Security News > 2021 > January > Researchers Disclose Undocumented Chinese Malware Used in Recent Attacks

Cybersecurity researchers have disclosed a series of attacks by a threat actor of Chinese origin that has targeted organizations in Russia and Hong Kong with malware - including a previously undocumented backdoor.

Attributing the campaign to Winnti, Positive Technologies dated the first attack to May 12, 2020, when the APT used LNK shortcuts to extract and run the malware payload. A second attack detected on May 30 used a malicious RAR archive file consisting of shortcuts to two bait PDF documents that purported to be a curriculum vitae and an IELTS certificate.

The shortcuts themselves contain links to pages hosted on Zeplin, a legitimate collaboration tool for designers and developers that are used to fetch the final-stage malware that, in turn, includes a shellcode loader and a backdoor called Crosswalk.

While this modus operandi shares similarities with that of the Korean threat group Higaisa - which was found exploiting LNK files attached in an email to launch attacks on unsuspecting victims in 2020 - the researchers said the use of Crosswalk suggests the involvement of Winnti.

The researchers found additional attack samples in the form of RAR files that contained Cobalt Strike Beacon as the payload, with the hackers in one case referencing the U.S. protests related to the death of George Floyd last year as a lure.

Previously, Paranoid PlugX had been linked to attacks on companies in the video games industry in 2017.

News URL

http://feedproxy.google.com/~r/TheHackersNews/~3/ngop7H1Rsho/researchers-disclose-undocumented.html