TechBizWebTechBizWeb

    Subscribe to Updates

    Get the latest news about Technology and Business from all around the web..

    What's Hot

    Reddit partners with crypto exchange FTX to help users manage community points

    August 14, 2022

    Applied Blockchain Refinances $15M Credit Facility from a North Dakota-based Bank

    August 14, 2022

    Saudi prince made $500mn Russia bet as Ukraine war started

    August 14, 2022
    Facebook Twitter Instagram
    • About Us
    • Privacy Policy
    • Guest Post
    • Terms
    • Contact
    Facebook Twitter Instagram
    TechBizWebTechBizWeb
    Subscribe
    • Home
    • Technology

      Reddit partners with crypto exchange FTX to help users manage community points

      August 14, 2022

      Your iPhone may soon have more ads

      August 14, 2022

      Halo system link still holds up more than 20 years later

      August 14, 2022

      Philips Hue Play sync box and gradient lightstrip review: wholly unnecessary, totally delightful

      August 14, 2022

      Elon Musk pitches lofty goals in a magazine run by China’s internet censorship agency

      August 13, 2022
    • Business
    • Cyber Security

      Avoid these employee monitoring blunders

      August 12, 2022

      Cybersecurity lessons from the red team: How to prevent a data breach

      August 12, 2022

      Data security, surveillance practices to be examined by FTC

      August 12, 2022

      Why it pays to be an early adopter of cybersecurity technology

      August 12, 2022

      The top identity-based attacks and how to stop them: Part 1

      August 11, 2022
    • Blockchain
    • Vulnerabilities
    • Social Engineering
    • Malware
    • Cyber Security Alerts
    TechBizWebTechBizWeb
    Home»Cyber Security»China’s APT27 Hackers Use Array of Tools in Recent Attacks
    Cyber Security

    China’s APT27 Hackers Use Array of Tools in Recent Attacks

    March 1, 2019Updated:March 1, 2019No Comments3 Mins Read
    Facebook Twitter Pinterest LinkedIn Tumblr WhatsApp
    Share
    Facebook Twitter LinkedIn Pinterest Email


    Over the past two years, China-linked cyber-espionage group Emissary Panda has used an array of tools and intrusion methods in attacks on political, technology, manufacturing, and humanitarian organizations, Secureworks reports. 

    Also known as APT27, LuckyMouse, BRONZE UNION, and Threat Group 3390, and active since at least 2010, the actor has been observed targeting hundreds of organizations all around the world, including U.S. defense contractors, financial services firms, a European drone maker, and a national data center in Central Asia, among others.

    The group’s hacking activities had various purposes, ranging from stealing data about cutting-edge weapons technologies to spying on dissidents and other civilian groups. 

    The group used both readily available tools (including services, tools, and credentials native to the compromised environments) and custom malware in their attacks, and also focused on maintaining presence in the compromised environments for a long period of time. 

    Secureworks’ security researchers noticed that the group usually returns to compromised networks every three months to verify access to existing web shells, refresh access to credentials, and revisit data of interest. 

    Last year, Emissary Panda was observed deploying an updated version of ZxShell, a remote access Trojan (RAT) developed in 2006 and which had its source code released in 2007. The malware had the well-known HTran packet redirection tool embedded and was signed with digital certificates by Hangzhou Shunwang Technology Co., Ltd and Shanghai Hintsoft Co., Ltd. 

    Also in 2018, the threat actor likely deployed a modified version of Gh0st RAT (which also has the source code available online) to multiple systems within a compromised environment. The sample communicates on TCP port 443 using a custom binary protocol and has modified headers to obfuscate the network traffic.

    The cyber-spies also used proprietary remote access tools in attacks observed since 2016, including SysUpdate and HyperBro. 

    A multi-stage malware, SysUpdate is used exclusively by the group, being delivered via multiple methods, including malicious Word documents leveraging Dynamic Data Exchange (DDE), manual deployment via stolen credentials, or via a redirect from a strategic web compromise (SWC). 

    All three methods deliver a WinRAR self-extracting (SFX) file that installs the SysUpdate stage 1 payload, which achieves persistence and installs the second stage malware payload, SysUpdate Main. The malware uses HTTP communications, and downloads code and injects it into svchost.exe. 

    SysUpdate Main has remote access capabilities, allowing attackers to manage files and processes, launch a command shell, interact with services, take screenshots, and upload and download additional malware payloads.

    Flexible in nature, SysUpdate’s capabilities could be easily expanded or diminished, via a new payload file, which could allow authors to limit the exposure of their full capabilities, the security researchers say. 

    “During complex intrusion scenarios, the threat actors leverage their proprietary tools, which offer custom functionality and lower detection rates. They appear to prefer using widely available tools and web shells to maintain access to networks over longer periods. After accessing a network, the threat actors are adept at circumventing common security controls, escalating privileges, and maintaining their access to high-value systems over long periods of time,” Secureworks concludes. 

    Related: China-linked Hackers Use Signed Network Filtering Driver in Recent Attacks

    Related: Chinese Cyberspies Target National Data Center in Asia

    Ionut Arghire is an international correspondent for SecurityWeek.

    Previous Columns by Ionut Arghire:
    Tags:



    Source link

    Share. Facebook Twitter Pinterest LinkedIn Tumblr Email

    Related Posts

    Avoid these employee monitoring blunders

    August 12, 2022 Cyber Security

    Cybersecurity lessons from the red team: How to prevent a data breach

    August 12, 2022 Cyber Security

    Data security, surveillance practices to be examined by FTC

    August 12, 2022 Cyber Security

    Why it pays to be an early adopter of cybersecurity technology

    August 12, 2022 Cyber Security

    The top identity-based attacks and how to stop them: Part 1

    August 11, 2022 Cyber Security

    Email cyberattacks increased 48% in first half of 2022

    August 11, 2022 Cyber Security
    Editors Picks

    Applied Blockchain Refinances $15M Credit Facility from a North Dakota-based Bank

    August 14, 2022

    Saudi prince made $500mn Russia bet as Ukraine war started

    August 14, 2022

    FTX Partners with Paradigm for ‘One-Click’ Futures Spread Trading

    August 14, 2022

    US lawmakers draw battle lines over search of Trump home

    August 14, 2022
    Trending Now

    Tornado Cash Developer Arrested by Dutch Authorities

    By techbizweb

    Rakesh Jhunjhunwala, known as ‘India’s Warren Buffett’, dies aged 62

    By techbizweb

    Halo system link still holds up more than 20 years later

    By techbizweb

    https://www.nationalsportsacademy.com

    slot gacor hari ini

    http://www.inadesfo.org/

    http://www.eueomgbissau.org/

    http://www.congo-mai-mai.net/

    http://www.angelesdelafrontera.org/

    http://fifaworldcup2018schedule.com/

    http://tony4gtrmcr.co.uk/

    http://www.standrewsagreement.org/

    http://www.bob-russell.co.uk/

    http://davidmulholland.co.uk/

    http://railwayhotelenniskillen.com/

    http://www.fantasysportstrades.com/

    http://www.rainleaf-flooring.com

    http://mothersagainstguns.org/

    http://ma-coc.org/

    slot online

    http://www.paradoxmag.com/situs-judi-slot-online-gampang-menang-2021/

    http://www.paradoxmag.com/situs-judi-slot-online-terbaru-2021/

    http://slot-terbaru.net/

    Slot Gacor

    Slot Online

    Situs Slot Gacor

    http://www.appdexterity.com/

    https://cars4kids-deutschland.de/

    https://www.stretchingculture.com/

    https://www.b-123-hp.com/slot-gacor/

    https://denzstaffing.nl/

    https://ezbbqcooking.com/slot-gacor/

    https://www.mbahelp24.com/slot-gacor

    https://minhtanstore.com/slot-jackpot-terbesar/

    https://njbpusupplierdiversity.com/slot-gacor-gampang-menang/

    https://www.floridaspecialtycropfoundation.org/slot-gampang-menang/

    https://childrenscornerpreschool.org/slot-gacor-gampang-menang/

    https://cryptoquoter.com/slot-online-terbaik/

    https://alorkantho24.com/slot-gacor/

    https://ellas.xyz/slot-gacor/

    https://it.dougamatome.xyz/slot-online/

    https://www.daltercume.com/slot-gacor/

    https://josi-ana.dougamatome.xyz/slot88/

    https://josi-ana.dougamatome.xyz/slot-gacor/

    https://fastobserver.com/slot-jackpot-terbesar/

    https://www.planetexperts.com/slot-gacor/

    https://bfsolution.group/slot-bet-kecil/

    https://rustleva.co/slot/

    https://bfsolution.group/slot-bet-kecil/

    https://www.hotelcalimareal.com/togel-online/

    https://anime-game.dougamatome.xyz/slot-gacor-gampang-menang/

    https://anime-game.dougamatome.xyz/togel-online/

    https://bourbonbarrelfoods.com/slot/

    http://suneo39.wp.xdomain.jp/slot/

    https://techbizweb.com/slot-gacor/

    https://www.generalcatalyst.com/18-daftar-slot-gacor-terbaik-gampang-menang-jackpot-hari-ini/

    https://www.hotelcalimareal.com/slot-online/

    https://www.blockgates.io/slot-gacor/

    https://l12.com.br/slot-gacor/

    slot paling gacor

    https://www.donalds-hobby.com/slot-online/

    https://thecryptodirt.com/slot-gacor-hari-ini/

    http://iseta.edu.ar/aulavirtual/app/upload/users/1/1205/my_files/sbobet.html

    http://escuelavirtual.mincit.gov.co/app/upload/users/1/194/my_files/slot.html

    https://www.dev.medecinesfax.org/courses/JUDICASINO/document/slot.html

    http://www.e-archivos.org/cursos/courses/JUDICASINO/document/slot-gacor.html

    http://iesma.com.br/ead/main/upload/users/4/447/my_files/slot.html

    https://www.fundacoop.org/chamilo/app/upload/users/1/1185/my_files/slot.html

    https://fata-aatf.org/eskola/main/upload/users/3/31/my_files/slot.html

    https://uancv.edu.pe/ofinvestigacion/app/upload/users/3/328/my_files/slot-terlengkap.html

    https://micost.edu.my/EL/app/upload/users/2/209/my_files/slot-gacor.html

    https://www.academiacoderdojo.ro/elearningdev/app/upload/users/2/2442/my_files/slot-online.html

    http://campus-cidci.ulg.ac.be/courses/JUDICASINO/document/slot-termurah.html

    https://www.escueladerobotica.misiones.gob.ar/aula-ste/courses/LIVECASINO/document/slot-tergacor.html

    http://ccdipeepccqqfar.usac.edu.gt/chamilo/app/upload/users/3/358/my_files/slot-online.html

    https://cunori.edu.gt/campus/app/upload/users/7/7334/my_files/slot-online.html

    http://u-rus.com.ar/aula/app/upload/users/1/1322/my_files/slot.html

    http://icrodarisoveria.edu.it/chamilo/app/upload/users/1/1855/my_files/slot.html

    https://iestpliliagutierrez.edu.pe/clarolgm/courses/CASINO/document/slot.html

    http://pva.cobach.edu.mx/app/upload/users/7/7379/my_files/slot.html

    http://www.imb-pc-online.edu.gt/PL/app/upload/users/3/373/my_files/slot.html

    http://avcs.upeu.edu.pe/main/upload/users/3333/my_files/slot.html

    https://chamilo.fca.uas.edu.mx/app/upload/users/1/11186/my_files/slot-online/

    TechBizWeb
    Facebook Twitter Instagram Pinterest Vimeo YouTube
    • Home
    • Guest Post
    • About Us
    • Privacy Policy
    • Our Authors
    • Terms and Conditions
    • Contact
    © 2022 Tech Biz Web. Developed by Sawah Dev.

    Type above and press Enter to search. Press Esc to cancel.