Chinese Hackers Target Government Officials in Europe, South America, and Middle East

A Chinese hacking group has been attributed to a new campaign
aimed at infecting government officials in Europe, the Middle East,
and South America with a modular malware known as PlugX.

Cybersecurity firm Secureworks said it identified the intrusions
in June and July 2022, once again demonstrating the adversary’s
continued focus on espionage against governments around the
world.

“PlugX is modular malware that contacts a command and control
(C2) server for tasking and can download additional plugins to
enhance its capability beyond basic information gathering,”
Secureworks Counter Threat Unit (CTU) said in a report^[1]
shared with The Hacker News.

Bronze President is a China-based threat actor active since at
least July 2018 and is likely estimated to be a state-sponsored
group that leverages a mix of proprietary and publicly available
tools to compromise and collect data from its targets.

It’s also publicly documented under other names such as
HoneyMyte, Mustang Panda, Red Lich, and Temp.Hex. One of its
primary tools of choice is PlugX, a remote access trojan that has
been widely shared among Chinese adversarial collectives.

Earlier this year, the group was observed targeting Russian government
officials^[2] with an updated version
of the PlugX backdoor called Hodur^[3], alongside entities^[4]
located in Asia, the European Union, and the U.S.

Secureworks’ attribution of the latest campaign to Bronze
President stems from the use of PlugX and politically-themed lure
documents that align with regions that are of strategic importance
to China.

Attack chains distribute RAR archive files that contain a
Windows shortcut (.LNK) file masquerading as a PDF document,
opening which executes a legitimate file present in a nested hidden
folder embedded within the archive.

This then paves the way for dropping a decoy document, while the
PlugX payload sets up persistence on the infected host.

“BRONZE PRESIDENT has demonstrated an ability to pivot quickly
for new intelligence collection opportunities,” the researchers
said. “Organizations in geographic regions of interest to China
should closely monitor this group’s activities, especially
organizations associated with or operating as government
agencies.”