PortDoor: New Chinese APT Backdoor Attack Targets Russian Defense Sector

guest · Apr 30, 2021

Suspected Chinese state hackers target Russian submarine designer
April 30, 2021
https://www.bleepingcomputer.com/ne...te-hackers-target-russian-submarine-designer/

Hackers suspected to work for the Chinese government have used a new malware called PortDoor to infiltrate the systems of an engineering company that designs submarines for the Russian Navy.

The method for delivering the backdoor was a weaponized RTF document attached to an email addressed to the company CEO, Igor V. Vilnit.
Threat researchers at Cybereason Nocturnus found that the attacker lured the recipient to open the malicious document with a general description for an autonomous underwater vehicle.
Click to expand...

Digging deeper, the researchers discovered that the RTF file had been weaponized using RoyalRoad, a tool for building malicious documents to exploit multiple vulnerabilities in Microsoft’s Equation Editor.

Cybereason’s attribution of PortDoor does not come with a high level of confidence. The researchers are aware that other groups may be behind this malware. Current evidence, though, points to an attacker of Chinese origin.

“Lastly, we are also aware that there could be other groups, known or yet unknown, that could be behind the attack and the development of the PortDoor backdoor. We hope that as time goes by, and with more evidence gathered, the attribution could be more concrete” - Cybereason
Click to expand...

Cybereason: Suspected Chinese state hackers target Russian submarine designer

Key Findings
• RoyalRoad Variants are Under Development: The variant of the RoyalRoad weaponizer examined altered its encoded payload from the known “8.t” file to a new filename: “e.o”. More new variants are likely to be under development as well.
• Previously Undocumented Backdoor: The newly discovered RoyalRoad RTF variant examined also drops a previously undocumented and stealthy backdoor dubbed PortDoor which is designed with obfuscation and persistence in mind.
• Highly Targeted Attack: The threat actor is specifically targeting the Rubin Design Bureau, a part of the Russian defense sector designing submarines for the Russian Federation’s Navy.
• Extensive Malware Capabilities: Portdoor has multiple functionalities, including the ability to do reconnaissance, target profiling, delivery of additional payloads, privilege escalation, process manipulation static detection antivirus evasion, one-byte XOR encryption, AES-encrypted data exfiltration and more.
• APT Group Operating on Behalf of Chinese State Interests: The accumulated evidence such as the infection vector, social engineering style, use of RoyalRoad against similar targets, and other similarities between the newly discovered backdoor sample and other known Chinese APT malware all bear the hallmarks of a threat actor operating on behalf of Chinese state-sponsored interests.
Click to expand...

Log in or Sign up

PortDoor: New Chinese APT Backdoor Attack Targets Russian Defense Sector

guest Guest

Log in or Sign up

PortDoor: New Chinese APT Backdoor Attack Targets Russian Defense Sector

guest Guest

Useful Searches