Chinese hackers use decade-old Bisonal Trojan in cyberespionage campaigns

guest · Mar 5, 2020

Chinese hackers use decade-old Bisonal Trojan in cyberespionage campaigns
March 5, 2020
https://www.zdnet.com/article/chine...old-bisonal-trojan-to-strike-russian-targets/

Chinese cyberattackers continue to improve and deploy a decade-old Remote Access Trojan (RAT) in ongoing campaigns against Russian, Japanese, and South Korean targets.

On Thursday, researchers from Cisco Talos said that the Bisonal RAT is an unusual sample of malware that has been improved, rolled back, and refined over a period of 10 years, an uncommon practice by threat actors who more often will overhaul their weapons arsenal with new tools and software over time.

In a report shared exclusively with ZDNet ahead of publication, Talos said the Trojan has been linked to Tonto Team, a suspected Chinese state-sponsored Advanced Persistent Threat (APT) group belonging to the Chinese military.

"Their campaigns had very specific targets which would suggest their end game was more around operational intelligence gathering and espionage," Talos says.
Click to expand...

The first stage of the attack chain is usually a spear-phishing email, sometimes bolstered via social engineering, containing a lure document.
First compiled on December 24, 2010, the oldest version of the Trojan was its most simple variant; designed as malware which used a Windows API to execute threads containing the code of the malware.
[...]
"The development of Bisonal has been active for over a decade," the researchers say. "Specific functions are still used today, many years after the original implementation of the Bional malware. Even if Bisonal could be considered as simple with less than 30 functions, it has spent its life targeting sensitive entities in both the public and private sectors. We don't see any reason why this actor will stop in the near future."
Click to expand...

Cisco Talos: Bisonal: 10 years of play

guest · Aug 13, 2020

CactusPete Targets Eastern European Military
August 13, 2020
https://www.infosecurity-magazine.com/news/cactuspete-targets-eastern/

An advanced persistent threat actor (APT) group has been caught cyber-spying on financial and military organizations in Eastern Europe.
CactusPete, also known as Karma Panda or Tonto Team, has been active since at least 2012 but appears to have ramped up its activities over the past year and a half.

Researchers at Kaspersky were able to link hundreds of samples of a backdoor called Bisonal to a campaign orchestrated by CactusPete. The samples appeared between March 2019 and April 2020 at a pace of around 20 samples per month, which researchers believe "underscores the fact that CactusPete is developing rapidly."
Click to expand...

The threat group's most recent wave of activity was first detected by researchers in February 2020, when they discovered an updated version of Bisonal.

"This time, they’ve upgraded their backdoor to target organizations in the military and financial sectors in Eastern Europe, most likely in an effort to gain access to confidential information," wrote researchers.
They believe that CactusPete is on the hunt for "highly sensitive information" and warned organizations in the Eastern European region to be on alert.

"In addition, as the operators move deeper into the infected system, they deploy keyloggers to harvest credentials and download privilege escalation malware to gradually gain more and more control over the system."
Click to expand...

Kaspersky: CactusPete APT group’s updated Bisonal backdoor

Log in or Sign up

Chinese hackers use decade-old Bisonal Trojan in cyberespionage campaigns

guest Guest

guest Guest

Log in or Sign up

Chinese hackers use decade-old Bisonal Trojan in cyberespionage campaigns

guest Guest

guest Guest

Useful Searches