Tick APT Group Hacked East Asian DLP Software Firm

A new malware campaign focusing on an East Asian business that develops info-loss avoidance (DLP) application for authorities and military services entities has been attributed to the superior persistent danger (APT) group regarded as Tick.

According to an advisory revealed by ESET on Tuesday, the danger actor breached the DLP company’s inside update servers to deliver malware in its network. It then trojanized reputable instrument installers utilised by the business, top to malware staying executed on two of its customers’ computers.

“During the intrusion, the attackers deployed a earlier undocumented downloader named ShadowPy, and they also deployed the Netboy backdoor (aka Invader) and Ghostdown downloader,” wrote ESET malware researcher Facundo Muñoz.

The security skilled included that Tick has reportedly been lively considering that at the very least 2006, utilizing a special custom made malware toolset designed for persistent entry in compromised machines, as nicely as reconnaissance, data exfiltration and additional device download.

“Our newest report into Tick’s activity uncovered it exploiting the ProxyLogon vulnerability to compromise a South Korean IT firm, as one particular of the teams with access to that distant code execution exploit right before the vulnerability was publicly disclosed,” Muñoz spelled out.

Go through more on ProxyLogon in this article: Hackers Disguise Malware in Windows Logo, Concentrate on Middle East Governments

Even so, the attack on the DLP company was spotted by ESET in March 2021. The hackers would have deployed malware that thirty day period, and months later commenced introducing trojanized copies of the Q-dir installers.

The APT team then compromised the targeted company’s network in June and September 2021, transferring the trojanized Q-dir installers to shoppers of the compromised firm in February and June 2022.

“Based on Tick’s profile and the compromised company’s higher-worth client portfolio, the goal of the attack was most probable cyber espionage,” Muñoz wrote. 

How the DLP company was initially compromised is now unknown. However, ESET hypothesized the firm’s shoppers had been acquiring specialized support via a distant support application and the malicious installer was utilised unknowingly on client machines.

“It is unlikely that the attackers set up assistance instruments to transfer the trojanized installers on their own,” Muñoz extra.

Tick is one of many ATP groups currently targeting Asia-centered companies. The Examine Position Study (CPR) staff not long ago published an advisory detailing an espionage marketing campaign expansion in the location by the threat actor regarded as Sharp Panda.

Some parts of this article are sourced from:
www.infosecurity-journal.com