Tuesday, April 16, 2024

Certificate Authority Hacked by Implanting Backdoor on Official Website

One of the largest certification authorities in Mongolia, the MonPass server has been hacked by the threat actors. 

The security researchers of Avast have pronounced that the threat actors have built a backdoor that has been built on Cobalt Strike into the company’s official client.

After the investigation, the experts confirmed that the backdoor was active from the 8th of February to the 3rd of March, 2021, on the official app.

The server was hacked by the threat actors nearly 8 times, and the experts found indication by eight various web shells and backdoors.

According to the security analysts of Avast, the main motive of the hackers was to infect different computers in Mongolia with malware. 

However, the security experts were investigating and working with the CERT Mongolia team as well as with MonPass from March to June so that they can find all the interventions.

Technical Analysis

After a proper investigation, the analysts declared that the malicious installer that has been used by the threat actors is an unsigned PE file. 

Here, the folder has been administered under a very unique process, that is whenever the users start downloading the authorized version of the installer from the MonPass official website the authorized version is grounded to the C:\Users\Public\ folder.  

However, this process ensures that the installer works as it used to work earlier, such as a regular user is absurd to mark anything unusual with the help of this process.

Compromised Web server content

During the investigation, the cybersecurity researchers of Avast found two compromised Web server content, and here we have mentioned them below:-

  • DNS.exe
  • Browser_plugin.exe

Clues lead to a Chinese threat actor

After a very long investigation process, the experts are yet not confirmed that who has initiated this attack. But as per the record of the previous attack that has happened to Mongolia and other Asian countries, they are speculating that it might be Beijing.

As they have got many clues that indicate, it might be Chines hacking group, well in December 2020 the experts detected that a Chines hacking group has attacked Mongolia by negotiating a software company that provided software to multiple Mongolian government offices.

Moreover, the Chinese cyber-espionage campaign has also attacked Mongolia by using spear-phishing emails, and not only this but the Chinese cyber-espionage group also break and embedded malware inside the certificate installation app that has been implemented by the Vietnam Government Certification Authority (VGCA).

After knowing all the details regarding the attack, the analysts have reported all the clients that are baffled in the attack, and as part of this, the experts have also asserted that the malware was using steganography to decrypt the Cobalt Strike beacon in their attack. 

In the meantime, the users were recommended to stay active, and should immediately remove the client and the backdoor that they have installed till now.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates

Website

Latest articles

Hacker Customize LockBit 3.0 Ransomware to Attack Orgs Worldwide

Cybersecurity researchers at Kaspersky have uncovered evidence that cybercriminal groups are customizing the virulent...

Microsoft .NET, .NET Framework, & Visual Studio Vulnerable To RCE Attacks

A new remote code execution vulnerability has been identified to be affecting multiple Microsoft...

LightSpy Hackers Indian Apple Device Users to Steal Sensitive Data

The revival of the LightSpy malware campaign has been observed, focusing on Indian Apple...

LightSpy Malware Attacking Android and iOS Users

A new malware known as LightSpy has been targeting Android and iOS users.This sophisticated...

This Startup Aims To Simplify End-to-End Cybersecurity, So Anyone Can Do It

The Web3 movement is going from strength to strength with every day that passes....

Alert! Palo Alto RCE Zero-day Vulnerability Actively Exploited in the Wild

In a recent security bulletin, Palo Alto Networks disclosed a critical vulnerability in its...

6-year-old Lighttpd Flaw Impacts Intel And Lenovo Servers

The software supply chain is filled with various challenges, such as untracked security vulnerabilities...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Top 3 SME Attack Vectors

Securing the Top 3 SME Attack Vectors

Cybercriminals are laying siege to small-to-medium enterprises (SMEs) across sectors. 73% of SMEs know they were breached in 2023. The real rate could be closer to 100%.

  • Stolen credentials
  • Phishing
  • Exploitation of vulnerabilities

Related Articles