Chinese Espionage Hackers Target Tibetans Using New LOWZERO Backdoor

A China-aligned advanced persistent threat actor known as TA413
weaponized recently disclosed flaws in Sophos Firewall and
Microsoft Office to deploy a never-before-seen backdoor called
LOWZERO as part of an espionage campaign aimed at Tibetan
entities.

Targets primarily consisted of organizations associated with the
Tibetan community, including enterprises associated with the
Tibetan government-in-exile.

The intrusions involved the exploitation of CVE-2022-1040^[1]
and CVE-2022-30190^[2]
(aka “Follina”), two remote code execution vulnerabilities in
Sophos Firewall and Microsoft Office, respectively.

“This willingness to rapidly incorporate new techniques and
methods of initial access contrasts with the group’s continued use
of well known and reported capabilities, such as the Royal Road RTF
weaponizer, and often lax infrastructure procurement tendencies,”
Recorded Future said^[3]
in a new technical analysis.

TA413, also known as LuckyCat, has been linked to relentlessly
targeting organizations and individuals associated with the Tibetan
community at least since 2020 using malware such as ExileRAT,
Sepulcher, and a malicious Mozilla Firefox browser extension dubbed
FriarFox^[4].

The group’s exploitation of the Follina flaw was previously
highlighted^[5]
by Proofpoint in June 2022, although the ultimate end goal of the
infection chains remained unclear.

Also put to use in a spear-phishing attack identified in May
2022 is a malicious RTF document that exploited flaws in Microsoft
Equation Editor to drop the custom LOWZERO implant. This is
achieved by employing a Royal Road RTF weaponizer tool^[6], which is widely shared
among Chinese threat actors.

In another phishing email sent to a Tibetan target in late May,
a Microsoft Word attachment hosted on the Google Firebase service
attempted to leverage the Follina vulnerability to execute a
PowerShell command designed to download the backdoor from a remote
server.

LOWZERO, the backdoor, is capable of receiving additional
modules from its command-and-control (C2) server, but only on the
condition that the compromised machine is deemed to be of interest
to the threat actor.

“The group continues to incorporate new capabilities while also
relying on tried-and-tested [tactics, techniques, and procedures,”
the cybersecurity firm said.

“TA413’s adoption of both zero-day and recently published
vulnerabilities is indicative of wider^[7]
trends^[8]
with Chinese cyber-espionage groups whereby exploits regularly
appear in use by multiple distinct Chinese activity groups prior to
their widespread public availability.”