Cyber-spies suspected of connections with China have infected "dozens" of computers belonging to Russian government agencies and IT providers with backdoors and trojans since late July, according to Kaspersky. The Russia-based security biz claimed the malware used in the ongoing, targeted attacks, called EastWind, has links to two China-nexus groups tracked as APT27 and APT31.
After gaining initial access to their victims' devices via phishing emails, the attackers used various cloud services and sites including GitHub, Dropbox, Quora, LiveJournal, and Yandex. Disk to direct their remote-control malware to download additional payloads onto compromised computers. Those services were effectively used as command-and-control (C2) servers.
These phishing emails sent RAR archive attachments containing a Windows shortcut along with a decoy document and both legitimate and malicious files to organizations' email addresses. These include malicious libraries that use DLL sideloading to drop a backdoor that then begins communicating with Dropbox.[1]
Once it establishes contact with the cloud storage service, the backdoor fetches instructions from its masters, executes commands, conducts reconnaissance, and downloads additional malware. The malware includes a trojan, previously linked to APT31 during a 2021 and 2023 campaign, that Kaspersky named "GrewApacha."
This version of GrewApacha uses the same loader spotted in 2023, but now uses two C2 servers. It also uses a GitHub profile bio to obfuscate the C2 server address, which is stored in a Base64-encoded string. In addition to the GrewApacha trojan, the attackers also downloaded the CloudSorcerer backdoor. Kaspersky previously reported on this malware in July and noted that since that time the attackers have modified it to use profile pages on the Russian-language social network LiveJournal and the question/answer website Quora as the initial C2 servers.
CloudSorcerer, while deployed against Russian organizations in this campaign, was also spotted in a late May 2024 attack against a US-based org, according to Proofpoint. In analyzing the updated CloudSorcerer samples, the threat hunters discovered that the criminals were using this backdoor to download a previously unknown implant they dubbed PlugY.
This implant connects to the C2 server via TCP, UDP, or named pipes, and can handle a "quite extensive" set of commands, we're told. This includes manipulating files, executing shell commands, logging keystrokes, monitoring screens and snooping around clipboards. "Analysis of the implant is still ongoing, but we can conclude with a high degree of confidence that the code of the DRBControl (aka Clambling) backdoor was used to develop it," Kaspersky's researchers wrote last week. The DRBControl backdoor has been linked to APT27.
Additionally, Kaspersky observed that the fact the EastWind campaign used malware with similarities to samples used by both APT27 and APT29 "clearly shows" that nation-state backed crews "very often team up, actively sharing knowledge and tools."
This article is shared at no charge for educational and informational purposes only.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. We provide indicators of compromise information via a notification service (RedXray) or an analysis service (CTAC). For questions, comments or assistance, please contact the office directly at 1-844-492-7225, or feedback@redskyalliance.com
Weekly Cyber Intelligence Briefings:
- Reporting: https://www.redskyalliance.org/
- Website: https://www.redskyalliance.com/
- LinkedIn: https://www.linkedin.com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
https://register.gotowebinar.com/register/5378972949933166424
[1] https://www.msn.com/en-us/news/technology/china-linked-cyber-spies-infect-russian-govt-it-sector/ar-AA1oP6Jv/
Comments