Friday, November 1, 2024
HomeBackdoorCertificate Authority Hacked by Implanting Backdoor on Official Website

Certificate Authority Hacked by Implanting Backdoor on Official Website

Published on

Malware protection

One of the largest certification authorities in Mongolia, the MonPass server has been hacked by the threat actors. 

The security researchers of Avast have pronounced that the threat actors have built a backdoor that has been built on Cobalt Strike into the company’s official client.

After the investigation, the experts confirmed that the backdoor was active from the 8th of February to the 3rd of March, 2021, on the official app.

- Advertisement - SIEM as a Service

The server was hacked by the threat actors nearly 8 times, and the experts found indication by eight various web shells and backdoors.

According to the security analysts of Avast, the main motive of the hackers was to infect different computers in Mongolia with malware. 

However, the security experts were investigating and working with the CERT Mongolia team as well as with MonPass from March to June so that they can find all the interventions.

Technical Analysis

After a proper investigation, the analysts declared that the malicious installer that has been used by the threat actors is an unsigned PE file. 

Here, the folder has been administered under a very unique process, that is whenever the users start downloading the authorized version of the installer from the MonPass official website the authorized version is grounded to the C:\Users\Public\ folder.  

However, this process ensures that the installer works as it used to work earlier, such as a regular user is absurd to mark anything unusual with the help of this process.

Compromised Web server content

During the investigation, the cybersecurity researchers of Avast found two compromised Web server content, and here we have mentioned them below:-

  • DNS.exe
  • Browser_plugin.exe

Clues lead to a Chinese threat actor

After a very long investigation process, the experts are yet not confirmed that who has initiated this attack. But as per the record of the previous attack that has happened to Mongolia and other Asian countries, they are speculating that it might be Beijing.

As they have got many clues that indicate, it might be Chines hacking group, well in December 2020 the experts detected that a Chines hacking group has attacked Mongolia by negotiating a software company that provided software to multiple Mongolian government offices.

Moreover, the Chinese cyber-espionage campaign has also attacked Mongolia by using spear-phishing emails, and not only this but the Chinese cyber-espionage group also break and embedded malware inside the certificate installation app that has been implemented by the Vietnam Government Certification Authority (VGCA).

After knowing all the details regarding the attack, the analysts have reported all the clients that are baffled in the attack, and as part of this, the experts have also asserted that the malware was using steganography to decrypt the Cobalt Strike beacon in their attack. 

In the meantime, the users were recommended to stay active, and should immediately remove the client and the backdoor that they have installed till now.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS...

ATPC Cyber Forum to Focus on Next Generation Cybersecurity and Artificial Intelligence Issues

White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch...

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan...

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Researchers Backdoored Azure Automation Account Packages And Runtime Environments

Runtime environments offer a flexible way to customize Automation Account Runbooks with specific packages....

Hackers Using Supershell Malware To Attack Linux SSH Servers

Researchers identified an attack campaign targeting poorly secured Linux SSH servers, where the attack...

UNC2970 Hackers Attacking Job Seekers Using Weaponized PDF Reader

UNC2970, a North Korean cyber espionage group, used customized SumatraPDF trojans to deliver MISTPEN...