Chinese Hackers Leverage Reverse SSH Tool in New Wave of Attacks on Organizations

The Chinese hacker group known as Billbug, or Lotus Blossom, targeted high-profile organizations across Southeast Asia.

The attackers, who were previously documented by Symantec and later Cisco Talos, employed a variety of new custom tools, alongside novel techniques like DLL sideloading, to infiltrate and persist within their victims’ networks.

New Weapons in the Arsenal

Billbug’s arsenal included a range of malware specifically designed to evade detection and exfiltrate sensitive data.

- Advertisement -

Among these was a new variant of the Sagerunex backdoor (SHA256: 4b430e9e43611aa67263f03fd42207c8ad06267d9b971db876b6e62c19a0805e), which was used to establish persistence by manipulating registry settings to run as a service.

This backdoor is known for its flexibility, allowing attackers to execute commands and steal data as intended.

A significant addition to their toolkit was a reverse SSH tool (SHA256: 461f0803b67799da8548ebfd979053fb99cf110f40ac3fc073c3183e2f6e9ced) capable of opening an SSH connection on port 22, thereby providing remote access from internal networks to the internet.

This tool was particularly useful for maintaining control over the compromised systems discreetly.

Advanced Credential Stealing

The hackers also deployed ChromeKatz and CredentialKatz to harvest credentials from the Chrome browser.

These tools, with multiple variants, were designed to extract both credentials and cookies, facilitating further network infiltration.

To bypass security measures, Billbug utilized DLL sideloading, a technique where they used legitimate software to load malicious DLLs.

An example includes the manipulation of a Trend Micro binary named tmdbglog.exe to sideload a malicious DLL called tmdglog.dll, which then executed encrypted contents from C:\Windows\temp\TmDebug.log.

Similarly, a Bitdefender binary named bds.exe was exploited to load a malicious DLL named log.dll, which attempted to run code hidden within winnt.config.

The campaign not only compromised a government ministry, an air traffic control organization, a telecoms operator, and a construction company in one Southeast Asian country but also staged intrusions into a news agency in another country and an air freight organization in a neighboring nation.

These attacks highlight the group’s broad strategic interests, targeting sectors vital for national security and economic stability.

For organizations looking to safeguard against such intrusions, regular updates to security protocols are essential.

Symantec has released a Protection Bulletin detailing the latest protection measures against this threat actor.

Additionally, monitoring for and blocking the Indicators of Compromise (IOCs) can help in identifying and thwarting potential attacks.

This sophisticated campaign underscores the evolving cyber espionage capabilities of state-linked actors and the persistent threat they pose to organizations worldwide, prompting a need for heightened vigilance and robust cybersecurity measures.

Indicators of Compromise (IOCs)

Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!