For a supply chain attack and to plant the Korplug backdoor (aka PlugX) on the systems of the targeted victims, an unknown APT group was found to be using the “Cobra DocGuard.”
Cobra DocGuard is a legit software package that enables users to manage their Consolidated Omnibus Budget Reconciliation Act documents, and it’s designed by “EsafeNet,” a Chinese company.
Cybersecurity experts at Symantec discovered that threat actors behind this unknown APT group, which is dubbed as “Carderbee” was found to be using the legitimate Microsoft certificate to sign malware.
While in a report shared with Cyber Security News, researchers confirmed that the victims that were targeted by this group during the supply chain attack campaign were mainly from Hong Kong and some from other regions of Asia.
Earlier, the Symantec Threat Hunter Team discovered a signed Korplug version in April 2023 but at that time couldn’t confirm if it was Budworm’s (aka LuckyMouse, APT27) work.
Multiple APT groups, including the APT41 and Budworm, use the “Korplug” backdoor, but, researchers affirmed that at the moment, only their geographical locations are identified, while the targeted industry sectors remain unknown.
While in this recent campaign, about 100 computers showed malicious activity in affected organizations. However, the Cobra DocGuard was present on 2,000 computers, and this scenario suggests targeted payload delivery.
The infection’s delivery location on computers points to a supply chain attack or malicious Cobra DocGuard setup as the compromise method.
Throughout 2023, multiple malware families emerged via this method, and notably, a Microsoft-signed downloader installed the “Korplug” backdoor from the following location by fetching the ‘update.zip’ file:-
The above-mentioned .zip file is a Zlib archive that decompresses and runs content.dll, acting as a dropper for x64 and x86 drivers based on the system environment.
Here below, we have mentioned all the abilities of the Korplug sample detected:-
Moreover, the threat actors behind this campaign are highly skilled, as the complete scenario of this campaign depicted the same. As in this case, to evade detection, the threat actors stealthily used the legitly signed malware.
So, selective payload deployment and targeting completely suggest careful planning and reconnaissance.
SHA256 File Hashes:
Remote IP addresses:
URLs:
Domains:
Keep yourself informed about the latest Cyber Security News by following us on GoogleNews, Linkedin, Twitter, and Facebook.
A very important message from the Norwegian National Cyber Security Centre (NCSC) says that Secure Socket Layer/Transport Layer Security (SSL/TLS)…
Linux is widely used in numerous servers, cloud infrastructure, and Internet of Things devices, which makes it an attractive target…
ViperSoftX malware, known for stealing cryptocurrency information, now leverages Tesseract, an open-source OCR engine, to target infected systems, which extracts…
Santander has confirmed that there was a major data breach that affected its workers and customers in Spain, Uruguay, and…
The U.S. government has offered a prize of up to $5 million for information that leads to the arrest and…
Russia leverages a mix of state-backed Advanced Persistent Threat (APT) groups and financially motivated cybercriminals to achieve its strategic goals,…