Budworm Hackers Resurface with New Espionage Attacks Aimed at U.S. Organization

An advanced persistent threat (APT) actor known as
Budworm targeted a U.S.-based entity for the first
time in more than six years, according to latest research.

The attack was aimed at an unnamed U.S. state legislature, the
Symantec Threat Hunter team, part of Broadcom Software, said^[1]
in a report shared with The Hacker News.

Other intrusions mounted over the past six months were directed
against a government of a Middle Eastern country, a multinational
electronics manufacturer, and a hospital in South East Asia.

Budworm^[2], also called APT27,
Bronze Union, Emissary Panda, Lucky Mouse, and Red Phoenix, is a
threat actor that’s believed to operate on behalf of China through
attacks that leverage a mix of custom and openly available tools to
exfiltrate information of interest.

“Bronze Union maintains a high degree of operational flexibility
in order to adapt to the environments it operates in,” Secureworks
notes^[3]
in a profile of the nation-state group, pointing out its ability to
“maintain access to sensitive systems over a long period of
time.”

A prominent backdoor attributed to the adversarial collective is
HyperBro^[4], which has been put to
use since at least 2013 and is in continuous development. Its other
tools include PlugX^[5], SysUpdate^[6], and the China Chopper^[7]
web shell.

The latest set of attacks are no different, with the threat
actor leveraging Log4Shell flaws^[8]
to compromise servers and install web shells, ultimately paving the
way for the deployment of HyperBro, PlugX, Cobalt Strike, and
credential dumping software.

The development marks the second time Budworm has been linked to
an attack on a U.S. entity. Earlier this month, the U.S. government
revealed^[9]
that multiple nation-state hacking groups breached a defense sector
organization using ProxyLogon flaws^[10] in Microsoft Exchange
Server to drop China Chopper and HyperBro.

“In more recent years, the group’s activity appears to have been
largely focused on Asia, the Middle East, and Europe,” the
researchers said. “A resumption of attacks against U.S.-based
targets could signal a change in focus for the group.”