New Chinese Spyware Being Used in Widespread Cyber Espionage Attacks

guest · Aug 4, 2021

New Chinese Spyware Being Used in Widespread Cyber Espionage Attacks
August 4, 2021
https://thehackernews.com/2021/08/new-chinese-spyware-being-used-in.html

A threat actor presumed to be of Chinese origin has been linked to a series of 10 attacks targeting Mongolia, Russia, Belarus, Canada, and the U.S. from January to July 2021 that involve the deployment of a remote access trojan (RAT) on infected systems, according to new research.

The intrusions have been attributed to an advanced persistent threat named APT31 (FireEye), which is tracked by the cybersecurity community under the monikers Zirconium (Microsoft), Judgement Panda (CrowdStrike), and Bronze Vinewood (Secureworks).

The group is a "China-nexus cyber espionage actor focused on obtaining information that can provide the Chinese government and state-owned enterprises with political, economic, and military advantages," according to FireEye.
Click to expand...

Positive Technologies, in a write-up published Tuesday, revealed a new malware dropper that was used to facilitate the attacks, including the retrieval of next-stage encrypted payloads from a remote command-and-control server, which are subsequently decoded to execute the backdoor.

The malicious code comes with the capacity to download other malware, potentially putting affected victims at further risk, as well as perform file operations, exfiltrate sensitive data, and even delete itself from the compromised machine.
Click to expand...

Positive Technologies: APT31 new dropper. Target destinations: Mongolia, Russia, the U.S., and elsewhere

Conclusion
In the study PT ESC specialists analyzed new versions of the malware used by APT31 in attacks from January to July this year. The revealed similarities with earlier versions of malicious samples described by researchers, such as in 2020, suggest that the group is expanding the geography of its interests to countries where its growing activity can be detected, Russia in particular. We believe that further instances will be revealed soon of this group being used in attacks, including against Russia, along with other tools that might be identified by code correspondence or network infrastructure.
Click to expand...

Log in or Sign up

New Chinese Spyware Being Used in Widespread Cyber Espionage Attacks

guest Guest

Log in or Sign up

New Chinese Spyware Being Used in Widespread Cyber Espionage Attacks

guest Guest

Useful Searches