Chinese ‘Spyder Loader’ Malware Spotted Targeting Organizations in Hong Kong

The China-aligned espionage-targeted actor dubbed Winnti has set its sights on authorities organizations in Hong Kong as part of an ongoing marketing campaign dubbed Operation CuckooBees.

Energetic because at least 2007, Winnti (aka APT41, Barium, Bronze Atlas, and Wicked Panda) is the title selected to a prolific cyber threat group that carries out Chinese state-sponsored espionage action, predominantly aimed at thieving mental assets from companies in made economies.

The threat actor’s strategies have qualified healthcare, telecoms, substantial-tech, media, agriculture, and education sectors, with an infection chains generally relying on spear-phishing e-mails with attachments to originally break into the victims’ networks.

Before this May possibly, Cybereason disclosed prolonged-managing attacks orchestrated by the group due to the fact 2019 to siphon technology secrets and techniques from technology and manufacturing providers mostly positioned in East Asia, Western Europe, and North The us.

The intrusions, clubbed less than the moniker Procedure CuckooBees, are estimated to have resulted in the exfiltration of “hundreds of gigabytes of information,” the Israeli cybersecurity company unveiled.

The most recent exercise, in accordance to the Symantec Danger Hunter group, section of Broadcom Software program, is a continuation of the proprietary data theft campaign, but with a emphasis on Hong Kong.

The attackers remained active on some of the compromised networks for as extensive as a year, the corporation explained in a report shared with The Hacker Information, incorporating the intrusions paved the way for the deployment of a malware loader named Spyder, which to start with came to gentle in March 2021.

“[Spyder] is getting applied for qualified assaults on data storage devices, gathering details about corrupted products, executing mischievous payloads, coordinating script execution, and C&C server conversation,” the SonicWall Seize Labs Risk Study Staff observed at the time.

Also deployed together with Spyder have been other publish-exploitation resources, such as Mimikatz and a trojanized zlib DLL module that’s able of acquiring commands from a distant server or loading an arbitrary payload.

Symantec stated that it did not notice the delivery of any closing-phase malware, while the motives of the campaign are suspected to be joined to intelligence gathering dependent on tactical overlaps with earlier assaults.

“The reality that this marketing campaign has been ongoing for several a long time, with distinct variants of the Spyder Loader malware deployed in that time, signifies that the actors powering this exercise are persistent and targeted adversaries, with the means to carry out stealthy functions on victim networks over a prolonged interval of time,” Symantec explained.

Winnti targets Sri Lankan authorities entities

As a further indicator of Winnti’s sophistication, Malwarebytes uncovered a independent set of attacks targeting govt entities in Sri Lanka in early August with a new backdoor referred to as DBoxAgent that leverages Dropbox for command-and-manage.

“To our expertise, Winnti (a China-backed APT) is targeting Sri Lanka for the very first time,” the Malwarebytes Risk Intelligence staff claimed.

The killchain is also notable for making use of an ISO impression hosted on Google Drive that purports to be a document containing details about financial guidance, indicating an attempt by the risk actor to capitalize on the ongoing financial disaster in the country.

Launching an LNK file contained inside of the ISO picture qualified prospects to the execution of the DBoxAgent implant that enables the adversary to remote commandeer the equipment and export sensitive knowledge back again to the cloud storage services. Dropbox has considering the fact that disabled the rogue account.

The backdoor further acts as a conduit to drop exploitation resources that would open up the doorway for other assaults and details exfiltration, which includes activating a multi-phase an infection sequence that culminates in the use of an sophisticated C++ backdoor named KEYPLUG, which was documented by Google’s Mandiant in March 2022.

The progress marks the to start with time APT41 has been noticed utilizing Dropbox for C&C purposes, illustrating the increasing use by attackers of legit software package-as-a-services and cloud choices to host malicious written content.

“Winnti remains active and its arsenal keeps increasing as one particular of the most sophisticated groups at present,” the cybersecurity firm explained. “Sri Lanka’s site in South Asia is strategic for China as it has open up entry to the Indian Ocean and is close to India.”

Identified this report appealing? Comply with THN on Facebook, Twitter  and LinkedIn to browse additional exceptional material we put up.

Some parts of this article are sourced from:
thehackernews.com