Security News > 2021 > December > New Flagpro malware linked to Chinese state-backed hackers

BlackTech cyber-espionage APT group has been spotted targeting Japanese companies using novel malware that researchers call 'Flagpro'.

The threat actor uses Flagpro in the initial stage of an attack for network reconnaissance, to evaluate the target's environment, and to download second-stage malware and execute it.

At some point in their analysis, NTT researchers noticed a new version of Flagpro, which can automatically close dialogs relevant to establishing external connections that could reveal its presence to the victim.

"In the implementation of Flagpro v1.0, if a dialog titled"Windows セキュリティ" is displayed when Flagpro accesses to an external site, Flagpro automatically clicks OK button to close the dialog," explains the NTT Security report.

As an APT, BlackTech possesses the knowledge and sophistication to adjust its tools to new reports like this one, so Flagpro will likely now be modified for stealthier deployment.

Defenders need to take note of the new indicators of compromise related to the new malware and follow all best security practices to maintain strong defenses against sophisticated threats like BlackTech.

News URL

https://www.bleepingcomputer.com/news/security/new-flagpro-malware-linked-to-chinese-state-backed-hackers/