APT41 Penetrates Networks in Italy, Spain, Taiwan, Turkey, and the U.K.
Various enterprises within global shipping and logistics, media and entertainment, technology, and automotive sectors in Italy, Spain, Taiwan, Thailand, Turkey, and the United Kingdom are under attack by the productive China-based APT41 cyber crew.
A new report by Mandiant, a company owned by Google, disclosed that “APT41 has breached and sustained unauthorized entry into multiple networks since 2023, allowing them to extract confidential data over an extended stretch of time.”
The cybersecurity firm illustrated the adversarial collective as distinct among China-related actors due to its deployment of “private malware typically used for espionage operations in endeavors that seem to fall beyond state-backed missions.”
The attack processes involve the utilization of web shells (ANTSWORD and BLUEBEAM), personalized droppers (DUSTPAN and DUSTTRAP), and publicly accessible tools (SQLULDR2 and PINEGROVE) to achieve continuity, deliver supplementary payloads, and extract data of interest.
The web shells serve as a pathway to download the DUSTPAN (also known as StealthVector) dropper, responsible for loading Cobalt Strike Beacon for command-and-control (C2) communication, followed by the deployment of the DUSTTRAP dropper post lateral movement.
On its end, DUSTTRAP is set up to decode a malicious payload and run it in memory, which establishes contact with a server controlled by the attacker or a compromised Google Workspace account in an effort to disguise its malicious operations.
Google mentioned that the identified Workspace accounts have been corrected to prevent unauthorized entry. However, the company did not disclose the quantity of impacted accounts.
The intrusions are additionally characterized by the use of SQLULDR2 to export data from Oracle Databases to a local text-based file and PINEGROVE to send substantial amounts of sensitive data from compromised networks by misusing Microsoft OneDrive as a channel for extraction.
It’s important to note that the malware varieties tracked by Mandiant as DUSTPAN and DUSTTRAP have similarities with those codenamed DodgeBox and MoonWalk, respectively, by Zscaler ThreatLabz.
“DUSTTRAP includes a plugin framework with numerous components,” stated researchers from Mandiant, noting the identification of a minimum of 15 plugins capable of executing shell commands, performing file system operations, enumerating and halting processes, capturing keystrokes and screenshots, collecting system details, and altering the Windows Registry.
It’s also designed to explore remote hosts, conduct domain name system (DNS) searches, list remote desktop sessions, upload files, and undertake various directives within Microsoft Active Directory.
“The DUSTTRAP malware and the accompanying components observed during the intrusion were code signed with presumably stolen code signing certificates,” said the organization. “One of the code signing certificates seemed to be related to a South Korean company operating in the gaming industry sector.”
GhostEmperor Returns to Cause Havoc
This disclosure coincides with Israeli cybersecurity firm Sygnia unveiling details of a cyber assault campaign executed by a sophisticated China-related threat group known as GhostEmperor to spread a variant of the Demodex rootkit.
The exact method utilized to infiltrate targets is presently unclear, although the group has previously been observed exploiting known vulnerabilities in internet-facing applications. The initial breach enables the execution of a Windows batch script, which deposits a Cabinet archive (CAB) file to eventually initiate a core implant module.
The implant is equipped to manage C2 communications and install the Demodex kernel rootkit by leveraging an open-source project called Cheat Engine to bypass the Windows Driver Signature Enforcement (DSE) mechanism.
“GhostEmperor deploys a multi-stage malware to achieve discreet execution and persistence while utilizing various techniques to thwart the analysis process,” mentioned Security researcher Dor Nizar in a statement.
About Author
