Certificate Authority Hacked by Implanting Backdoor on Official Website

One of the largest certification authorities in Mongolia, the MonPass server has been hacked by the threat actors. 

The security researchers of Avast have pronounced that the threat actors have built a backdoor that has been built on Cobalt Strike into the company’s official client.

After the investigation, the experts confirmed that the backdoor was active from the 8th of February to the 3rd of March, 2021, on the official app.

The server was hacked by the threat actors nearly 8 times, and the experts found indication by eight various web shells and backdoors.

According to the security analysts of Avast, the main motive of the hackers was to infect different computers in Mongolia with malware. 

However, the security experts were investigating and working with the CERT Mongolia team as well as with MonPass from March to June so that they can find all the interventions.

Technical Analysis

After a proper investigation, the analysts declared that the malicious installer that has been used by the threat actors is an unsigned PE file. 

Here, the folder has been administered under a very unique process, that is whenever the users start downloading the authorized version of the installer from the MonPass official website the authorized version is grounded to the C:\Users\Public\ folder.  

However, this process ensures that the installer works as it used to work earlier, such as a regular user is absurd to mark anything unusual with the help of this process.

Compromised Web server content

During the investigation, the cybersecurity researchers of Avast found two compromised Web server content, and here we have mentioned them below:-

  • DNS.exe
  • Browser_plugin.exe

Clues lead to a Chinese threat actor

After a very long investigation process, the experts are yet not confirmed that who has initiated this attack. But as per the record of the previous attack that has happened to Mongolia and other Asian countries, they are speculating that it might be Beijing.

As they have got many clues that indicate, it might be Chines hacking group, well in December 2020 the experts detected that a Chines hacking group has attacked Mongolia by negotiating a software company that provided software to multiple Mongolian government offices.

Moreover, the Chinese cyber-espionage campaign has also attacked Mongolia by using spear-phishing emails, and not only this but the Chinese cyber-espionage group also break and embedded malware inside the certificate installation app that has been implemented by the Vietnam Government Certification Authority (VGCA).

After knowing all the details regarding the attack, the analysts have reported all the clients that are baffled in the attack, and as part of this, the experts have also asserted that the malware was using steganography to decrypt the Cobalt Strike beacon in their attack. 

In the meantime, the users were recommended to stay active, and should immediately remove the client and the backdoor that they have installed till now.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates

Balaji

BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Recent Posts

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting the growing, widespread use and potential…

7 hours ago

C2A Security’s EVSec Risk Management and Automation Platform Gains Automotive Industry Favor as Companies Pursue Regulatory Compliance

In 2023, C2A Security added multiple OEMs and Tier 1s to its portfolio of customers, successful evaluations, and partnerships such…

9 hours ago

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and education. The latest update, Wireshark 4.2.4,…

11 hours ago

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered platform designed to redefine how we…

11 hours ago

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information and grant unauthorized access. It's an…

12 hours ago

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including two zero-day exploits showcased at the…

15 hours ago