Security News > 2022 > September > Chinese Hackers Target Government Officials in Europe, South America and Middle East

A Chinese hacking group has been attributed to a new campaign aimed at infecting government officials in Europe, the Middle East, and South America with a modular malware known as PlugX. Cybersecurity firm Secureworks said it identified the intrusions in June and July 2022, once again demonstrating the adversary's continued focus on espionage against governments around the world.
"PlugX is modular malware that contacts a command and control server for tasking and can download additional plugins to enhance its capability beyond basic information gathering," Secureworks Counter Threat Unit said in a report shared with The Hacker News.
One of its primary tools of choice is PlugX, a remote access trojan that has been widely shared among Chinese adversarial collectives.
Earlier this year, the group was observed targeting Russian government officials with an updated version of the PlugX backdoor called Hodur, alongside entities located in Asia, the European Union, and the U.S. Secureworks' attribution of the latest campaign to Bronze President stems from the use of PlugX and politically-themed lure documents that align with regions that are of strategic importance to China.
Attack chains distribute RAR archive files that contain a Windows shortcut file masquerading as a PDF document, opening which executes a legitimate file present in a nested hidden folder embedded within the archive.
"Organizations in geographic regions of interest to China should closely monitor this group's activities, especially organizations associated with or operating as government agencies."
News URL
https://thehackernews.com/2022/09/chinese-hackers-target-government.html
Related news
- US charges Chinese hackers linked to critical infrastructure breaches (source)
- Chinese Hackers Breach Juniper Networks Routers With Custom Backdoors and Rootkits (source)
- Chinese Weaver Ant hackers spied on telco network for 4 years (source)
- FCC on the prowl for Huawei and other blocked Chinese makers in America (source)
- Hackers Use .NET MAUI to Target Indian and Chinese Users with Fake Banking, Social Apps (source)
- Chinese Hackers Breach Asian Telecom, Remain Undetected for Over 4 Years (source)
- Chinese FamousSparrow hackers deploy upgraded malware in attacks (source)
- Chinese Hackers Target Linux Systems Using SNOWLIGHT Malware and VShell Tool (source)
- Chinese hackers target Russian govt with upgraded RAT malware (source)