An ongoing campaign spreading a new version of a known malware who Chinese Hackers Recover PlugX Variant (also known as Korplug or SOGU) has targeted. The manufacturing and telecommunications sectors in Central and South Asian nations.
Chinese Hackers Recover PlugX: Researchers at Cisco Talos
According to an analysis released this week by Cisco Talos researchers Joey Chen and Takahiro Takeda. Some of the features of the new variant that overlap with both the RainyDay and Turian backdoors include the XOR-RC4-RtlDecompressBuffer algorithm used to encrypt/decrypt payloads. The RC4 keys used, and the abuse of the same legitimate applications for DLL side-loading.
Same structure as Renidae used: Chinese Hackers Recover PlugX
The cybersecurity firm point out that the PlugX variant’s configuration differs greatly from the standard PlugX configuration format, OpenAI instead using the same structure as RainyDay, a backdoor connect to the Lotus Panda (also known as Naikon APT) threat actor, which is associates with China. Additionally, Kaspersky probably tracks it as FoundCore and attributes it to a threat group it calls Cycldek that speaks Chinese.
Many hacker groups with ties to China use PlugX, a modular remote access trojan (RAT), but Mustang Panda (also known as BASIN, Bronze President, Camaro Dragon, Earth Preta, HoneyMyte, RedDelta, Red Lich, Stately Taurus, TEMP.Hex, and Twill Typhoon) is the most well-known user.
Why Telecom Is A Target
Because they provide access to strategic communications, private information, and even whole populations, telecom networks are ideal targets for espionage. Threat actors obtain important intelligence and ongoing access to vital infrastructure by breaking into these systems. To highlight the tenacity of these campaigns, Cisco Talos discover one victim who compromise for more than two years.
How The Attack Works
Usually, the campaign starts with a malicious email or document attached to a phishing email. Attackers use DLL sideloading to trick trustworthy apps into loading hidden malware after opening. PlugX then installs backdoors, records keystrokes, and stealthily retrieves private information.
Turian as a backdoor
However, Turian (also known as Quarian or Whitebird) is consider a backdoor that is only uses in cyberattacks against the Middle East by BackdoorDiplomacy, another Chinese-affiliated advanced persistent threat (APT) group (also known as CloudComputating or Faking Dragon).
According to one incident the company discoveres, Naikon targeted a telecom company in Kazakhstan, which borders Uzbekistan and target by BackdoorDiplomacy in the past. Furthermore, it is discover that both hacking teams target South Asian nations.
Sideload a malicious DLL
Basically, the attack chains use a legitimate executable linked to a Mobile Popup Application to sideload a malicious DLL. Which is then use to launch the PlugX, RainyDay, and Turian payloads in memory after decryption. PlugX, which employs the same configuration structure. As RainyDay and has an integrated keylogger plugin, has been a major component of recent attack waves. That the threat actor has coordinated.
Talos stated, “There are significant overlapping aspects including the choice of targets, encryption/decryption payload methods, encryption key reuse, and use of tools supported by the same vendor, even though we cannot conclude that there is a clear connection between Naikon and BackdoorDiplomacy.” “A medium level of confidence is suggested by these similarities to a Chinese-speaking actor in this campaign.”
Mustang Panda’s Bookworm Malware Detailed
As Palo Alto Networks Unit 42 reveal the inner workings of the Bookworm malware, which has been used by the Mustang Panda actor since 2015 to obtain extensive control over compromise systems, the disclosure was made. The sophisticated RAT has the ability to upload and download files, run arbitrary commands, exfiltrate data, and create persistent access.
The cybersecurity vendor reported earlier in March that it had discovered malware distribution attacks aimed at nations connected to the Association of Southeast Asian Nations (ASEAN).
Malware variants with similarities to TONESHELL
Bookworm blends in with regular network traffic by using compromised infrastructure or domains that appear authentic for C2 purposes. Certain malware variations have also been discovered to have similarities with TONESHELL, a backdoor that has been linked to Mustang Pana since late 2022.
Attack chains that distribute Bookworm, like PlugX and TONESHELL, use DLL side-loading to execute their payloads, but more recent versions is adopt a method that packages shellcode as universally unique identifier (UUID) strings, which are subsequently decoded and run.
According to Unit 42 researcher Kyle Wilhoit
“Bookworm is renowns for its distinctive modular architecture. Which enables its core functionality to be expand by loading additional modules directly from its command-and-control (C2) server.” “Static analysis is makes more difficult by this modularity. Since the Leader module depends on other DLLs to provide certain functionality.”
Bookworm’s long-term role in the actor’s toolbox is demonstrated by this deployment and adaptation. Which took place concurrently with other Stately Taurus operations. It also indicates a consistent, long-term dedication to the group’s use and advancement of it.
How To Stay Protected
Security professionals advise businesses in high-risk industries to take preventative measures right away:
- To stop DLL sideloading, keep Windows apps and systems up to date.
- Make use of detection tools that are able to identify anomalous activity in addition to known malware signatures.
- Make sure multi-factor authentication (MFA) is enable and that your password policies are strong.
- Make regular offline backups of your systems and important data.
Employees should be trains to spot phishing emails and steer clear of dubious downloads.
The Bigger Picture
This new PlugX variant’s discovery highlights how persistent APT activity associated with China is in Asia. Chinese hackers are combining tried-and-true techniques with new features to remain efficient and covert by improving outdated tools like PlugX rather than giving them up.
As the campaign goes on, cybersecurity professionals caution that in the realm of cyberespionage. it is becoming harder to distinguish between new and old threats, which makes being vigilant more important than ever.
