Friday, March 29, 2024

Chinese APT Hackers Deploys MoonBounce Implant In UEFI Firmware

Kaspersky Lab experts have recently discovered a security vulnerability in UEFI firmware, and this vulnerability was detected while studying the Firmware Scanner logs at the end of 2021.

During the further analysis, they found that the threat actors had modified one of the components in the firmware image that enabled the attackers to change the execution chain in UEFI and then inject the malicious code that runs at the startup of the machine.

On the victim’s network, the components of the modified firmware and other artifacts of malicious activity were analyzed, and it’s been detected that the malicious code which was implanted into the UEFI firmware was dubbed as “MoonBounce.”

Other Malware and Implants That are Under The Radar

Here we have mentioned all the other malware, stagers, and post-exploitation malware implants that were used by the Chinese-speaking attackers:-

  • Microcin: It’s a backdoor that is used by the operators of the SixLittleMonkeys group.
  • Mimikat_ssp: It’s a publicly available post-exploitation tool that is used to dump the credentials and security secrets from exe.
  • Go implant: It’s a formerly unknown backdoor that is used to contact a C2 server by using the RESTful API.

Moreover, this MoonBounce implant targets the organizations that are in command of several corporations dealing with transport technology. In short, their target is the transport sector.

Feature of MoonBounce

MoonBounce offers a distinctive feature that enables the MoonBounce to remain un-hidden in the ESP (EFI System Partition), and it’s the section where the UEFI code is located; but, in this situation with an active implant, it is immediately embedded in the SPI flash memory, that is located on the motherboard.

Here, the malware can be launched in both situations, which implies:-

  • After reinstalling the operating system.
  • After formatting or replacing the hard drive. 

While on the infected device until the SPI memory is flashed, which is a very complicated process until the motherboard is replaced, the bootkit will remain over there.

The MoonBounce is the third UEFI bootkit that was capable of infecting SPI memory, but, apart from this, the previous two cases are:-

  • LoJax malware
  • MosaicRegressor malware

Operators of MoonBounce

The MoonBounce was used as a form to maintain access to the infected host and then in the second stage of the attack deploy the malware.

While it’s been confirmed by the experts that during their analysis they found MoonBounce was deployed once so far on the network of an unnamed transport company.

Since MoonBounce and other malware found on the victim’s network constantly contacted the server infrastructure, from where the APT41 group command all its instructions.

So, they have speculated that the operators behind the MoonBounce malware could be a Chinese cyber-espionage group that is dubbed as “APT41.” What is not clear till now is the installation procedure of MoonBounce.

But, still, cybersecurity researchers are analyzing the MoonBounce closely to get all the key details.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates

Website

Latest articles

How to Analyse .NET Malware? – Reverse Engineering Snake Keylogger

Utilizing sandbox analysis for behavioral, network, and process examination provides a foundation for reverse...

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles