Tuesday, October 8, 2024
HomeCyber AttackChinese Panda APT Hacking Websites To Infect Windows And MacOS Users

Chinese Panda APT Hacking Websites To Infect Windows And MacOS Users

Published on

Evasive Panda dubbed BRONZE HIGHLAND and Daggerfly, a Chinese-speaking APT group operating since at least 2012, has been spotted conducting cyberespionage targeting individuals in mainland China, Hong Kong, Macao, and Nigeria. 

Southeast and East Asian governments, notably those in China, Macao, Myanmar, the Philippines, Taiwan, and Vietnam, were the targets of attacks. The targets included other Chinese and Hong Kong groups.

Since 2020, Evasive Panda has been capable of using adversary-in-the-middle attacks to spread its backdoors by obtaining updates from legitimate software.

- Advertisement - EHA

“The group uses its own custom malware framework with a modular architecture that allows its backdoor, known as MgBot, to receive modules to spy on its victims and enhance its capabilities,” ESET researchers shared with Cyber Security News.

Specifics Of The Cyberespionage Campaign

Since September 2023, Tibetans have been the victims of a cyberespionage campaign that was uncovered.

It used a supply-chain compromise to distribute trojanized installers of software that translated Tibetan language and a targeted watering hole, also known as a strategic web compromise. 

The hijacked website being used as a watering hole is owned by the Kagyu International Monlam Trust, an Indian organization that spreads Tibetan Buddhism worldwide.

Timeline of events related to the attack

The attackers intended to use malicious downloaders for macOS and Windows to infect website users with MgBot and a backdoor known as Nightdoor. 

MgBot, which is used exclusively by Evasive Panda, can provide attackers with a significant amount of information about compromised machines.

Nightdoor was first discovered in 2020, the Google Drive API or UDP is the two ways the backdoor and its C&C server can communicate.

First, the attackers installed a script on the website that checks the IP address of the possible victim and, if it falls within one of the targeted addresses.

The script sends an HTTP request to determine whether the attacker’s intermediary downloader is currently operating on the possible victim’s computer.

The implant responds on a previously hacked system with handleCallback({“success”:true }).

JavaScript code that checks in with the implant

Subsequently, it displays a fake error page that convinces the user to download a “fix” called certificate (which, depending on the operating system, ends in.exe for Windows or.pkg for macOS). 

A fake graphic rendered by the JavaScript

Depending on the user’s operating system, a script that downloads a payload is triggered when they click the “Immediate Fix” button.

Researchers suspect that at the time, the attackers took advantage of the Monlam festival that was scheduled to take place in January and February of 2024 to compromise individuals who visited the website that had turned into a watering hole.

The attackers deployed a number of downloaders, droppers, and backdoors, such as Nightdoor, the most recent significant addition to the group’s toolkit, which has been used to target multiple networks in East Asia.

With Perimeter81 malware protection, you can block malware, including Trojans, ransomware, spyware, rootkits, worms, and zero-day exploits. All are incredibly harmful and can wreak havoc on your network.

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Hackers Gained Unauthorized Network Access to Casio Networks

Casio Computer Co., Ltd. has confirmed that a third party illegally accessed its network...

Open-Source Scanner Released to Detect CUPS Vulnerability

A new open-source scanner has been released to detect a critical vulnerability in the...

Comcast Cyber Attack Impacts 237,000+ Users Personal Data

Comcast Cable Communications LLC has reported that over 237,000 users' data has been compromised....

American Water Works Cyber Attack Impacts IT Systems

American Water Works Company, Inc., a leading provider of water and wastewater services, announced...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Hackers Gained Unauthorized Network Access to Casio Networks

Casio Computer Co., Ltd. has confirmed that a third party illegally accessed its network...

Open-Source Scanner Released to Detect CUPS Vulnerability

A new open-source scanner has been released to detect a critical vulnerability in the...

Comcast Cyber Attack Impacts 237,000+ Users Personal Data

Comcast Cable Communications LLC has reported that over 237,000 users' data has been compromised....