Billbug Targets Government Agencies in Multiple Asian Countries

Condition-sponsored actors in the Billbug team (aka Lotus Blossom and Thrip) have tried to compromise a digital certificate authority in an Asian region for the duration of a campaign focusing on numerous govt agencies.

Security scientists from Symantec have produced the discovery and shared the results in an advisory posted previously currently.

“In exercise documented by Symantec in 2019, we in-depth how the team was using a backdoor identified as Hannotog and yet another backdoor recognized as Sagerunex. Both equally these equipment were being also found in this additional new activity,” reads the technical publish-up.

The corporation included that all the victims in this new Billbug campaign were being primarily based in a variety of countries in Asia.

“Billbug is acknowledged to aim on targets in Asian nations around the world. In at least a person of the federal government victims, a big quantity of machines on the network were compromised by the attackers,” Symantec defined.

According to the security organization, the concentrating on of a certification authority is notable. If the attackers could compromise it and accessibility certificates, they could use them to sign malware with a legitimate certification and help it avoid detection on victim devices. It could also use compromised certificates to intercept HTTPS site visitors.

“However, whilst this is a probable determination for concentrating on a certification authority, Symantec has viewed no evidence to recommend they have been productive in compromising electronic certificates,” wrote the company.

In phrases of how the assaults ended up executed, Billbug was noticed exploiting general public-struggling with programs to attain preliminary accessibility to target networks and, in distinct, dual-use resources. These provided AdFind, WinRAR and Port Scanner, among the some others.

“Multiple files that are believed to be loaders for the Hannotog backdoor have been noticed on sufferer devices,” Symantec wrote. “A backdoor was then deployed on the compromised technique. This backdoor has numerous functionalities.”

Amid its various abilities, the backdoor could build a company for persistence, stop other services and add encrypted data.

Symantec confirmed it experienced notified the certificate authority to inform them of this action. The advisory arrives two months soon after Interpol claimed to have dismantled an intercontinental cybercrime ring that built an believed $47,000 from extorting dozens of victims in Asia.

Some parts of this article are sourced from:
www.infosecurity-magazine.com