Pierluigi Paganini
August 04, 2021
Researchers from Positive Technologies reported that China-linked APT31 group has been using a new piece of malware in a recent wave of attacks targeting Mongolia, Belarus, Canada, the United States, and Russia.
Experts found many similarities between the malware and the DropboxAES RAT that was first spotted by researchers at Secureworks and that was previously attributed to APT31. Positive Technologies pointed out that the two samples were the same malware with only minor differences.
APT31 (aka Zirconium) is a China-linked APT group that was involved in multiple cyber espionage operations, it made the headlines recently after Check Point Research team discovered that the group used a tool dubbed Jian, which is a clone of NSA Equation Group ‘s “EpMe” hacking tool, years before it was leaked online by Shadow Brokers hackers.
In July 2021, the French national cyber-security agency ANSSI warned of ongoing attacks against a large number of French organizations conducted by the Chine-linked APT31 cyberespionage group. The state-sponsored hackers are hijacking home routers to set up a proxy mesh of compromised devices to conceal its attack infrastructure. The campaign began at the beginning of 2021 and is still ongoing, the alert published by the French agency includes a list of 161 IP addresses associated with hijacked devices that were involved in the attack.
The technique allows masquerading the actual source of attacks against France entities.
Researchers reported that the attackers employed the new malware in approximately 10 attacks aimed at the above states between January and July 2021.
APT31 employed a new dropper that leverages DLL sideloading to execute the malicious binary on the target machine.
“The main objective of the dropper, the appearance of the main function of which is shown in Figure 1, is the creation of two files on the infected computer: a malicious library and an application vulnerable to DLL Sideloading (this application is then launched). Both files are always created over the same path: C:\ProgramData\Apacha. In the absence of this directory, it is created and the process is restarted.” reads the analysis published by the experts.
The application launched by the dropper loads the malicious library and calls one of its functions. The library mimics the legitimate MSVCR100.dll which is included in Visual C ++ for Microsoft Visual Studio. Experts pointed out that the size of the malicious library employed in the attack is much smaller than the legitimate one.
In order to avoid detection, threat actors also signed the dropper used in some attacks with a valid digital signature likely stolen.
The malware employed in the attacks allows operators to steal information from infected systems, get info on mapped drives, search for files and documents, create a process, create a new stream with a file download from the server, create a new stream sending the file to the server, create a directory, or delete itself.
“In the study PT ESC specialists analyzed new versions of the malware used by APT31 in attacks from January to July this year. The revealed similarities with earlier versions of malicious samples described by researchers, such as in 2020, suggest that the group is expanding the geography of its interests to countries where its growing activity can be detected, Russia in particular. We believe that further instances will be revealed soon of this group being used in attacks, including against Russia, along with other tools that might be identified by code correspondence or network infrastructure.” Positive Technologies concludes.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, APT31)
[adrotate banner=”5″]
[adrotate banner=”13″]
