information for over 1 billion Indian citizens. These intrusions were conducted by an activity group we track using a temporary designation, TAG-28.
Click to expand...

Log in or Sign up

Chinese Hackers Escalate Attacks Against India and Hong Kong Amid Tensions

mood Updates Team

mood Updates Team

Log in or Sign up

Chinese Hackers Escalate Attacks Against India and Hong Kong Amid Tensions

mood Updates Team

mood Updates Team

Useful Searches