Wednesday, April 30, 2025
HomeMalwareBlackTech Hackers Group Using API Hooking Technique in Malware to Evade Detection...

BlackTech Hackers Group Using API Hooking Technique in Malware to Evade Detection & Attack Government Networks

Published on

SIEM as a Service

Follow Us on Google News

Cyberespionage group known as BlackTech who behind the Waterbear malware campaign that has been targeted at various industries several years return to attack Government and technology companies.

Researchers recently uncovered a brand new piece of Waterbear payload with sophisticated hiding capability in the network from a specific security product by API hooking techniques.

 API hooking is a technique used to modify or hide the API Calls behavior and flow to evade detection of its activities in run time.

- Advertisement - Google News

If the attacker knowing which specific APIs to hook in their attack, it means that they are familiar with how certain security products gather information on their clients’ endpoints and networks.

Researchers excited that this is the first time seen Waterbear attempting to hide its backdoor activities, and the attackers are very knowledgeable of the victim’s environment.

Waterbear Malware Behaviour

There is some modular approach that was observed that the Waterbear employed in its malware and utilize the DLL loader to decrypt and execute the payload.

There is some modular approach Waterbear employed in its malware and it utilizes the DLL loader to decrypt and execute the payload. which is the first stage of the backdoor and its divided into two types.

The first type acts as command and control server and the second type listening to the specific ports.

Researchers also believe that the attackers use Waterbear as a secondary payload to help maintain presence after gaining some levels of access to the targets’ systems. 

Waterbear Infection Process

The infection process starts with the weaponized DLL loader, in which attackers using two different techniques to trigger the DLL loader.

  • One is modifying a legitimate server application to import and load the malicious DLL loader.
  • The second technique is performing phantom DLL hijacking and DLL side loading. 

Researchers from Trend Micro observed that the DLL loader loaded two payloads.

The first payload injects the code into a specific security product to hide the campaign backdoor and the second one is a typical Waterbear first-stage backdoor, which we will attempt to dissect first based on a specific case we observed during our analysis.

API Hooking

The payload encrypts all of the function blocks before executing the actual malicious routine to avoid memory scanning during the runtime.

API hooking

Attack mainly using the API hooking technique to hide the behaviors of the first-stage backdoor which is the second payload in this operation.

Another first payload uses API hooking techniques to avoid being detected by a specific security product and it hooks the two different API ( “ZwOpenProcess” and “GetExtendedTcpTable”) to hide its process.

Later it modifying the function in the memory of the security product process, hence the original system DLL files remain unchanged.

“The payload is composed of a two-stage shellcode. The first-stage shellcode finds a specific security product’s process with a hardcoded name and injects the second-stage shellcode into that process. The second-stage shellcode then performs API hooking inside the targeted process.” Trend Micro researchers said.

You can also read the complete technical analysis and Indicator of compromise here.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Trellix Launches Phishing Simulator to Help Organizations Detect and Prevent Attacks

Trellix, a leader in cybersecurity solutions, has unveiled its latest innovation, the Trellix Phishing...

AiTM Phishing Kits Bypass MFA by Hijacking Credentials and Session Tokens

Darktrace's Security Operations Center (SOC) in late 2024 and early 2025, cybercriminals have been...

Nitrogen Ransomware Uses Cobalt Strike and Log Wiping in Targeted Attacks on Organizations

Threat actors have leveraged the Nitrogen ransomware campaign to target organizations through deceptive malvertising...

Researchers Reveal Threat Actor TTP Patterns and DNS Abuse in Investment Scams

Cybersecurity researchers have uncovered the intricate tactics, techniques, and procedures (TTPs) employed by threat...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

New WordPress Malware Disguised as Anti-Malware Plugin Takes Full Control of Websites

The Wordfence Threat Intelligence team has identified a new strain of WordPress malware that...

Konni APT Deploys Multi-Stage Malware in Targeted Organizational Attacks

A sophisticated multi-stage malware campaign, potentially orchestrated by the North Korean Konni Advanced Persistent...

Outlaw Cybergang Launches Global Attacks on Linux Environments with New Malware

The Outlaw cybergang, also known as “Dota,” has intensified its global assault on Linux...