Pierluigi Paganini
April 26, 2023
Researchers from Palo Alto Networks Unit 42 recently observed the China-linked Alloy Taurus group (aka GALLIUM, Softcell) targeting Linux systems with a new variant of PingPull backdoor. While investigating the activity of the group, the researchers also identified a previously undocumented backdoor used by the threat actor and tracked as Sword2033.
The Chinese APT is known to be focused on telecommunications companies operating across Asia, Europe and Africa. In recent years, the researchers observed the group expanding its operations to include financial institutions and government entities.
PingPull, was first spotted by Unit 42 in June 2022, the researchers defined the RAT as a “difficult-to-detect” backdoor that leverages the Internet Control Message Protocol (ICMP) for C2 communications. Experts also found PingPull variants that use HTTPS and TCP for C2 communications instead of ICMP.
On March 7, 2023, the researchers found a Linux variant of the PingPull that was uploaded to VirusTotal, it had a very low detection rate (3 out of 62)
“Despite a largely benign verdict, additional analysis has determined that this sample is a Linux variant of PingPull malware. This determination was made based on matching HTTP communication structure, POST parameters, AES key, and C2 commands, which are outlined below.” reads the analysis published by Unit 42. “Upon execution, this sample is configured to communicate with the domain yrhsywu2009.zapto[.]org over port 8443 for C2. It uses a statically linked OpenSSL (OpenSSL 0.9.8e) library to interact with the domain over HTTPS via HTTP POST request”
The researchers noticed that the command handler implemented in the PingPull malware is similar to the ones supported by both the China Chopper web shell and the PingPull Windows PE variant.
This circumstance suggests that the threat actor is reusing existing source code to create new malware.
While investigating the yrhsywu2009.zapto[.]org domain, the researchers discovered another ELF artifact, tracked as Sword2033.
This Sword2033 backdoor supports three basic functions, including uploading and exfiltrating files and executing commands.
Analysis of the C2 for a second Sword2033 sample revealed that the domain *.saspecialforces.co[.]za resolved to 196.216.136[.]139. This domain has been hosted on eight other IPs throughout its history, none of these IPs were directly affiliated with the South African government. However, the attackers chose a domain name that gives the impression of a connection to the South African military.
Experts added that the IP 196.216.136[.]139 resolved to vpn729380678.softether[.]net from late December 2022 through mid-February 2023. Alloy Taurus is known for leveraging the SoftEther VPN service to facilitate access and maintain persistence to their targeted network.
The Alloy Taurus APT group targeted South Africa because in February 2023, the African state joined Russia and China to participate in combined naval exercises.
“Alloy Taurus remains an active threat to telecommunications, finance and government organizations across Southeast Asia, Europe and Africa,” Unit 42 concludes. “The identification of a Linux variant of PingPull malware, as well as recent use of the Sword2033 backdoor, suggests that the group continues to evolve their operations in support of their espionage activities.”
Blogger Awards 2022 – VOTE FOR YOUR WINNERS
Vote for me in the sections:
Please nominate Security Affairs as your favorite blog.
Nominate here: https://docs.google.com/forms/d/e/1FAIpQLSfaFMkrMlrLhOBsRPKdv56Y4HgC88Bcji4V7OCxCm_OmyPoLw/viewform
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Alloy Taurus)
