Hacking Group Using Fresh DLL Side-Loading Attack

guest · Nov 4, 2020

Mysterious APT Leaves Curious ‘KilllSomeOne’ Clue
APT cloaks identity using script-kiddie messages and advanced deployment and targeting techniques
November 4, 2020
https://threatpost.com/apt-leaves-killlsomeone-clue/160975/

Researchers are scratching their heads when it comes to unmasking a new advanced persistent threat (APT) group targeting non-governmental organizations in the Southeast Asian nation Myanmar (formerly Burma).

Based on crude messages, such as “KilllSomeOne”, used in attack code strings, coupled with advanced deployment and targeting techniques, they say the APT has a split personality.

“The messages hidden in their samples [malware] are on the level of script kiddies. On the other hand, the targeting and deployment is that of a serious APT group,” wrote Gabor Szappanos, author of a Sophos technical brief, posted Wednesday, outlining what is known about the APT.
Szappanos wrote that the gang relies primarily on a cyberattack technique known as DLL side-loading. This preferred method of attack gained popularity in China in 2013. That fact, coupled with ongoing border-tensions between ethnic Chinese rebels and Myanmar military, suggest that the gang is a Chinese APT, researchers believe.
Click to expand...

Four distinct DLL side-loading scenarios deliver either a shell payload (allowing an adversary to run commands on targeted systems) or plant a “complex set of malware” on systems, researchers said.

“Side-loading is the use of a malicious DLL spoofing a legitimate one, relying on legitimate Windows executables to load and execute the malicious code,” describes Sophos.
Click to expand...

“The cases are connected by a common artifact: the program database (PDB) path. All samples share a similar PDB path, with several of them containing the folder name ‘KilllSomeOne,'” researchers wrote.
Click to expand...

Sophos: A new APT uses DLL side-loads to “KilllSomeOne”

A group of targeted attacks takes a different spin on methods first seen in PlugX APT operations
The types of perpetrators behind targeted attacks in general are not a homogeneous pool. They come with very different skill sets and capabilities. Some of them are highly skilled, while others don’t have skills that exceed the level of average cybercriminals.

The group responsible for the attacks we investigated in this report don’t clearly fall on either end of the spectrum. They moved to more simple implementations in coding—especially in encrypting the payload—and the messages hidden in their samples are on the level of script kiddies. On the other hand, the targeting and deployment is that of a serious APT group.
Click to expand...

Log in or Sign up

Hacking Group Using Fresh DLL Side-Loading Attack

guest Guest

Log in or Sign up

Hacking Group Using Fresh DLL Side-Loading Attack

guest Guest

Useful Searches