Foreign APT Groups ‘Weaponize’ Coronavirus Data to drop RAT Malware

guest · Mar 13, 2020

Chinese Hackers ‘Weaponize’ Coronavirus Data For New Cyber Attack
March 12, 2020
https://www.forbes.com/sites/zakdof...navirus-data-to-launch-this-new-cyber-attack/

Well, Chinese state-sponsored hackers are keen to get in on the act—at least according to the team at Check Point. In research published today, March 12, the firm exposes a Chinese APT, which it says has “weaponized” documents “to deliver previously unknown malware.”

Check Point told me its research team had intercepted “a targeted cyber-attack by a Chinese APT group on a public sector entity of Mongolia.” An attack which “leveraged the coronavirus pandemic.”
In this example of social engineering at the highest level, the APT sent two documents, “one related to COVID-19, both impersonating the Mongolian Ministry of Foreign Affairs in the form of press briefings.” Those documents contained unique, remote access malware.

We have now seen multiple malware attacks framed under similar advisory notices—this is the first, though, that can be attributed to state-sponsored hackers in a campaign against an overseas government.
Click to expand...

Check Point attributes this to an unnamed Chinese APT group, which it links to previous operations “dating back to at least 2016—targeting different sectors in multiple countries, such as Ukraine, Russia, and Belarus.”

The RTF files were “weaponized” by RoyalRoad, which “is commonly used by Chinese threat actors,” and which exploits “the Equation Editor vulnerabilities of Microsoft Word.”
Click to expand...

Check Point Research: Vicious Panda: The COVID Campaign

guest · Mar 16, 2020

Foreign APT groups use coronavirus phishing lures to drop RAT malware
March 16, 2020
https://www.scmagazine.com/home/sec...ronavirus-phishing-lures-to-drop-rat-malware/

Fake Indian Health Advisory spreads Crimson RAT
APT36, a reputed Pakistani APT group with designs on Indian targets, has launched an email-based spear phishing campaign that delivers the Crimson RAT trojan via links to a malicious document that purports to come from the Indian government.

The document reads like a health advisory for businesses and training institutions, according to the Malwarebytes research team in a blog post that cites previous reporting from the Red Drip team.
Opening the document and enabling the hidden macros begins the infection chain that drops the RAT, which can steal browser-based credentials, gather victim machine information, capture screenshots, leverage TCP protocol for C2 communications and more.
‘Vicious Panda’ campaign delivers RAT via phony Mongolian government announcement
Suspected Chinese actors have been targeting the Mongolian public sector with a newly discovered malware implant, spread via several malicious documents, including one that looks like a fake coronavirus press release sent by the Mongolian Ministry of Foreign Affairs. [...]
Click to expand...

Malwarebytes: APT36 jumps on the coronavirus bandwagon, delivers Crimson RAT

Log in or Sign up

Foreign APT Groups ‘Weaponize’ Coronavirus Data to drop RAT Malware

guest Guest

guest Guest

Log in or Sign up

Foreign APT Groups ‘Weaponize’ Coronavirus Data to drop RAT Malware

guest Guest

guest Guest

Useful Searches