Home Security Asian Governments and Organizations Focused in Newest Cyber Espionage Assaults

Asian Governments and Organizations Focused in Newest Cyber Espionage Assaults

by crpt os


Government and state-owned organizations in a number of Asian countries have been targeted by a distinct group of espionage hackers as part of an intelligence gathering mission that has been underway since early 2021.

“A notable feature of these attacks is that the attackers leveraged a wide range of legitimate software packages in order to load their malware payloads using a technique known as DLL side-loading,” the Symantec Threat Hunter team, part of Broadcom Software, said in a report shared with The Hacker News.

The campaign is said to be exclusively geared towards government institutions related to finance, aerospace, and defense, as well as state-owned media, IT, and telecom firms.

Dynamic-link library (DLL) side-loading is a popular cyberattack method that leverages how Microsoft Windows applications handle DLL files. In these intrusions, a spoofed malicious DLL is planted in the Windows Side-by-Side (WinSxS) directory so that the operating system loads it instead of the legitimate file.

CyberSecurity

The attacks entail the use of old and outdated versions of security solutions, graphics software, and web browsers that are bound to lack mitigations for DLL side-loading, using them as a conduit to load arbitrary shellcode designed to execute additional payloads.

Furthermore, the software packages also double up as a means to deliver tools to facilitate credential theft and lateral movement across the compromised network.

“[The threat actor] leveraged PsExec to run old versions of legitimate software which were then used to load additional malware tools such as off-the-shelf remote access Trojans (RATS) via DLL side-loading on other computers on the networks,” the researchers noted.

In one of the attacks against a government-owned organization in the education sector in Asia lasted from April to July 2022, during which the adversary accessed machines hosting databases and emails, before accessing the domain controller.

The intrusion also made use of an 11-year-old version of Bitdefender Crash Handler (“javac.exe”) to launch a renamed version of Mimikatz (“calc.exe”), an open source Golang penetration testing framework called LadonGo, and other custom payloads on multiple hosts.

One among them is a previously undocumented, feature-rich information stealer that’s capable of logging keystrokes, capturing screenshots, connecting to and querying SQL databases, downloading files, and stealing clipboard data.

Also put to use in the attack is a publicly-available intranet scanning tool named Fscan to perform exploit attempts leveraging the ProxyLogon Microsoft Exchange Server vulnerabilities.

CyberSecurity

The identity of the threat group is unclear, although it’s said to have used ShadowPad in prior campaigns, a modular backdoor that’s fashioned as a successor to PlugX (aka Korplug) and shared among many a Chinese threat actor.

Symantec said it has limited evidence linking the threat actor’s earlier attacks involving the PlugX malware to other Chinese hacking groups such as APT41 (aka Wicked Panda) and Mustang Panda. What’s more, the use of a legitimate Bitdefender file to sideload shellcode has been observed in previous attacks attributed to APT41.

“The use of legitimate applications to facilitate DLL side-loading appears to be a growing trend among espionage actors operating in the region,” the researchers said. “Although a well-known technique, it must be yielding some success for attackers given its current popularity.”





Source link

Related Articles

xxxanti beeztube.mobi hot sexy mp4 menyoujan hentaitgp.net jason voorhees hentai indian soft core chupatube.net youjzz ez2 may 8 2023 pinoycinema.org ahensya ng pamahalaan pakistani chut ki chudai pimpmovs.com www xvedio dost ke papa zztube.mobi 300mbfilms.in صور مص الزب arabporna.net نهر العطش لمن تشعر بالحرمان movierulz plz.in bustyporntube.info how to make rangoli video 穂高ゆうき simozo.net 四十路五十路 ロシアav javvideos.net 君島みお 無修正 افلام سكس في المطبخ annarivas.net فيلم سكس قديم rashmi hot videos porncorn.info audiosexstories b grade latest nesaporn.pro high school girls sex videos real life cam eroebony.info painfull porn exbii adult pics teacherporntrends.com nepali school sex