DRBControl Espionage Operation Hits Gambling, Betting Companies

guest · Feb 19, 2020

DRBControl Espionage Operation Hits Gambling, Betting Companies
February 19, 2020
https://www.bleepingcomputer.com/ne...ge-operation-hits-gambling-betting-companies/

An advanced threat actor has been targeting gambling and betting companies in multiple regions of the globe with malware that links to two Chinese hacker groups.

Named "DRBControl" by security researchers, the group uses malware not publicly reported before. The mission appears to be cyberespionage, stealing databases and source code from the targets being part of the operation.
Malware arsenal
The group combines in its attacks both common and custom malware and exploitation tools. From the discovered arsenal, stood out two main backdoors (Type 1 and Type 2) with rich capabilities that were previously unknown to the researchers.
An interesting detail in a recent version of this backdoor is that it relies on Dropbox service to deliver various payloads and store information stolen from compromised hosts as well as commands, results, and heartbeats.

Other malware used by the group includes a modified version of PlugX RAT, Trochilus RAT, keyloggers using the Microsoft Foundation Class (MFC) library, the HyperBro backdoor, and a Cobalt Strike sample.
Click to expand...

Connection to Chinese APT groups
Although the new malware indicates that DRBControl is a new threat actor, Trend Micro's analysis found connections to Winnti and Emissary Panda (a.k.a. BRONZE UNION, APT27, Iron Tiger, LuckyMouse).
The former is motivated by profit and the second engages in cyberespionage operations; both are associated with Chinese hackers and have been active since at least 2010.

The researchers cannot say with high confidence if DRBControl is a new actor or a splinter from an old one but the evidence they found points to a connection to other groups with Chinese origins that have been attacking for at least a decade.
Click to expand...

Trend Micro: Operation DRBControl - Uncovering a Cyberespionage Campaign Targeting Gambling Companies in Southeast Asia
(PDF - 3.07 MB): https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf

Log in or Sign up

DRBControl Espionage Operation Hits Gambling, Betting Companies

guest Guest

Log in or Sign up

DRBControl Espionage Operation Hits Gambling, Betting Companies

guest Guest

Useful Searches