Asian Governments and Organizations Targeted in Latest Cyber Espionage Attacks

Government and state-owned organizations in a number of Asian
countries have been targeted by a distinct group of espionage
hackers as part of an intelligence gathering mission that has been
underway since early 2021.

“A notable feature of these attacks is that the attackers
leveraged a wide range of legitimate software packages in order to
load their malware payloads using a technique known as DLL side-loading^[1],” the Symantec Threat
Hunter team, part of Broadcom Software, said^[2]
in a report shared with The Hacker News.

The campaign is said to be exclusively geared towards government
institutions related to finance, aerospace, and defense, as well as
state-owned media, IT, and telecom firms.

Dynamic-link library (DLL) side-loading is a popular cyberattack
method that leverages how Microsoft Windows applications handle DLL
files. In these intrusions, a spoofed malicious DLL is planted in
the Windows Side-by-Side (WinSxS^[3]) directory so that the
operating system loads it instead of the legitimate file.

The attacks entail the use of old and outdated versions of
security solutions, graphics software, and web browsers that are
bound to lack mitigations for DLL side-loading, using them as a
conduit to load arbitrary shellcode designed to execute additional
payloads.

Furthermore, the software packages also double up as a means to
deliver tools to facilitate credential theft and lateral movement
across the compromised network.

“[The threat actor] leveraged PsExec to run old versions of
legitimate software which were then used to load additional malware
tools such as off-the-shelf remote access Trojans (RATS) via DLL
side-loading on other computers on the networks,” the researchers
noted.

In one of the attacks against a government-owned organization in
the education sector in Asia lasted from April to July 2022, during
which the adversary accessed machines hosting databases and emails,
before accessing the domain controller.

The intrusion also made use of an 11-year-old version of
Bitdefender Crash Handler (“javac.exe”) to launch a renamed version
of Mimikatz (“calc.exe”), an open source Golang penetration testing
framework called LadonGo^[4], and other custom
payloads on multiple hosts.

One among them is a previously undocumented, feature-rich
information stealer that’s capable of logging keystrokes, capturing
screenshots, connecting to and querying SQL databases, downloading
files, and stealing clipboard data.

Also put to use in the attack is a publicly-available intranet
scanning tool named Fscan to perform exploit attempts leveraging
the ProxyLogon^[5]
Microsoft Exchange Server vulnerabilities.

The identity of the threat group is unclear, although it’s said
to have used ShadowPad^[6]
in prior campaigns, a modular backdoor that’s fashioned as a
successor to PlugX (aka Korplug) and shared among many a Chinese
threat actor.

Symantec said it has limited evidence linking the threat actor’s
earlier attacks involving the PlugX malware to other Chinese
hacking groups such as APT41^[7]
(aka Wicked Panda) and Mustang Panda^[8]. What’s more, the use of
a legitimate Bitdefender file to sideload shellcode has been
observed in previous attacks^[9]
attributed to APT41.

“The use of legitimate applications to facilitate DLL
side-loading appears to be a growing trend among espionage actors
operating in the region,” the researchers said. “Although a
well-known technique, it must be yielding some success for
attackers given its current popularity.”