Chinese ‘Spyder Loader’ Malware Spotted Targeting Organizations in Hong Kong

The China-aligned espionage-focused actor dubbed Winnti has set
its sights on government organizations in Hong Kong as part of an
ongoing campaign dubbed Operation CuckooBees.

Active since at least 2007, Winnti^[1]
(aka APT41, Barium, Bronze Atlas, and Wicked Panda) is the name
designated to a prolific cyber threat group that carries out
Chinese state-sponsored espionage activity, predominantly aimed at
stealing intellectual property from organizations in developed
economies.

The threat actor’s campaigns have targeted healthcare, telecoms,
high-tech, media, agriculture, and education sectors, with
infection chains primarily relying on spear-phishing emails with
attachments to initially break into the victims’ networks.

Earlier this May, Cybereason disclosed^[2]
long-running attacks orchestrated by the group since 2019 to siphon
technology secrets from technology and manufacturing companies
mainly located in East Asia, Western Europe, and North America.

The intrusions, clubbed under the moniker Operation CuckooBees,
are estimated to have resulted in the exfiltration of “hundreds of
gigabytes of information,” the Israeli cybersecurity company
revealed.

The latest activity, according to the Symantec^[3]
Threat Hunter team, part of Broadcom Software, is a continuation of
the proprietary data theft campaign, but with a focus on Hong
Kong.

The attackers remained active on some of the compromised
networks for as long as a year, the company said^[4]
in a report shared with The Hacker News, adding the intrusions
paved the way for the deployment of a malware loader called
Spyder^[5], which first came to
light in March 2021.

“[Spyder] is being used for targeted attacks on information
storage systems, collecting information about corrupted devices,
executing mischievous payloads, coordinating script execution, and
C&C server communication,” the SonicWall Capture Labs Threat
Research Team noted^[6]
at the time.

Also deployed alongside Spyder were other post-exploitation
tools, such as Mimikatz^[7]
and a trojanized zlib DLL module that’s capable of receiving
commands from a remote server or loading an arbitrary payload.

Symantec said that it did not observe the delivery of any
final-stage malware, although the motives of the campaign are
suspected to be linked to intelligence gathering based on tactical
overlaps with previous attacks.

“The fact that this campaign has been ongoing for several years,
with different variants of the Spyder Loader malware deployed in
that time, indicates that the actors behind this activity are
persistent and focused adversaries, with the ability to carry out
stealthy operations on victim networks over a long period of time,”
Symantec said.

Winnti targets Sri Lankan government entities

As a further sign of Winnti’s sophistication, Malwarebytes
uncovered^[8]
a separate set of attacks targeting government entities in Sri
Lanka in early August with a new backdoor referred to as DBoxAgent
that leverages Dropbox for command-and-control.

“To our knowledge, Winnti (a China-backed APT) is targeting Sri
Lanka for the first time,” the Malwarebytes Threat Intelligence
team said.

The killchain is also notable for making use of an ISO image
hosted on Google Drive that purports to be a document containing
information about economic assistance, indicating an attempt by the
threat actor to capitalize on the ongoing economic crisis^[9]
in the nation.

Launching an LNK file contained within the ISO image leads to
the execution of the DBoxAgent implant that enables the adversary
to remote commandeer the machine and export sensitive data back to
the cloud storage service. Dropbox has since disabled the rogue
account.

The backdoor further acts as a conduit to drop exploitation
tools that would open the door for other attacks and data
exfiltration, including activating a multi-stage infection sequence
that culminates in the use of an advanced C++ backdoor named
KEYPLUG^[10], which was documented
by Google’s Mandiant in March 2022.

The development marks the first time APT41 has been observed
utilizing Dropbox for C&C purposes, illustrating the growing
use by attackers of legitimate software-as-a-service and cloud
offerings to host malicious content.

“Winnti remains active and its arsenal keeps growing as one of
the most sophisticated groups nowadays,” the cybersecurity firm
said. “Sri Lanka’s location in South Asia is strategic for China as
it has open access to the Indian Ocean and is close to India.”