Security News > 2021 > December > New Flagpro malware linked to Chinese state-backed hackers
BlackTech cyber-espionage APT group has been spotted targeting Japanese companies using novel malware that researchers call 'Flagpro'.
The threat actor uses Flagpro in the initial stage of an attack for network reconnaissance, to evaluate the target's environment, and to download second-stage malware and execute it.
At some point in their analysis, NTT researchers noticed a new version of Flagpro, which can automatically close dialogs relevant to establishing external connections that could reveal its presence to the victim.
"In the implementation of Flagpro v1.0, if a dialog titled"Windows セキュリティ" is displayed when Flagpro accesses to an external site, Flagpro automatically clicks OK button to close the dialog," explains the NTT Security report.
As an APT, BlackTech possesses the knowledge and sophistication to adjust its tools to new reports like this one, so Flagpro will likely now be modified for stealthier deployment.
Defenders need to take note of the new indicators of compromise related to the new malware and follow all best security practices to maintain strong defenses against sophisticated threats like BlackTech.
News URL
Related news
- Chinese hackers use custom malware to spy on US telecom networks (source)
- Hackers Hide Malware in Images to Deploy VIP Keylogger and 0bj3ctivity Stealer (source)
- US sanctions Chinese firm, hacker behind telecom and Treasury hacks (source)
- Trump 'waved a white flag to Chinese hackers' as Homeland Security axed cyber advisory boards (source)
- Hacker infects 18,000 "script kiddies" with fake malware builder (source)
- North Korean Hackers Deploy FERRET Malware via Fake Job Interviews on macOS (source)
- Hackers exploit SimpleHelp RMM flaws to deploy Sliver malware (source)
- North Korean hackers spotted using ClickFix tactic to deliver malware (source)
- Chinese hackers breach more US telecoms via unpatched Cisco routers (source)
- Chinese Hackers Exploit MAVInject.exe to Evade Detection in Targeted Cyber Attacks (source)