Certificate Authority Hacked by Implanting Backdoor on Official Website

One of the largest certification authorities in Mongolia, the MonPass server has been hacked by the threat actors. 

The security researchers of Avast have pronounced that the threat actors have built a backdoor that has been built on Cobalt Strike into the company’s official client.

After the investigation, the experts confirmed that the backdoor was active from the 8th of February to the 3rd of March, 2021, on the official app.

The server was hacked by the threat actors nearly 8 times, and the experts found indication by eight various web shells and backdoors.

According to the security analysts of Avast, the main motive of the hackers was to infect different computers in Mongolia with malware. 

However, the security experts were investigating and working with the CERT Mongolia team as well as with MonPass from March to June so that they can find all the interventions.

Technical Analysis

After a proper investigation, the analysts declared that the malicious installer that has been used by the threat actors is an unsigned PE file. 

Here, the folder has been administered under a very unique process, that is whenever the users start downloading the authorized version of the installer from the MonPass official website the authorized version is grounded to the C:\Users\Public\ folder.  

However, this process ensures that the installer works as it used to work earlier, such as a regular user is absurd to mark anything unusual with the help of this process.

Compromised Web server content

During the investigation, the cybersecurity researchers of Avast found two compromised Web server content, and here we have mentioned them below:-

• DNS.exe
• Browser_plugin.exe

Clues lead to a Chinese threat actor

After a very long investigation process, the experts are yet not confirmed that who has initiated this attack. But as per the record of the previous attack that has happened to Mongolia and other Asian countries, they are speculating that it might be Beijing.

As they have got many clues that indicate, it might be Chines hacking group, well in December 2020 the experts detected that a Chines hacking group has attacked Mongolia by negotiating a software company that provided software to multiple Mongolian government offices.

Moreover, the Chinese cyber-espionage campaign has also attacked Mongolia by using spear-phishing emails, and not only this but the Chinese cyber-espionage group also break and embedded malware inside the certificate installation app that has been implemented by the Vietnam Government Certification Authority (VGCA).

After knowing all the details regarding the attack, the analysts have reported all the clients that are baffled in the attack, and as part of this, the experts have also asserted that the malware was using steganography to decrypt the Cobalt Strike beacon in their attack. 

In the meantime, the users were recommended to stay active, and should immediately remove the client and the backdoor that they have installed till now.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates