Security News > 2022 > August > Chinese hackers backdoor chat app with new Linux, macOS malware
Versions of a cross-platform instant messenger application focused on the Chinese market known as 'MiMi' have been trojanized to deliver a new backdoor that can be used to steal data from Linux and macOS systems.
SEKOIA's Threat & Detection Research Team says that the app's macOS 2.3.0 version has been backdoored for almost four months, since May 26, 2022.
They discovered this after noticing unusual connections to this app while analyzing command-and-control infrastructure for the HyperBro remote access trojan malware linked to the APT27 Chinese-backed threat group.
TrendMicro also reported detecting the same campaign and said it found old trojanized versions of MiMi targeting Linux and Windows, with the oldest Linux rshell sample in June 2021 and the first victim being reported back in mid-July 2021.
Once launched, the malware will harvest and send system information to its C2 server and wait for commands from the APT27 threat actors.
Since March 2021, the group has been breaching and infecting servers running vulnerable Zoho AdSelf Service Plus software-a password management solution for cloud apps and Active Directory-with several malware strains, including the HyperBro RAT. These attacks compromised at least nine entities from critical sectors worldwide, including defense, healthcare, energy, and technology.
News URL
Related news
- Chinese hackers use Visual Studio Code tunnels for remote access (source)
- U.S. Charges Chinese Hacker for Exploiting Zero-Day in 81,000 Sophos Firewalls (source)
- Secret Blizzard Deploys Kazuar Backdoor in Ukraine Using Amadey Malware-as-a-Service (source)
- New stealthy Pumakit Linux rootkit malware spotted in the wild (source)
- Iran-Linked IOCONTROL Malware Targets SCADA and Linux-Based IoT Platforms (source)
- Winnti hackers target other threat actors with new Glutton PHP backdoor (source)
- Hackers Exploit Webview2 to Deploy CoinLurker Malware and Evade Security Detection (source)
- Hackers Use Microsoft MSC Files to Deploy Obfuscated Backdoor in Pakistan Attacks (source)
- New 'OtterCookie' malware used to backdoor devs in fake job offers (source)
- North Korean Hackers Deploy OtterCookie Malware in Contagious Interview Campaign (source)