Friday, May 2, 2025
HomeCyber Security NewsCarderbee Hacking Group Uses Legitimate Software in Supply Chain Attack

Carderbee Hacking Group Uses Legitimate Software in Supply Chain Attack

Published on

SIEM as a Service

Follow Us on Google News

For a supply chain attack and to plant the Korplug backdoor (aka PlugX) on the systems of the targeted victims, an unknown APT group was found to be using the “Cobra DocGuard.” 

Cobra DocGuard is a legit software package that enables users to manage their Consolidated Omnibus Budget Reconciliation Act documents, and it’s designed by “EsafeNet,” a Chinese company.

Cybersecurity experts at Symantec discovered that threat actors behind this unknown APT group, which is dubbed as “Carderbee” was found to be using the legitimate Microsoft certificate to sign malware.

- Advertisement - Google News

While in a report shared with Cyber Security News, researchers confirmed that the victims that were targeted by this group during the supply chain attack campaign were mainly from Hong Kong and some from other regions of Asia.

Attack Chain

Earlier, the Symantec Threat Hunter Team discovered a signed Korplug version in April 2023 but at that time couldn’t confirm if it was Budworm’s (aka LuckyMouse, APT27) work.

Multiple APT groups, including the APT41 and Budworm, use the “Korplug” backdoor, but, researchers affirmed that at the moment, only their geographical locations are identified, while the targeted industry sectors remain unknown.

While in this recent campaign, about 100 computers showed malicious activity in affected organizations. However, the Cobra DocGuard was present on 2,000 computers, and this scenario suggests targeted payload delivery.

The infection’s delivery location on computers points to a supply chain attack or malicious Cobra DocGuard setup as the compromise method.

  • csidl_system_drive\program files\esafenet\cobra dog guard client\update

Throughout 2023, multiple malware families emerged via this method, and notably, a Microsoft-signed downloader installed the “Korplug” backdoor from the following location by fetching the ‘update.zip’ file:-

  • http://cdn.stream-amazon[.]com/update.zip

The above-mentioned .zip file is a Zlib archive that decompresses and runs content.dll, acting as a dropper for x64 and x86 drivers based on the system environment.

Capabilities of Korplug sample

Here below, we have mentioned all the abilities of the Korplug sample detected:-

  • Execute commands via cmd
  • Enumerate files
  • Check running processes
  • Download files 
  • Open firewall ports
  • Act as a keylogger

Moreover, the threat actors behind this campaign are highly skilled, as the complete scenario of this campaign depicted the same. As in this case, to evade detection, the threat actors stealthily used the legitly signed malware.

So, selective payload deployment and targeting completely suggest careful planning and reconnaissance.

Indicators of Compromise

SHA256 File Hashes:

  • 96170614bbd02223dc79cec12afb6b11004c8edb8f3de91f78a6fc54d0844622
  • 19a6a404605be964ab87905d59402e2890460709a1d9038c66b3fbeedc1a2343
  • 1ff7b55dde007b7909f43dd47692f7c171caa2897d663eb9db01001062b1fe9d
  • 2400d8e66c652f4f8a13c99a5ffb67cb5c0510144b30e93122b1809b58614936
  • 2f714aaf9e3e3e03e8168fe5e22ba6d8c1b04cbfa3d37ff389e9f1568a80cad4
  • 47b660bbaacb2a602640b5e2c589a3adc620a0bfc9f0ecfb8d813a803d7b75e2
  • 5467e163621698b38c2ba82372bac110cea4121d7c1cec096958a4d9eaa44be7
  • 7e6d0f14302662f52e4379eb5b69a3749d8597e8f61266aeda74611258972a3d
  • 85fc7628c5c7190f25da7a2c7ee16fc2ad581e1b0b07ba4ac33cff4c6e94c8af
  • 8bd40da84c8fa5f6f8e058ae7e36e1023aca1b9a9c8379704934a077080da76f
  • 8ca135b2f4df6a714b56c1a47ac5baa80a11c6a4fcc1d84a047d77da1628f53f
  • 9e96f70ce312f2638a99cfbd3820e85798c0103c7dc06fe0182523e3bf1e2805
  • 9fc49d9f4b922112c2bafe3f1181de6540d94f901b823e11c008f6d1b2de218c
  • b5159f8ae16deda7aa5d55100a0eac6e5dacd1f6502689b543513a742353d1ea
  • b7b8ea25786f8e82aabe4a4385c6142d9afe03f090d1433d0dc6d4d6ccc27510
  • b84f68ab098ce43f9cb363d0a20a2267e7130078d3d2d8408bfb32bbca95ca37
  • f64267decaa982c63185d92e028f52c31c036e85b2731a6e0bccdb8f7b646e97

Remote IP addresses:

  • 45.76.179[.]209
  • 104.238.151[.]104

URLs:

  • http://111.231.100[.]228:8888/CDGServer3/UpgradeService2
  • http://103.151.28[.]11:8090/CDGServer3/UpgradeService2

Domains:

  • cdn.stream-amazon[.]com
  • cdn.ofo[.]ac
  • gobay[.]info
  • tjj.active-microsoft[.]com
  • githubassets.akamaixed[.]net
  • ms-g9-sites-prod-cdn.akamaixed[.]net 
  • ms-f7-sites-prod-cdn.akamaixed[.]net

Keep yourself informed about the latest Cyber Security News by following us on GoogleNewsLinkedinTwitter, and Facebook.

Tushar Subhra
Tushar Subhra
Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Latest articles

Nebulous Mantis hackers have Deployed the RomCom RAT globally, Targeting organizations.

Nebulous Mantis, also known as Cuba, STORM-0978, Tropical Scorpius, and UNC2596, is a Russian-speaking...

Why CISOs Are Adopting DevSecOps for Secure Software Development

CISOs adopting DevSecOps strategically enhance security measures while ensuring fast-paced software development, responding to...

Dutch Services Disrupted by DDoS Attacks From Russian-Affiliated Hacktivists

Multiple Dutch organizations have experienced significant service disruptions this week due to a series...

Seven Malicious Packages Exploit Gmail SMTP to Run Harmful Commands

A major supply chain security incident has rocked the Python open-source community as researchers...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Nebulous Mantis hackers have Deployed the RomCom RAT globally, Targeting organizations.

Nebulous Mantis, also known as Cuba, STORM-0978, Tropical Scorpius, and UNC2596, is a Russian-speaking...

Dutch Services Disrupted by DDoS Attacks From Russian-Affiliated Hacktivists

Multiple Dutch organizations have experienced significant service disruptions this week due to a series...

Seven Malicious Packages Exploit Gmail SMTP to Run Harmful Commands

A major supply chain security incident has rocked the Python open-source community as researchers...