Digital SecurityTechnology For SMEs

Hacking Group Caught For Spying Asian Corporates

Sharing is caring!

An advanced persistent threat (APT) hacking group planted backdoors to spy on a telecommunications company, a gas company, and a governmental institution in Asia, said a joint report from cybersecurity teams at Avast and ESET. There are reports that this hacking group is based in China.

The group planted backdoors to gain long-term access to corporate networks, said the report, adding that the group was also perhaps behind attacks active in Mongolia, Russia, and Belarus.

None of the organisations targeted by the group are based in India, Avast said.

Avast believes the group is from China, based on the use of Gh0st Remote Access Trojan (RAT), which has been known to be used by Chinese APT groups in the past and similarities in the code Avast analysed and code recently analysed in a campaign attributed to Chinese actors.

The backdoors gave the actors the ability to manipulate and delete files, take screenshots, alter processes, and services, as well as execute console commands, and remove itself.

Additionally, some commands had the capability to instruct the backdoors to exfiltrate data to a command and control (C&C) server.

Infected devices could also be commanded by a C&C server to act as a proxy or listen on a specific port on every network interface.

The group also used tools such as Gh0st RAT and Management Instrumentation to move laterally within infiltrated networks.

“The group behind the attack frequently recompiled their custom tools to avoid antivirus detection, which, in addition to the backdoors, included Mimikatz and Gh0st RAT,” said Luigino Camastra, a malware researcher at Avast.

“Based on what we have discovered and the fact that we were able to tie elements of these attacks back to attacks carried out on other countries, we assume this group is also targeting further countries.”

Avast said it reported its findings to the local Computer Emergency Response Team team, and reached out to the affected telecommunications company it discovered was under attack.

SMEStreet Desk

SMEStreet is fast growing platform dedicated to entrepreneurs from small and medium sized businesses (SMEs). Committed to facilitate Knowledge & Networking for Business Growth, SMEStreet offers value added content which shows the actual voice of Indian MSMEs.

Related Articles

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Back to top button
%d bloggers like this: