Thursday, December 19, 2024
HomeCyber AttackChinese Hackers Using Greyware Tool To DoS Against Mobile Phones

Chinese Hackers Using Greyware Tool To DoS Against Mobile Phones

Published on

SIEM as a Service

The Chinese hacking group known as Tropic Trooper was attributed to a new campaign discovered by cybersecurity researchers at CheckPoint. In this case, a new variant of the Yahoyah trojan is being used along with a new loader called Nimbda.

In addition, the trojan is embedded in a Greyware tool designed for DoS attacks against mobile phones. This tool is called SMS Bomber, and it floods phones with messages. 

While such tools are frequently used by beginners in the field of cybersecurity who are looking to conduct attacks against websites.

- Advertisement - SIEM as a Service

As a sign of their advanced cryptographic skills, the threat actors developed their own custom implementation of the AES specification, extending its functionality.

Attack flow

A malicious version of SMS Bomber is downloaded as part of the infection process. The following things are contained in this SMS Bomber –

  • Tool’s binary
  • Standard functionality

In addition to the modified download, a new file that injects a piece of code within a notepad.exe process has also been included.

There is actually an executable in the downloaded file called Nimbda which is the loader. SMS Bomber is an embedded executable in this loader that allows it to use the icon associated with SMS Bomber.

Shellcode is integrated into a notepad in order to create a background connection to a GitHub repository. Next, it fetches an executable that is obfuscated, decrypts it, and then executes it through a bug in DLLhost.exe, which exploits this loophole.

A brand new variant of Yahoyah is used for this payload. Here to gather data about the host the threat actors use this payload and then it sends the gathered data to the C2 server. 

According to the report, Below we have listed all the types of information gathered by Yahoyah:-

  • System name
  • Existence of WeChat files
  • Existence of Tencent files
  • MAC address of the system
  • AV products installed on the system
  • Local wireless network SSIDs
  • OS version

Implementation of custom AES 

Yahoyah uses a custom implementation of AES to encrypt data that is sent over the internet. In the technique it uses, double rounds of inversions are performed. 

Due to this implementation, Check Point has named it “AEES.” However, it does not make the encryption more robust, but rather, it makes it very hard for the security experts to examine the sample.

At the moment, it is unknown what the exact scope of the targeting will be. In this campaign, it is demonstrated how Tropic Trooper’s stealthy skills and capabilities can be used.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Beware Of Malicious SharePoint Notifications That Delivers Xloader Malware

Through the use of XLoader and impersonating SharePoint notifications, researchers were able to identify...

Malicious Supply Chain Attacking Moving From npm Community To VSCode Marketplace

Researchers have identified a rise in malicious activity on the VSCode Marketplace, highlighting the...

Hackers Weaponizing LNK Files To Create Scheduled Task And Deliver Malware Payload

TA397, also known as Bitter, targeted a Turkish defense organization with a spearphishing email...

BADBOX Botnet Hacked 74,000 Android Devices With Customizable Remote Codes

BADBOX is a cybercriminal operation infecting Android devices like TV boxes and smartphones with...

API Security Webinar

72 Hours to Audit-Ready API Security

APIs present a unique challenge in this landscape, as risk assessment and mitigation are often hindered by incomplete API inventories and insufficient documentation.

Join Vivek Gopalan, VP of Products at Indusface, in this insightful webinar as he unveils a practical framework for discovering, assessing, and addressing open API vulnerabilities within just 72 hours.

Discussion points

API Discovery: Techniques to identify and map your public APIs comprehensively.
Vulnerability Scanning: Best practices for API vulnerability analysis and penetration testing.
Clean Reporting: Steps to generate a clean, audit-ready vulnerability report within 72 hours.

More like this

Hackers Weaponizing LNK Files To Create Scheduled Task And Deliver Malware Payload

TA397, also known as Bitter, targeted a Turkish defense organization with a spearphishing email...

CISA Issues Secure Practices for Cloud Services To Strengthen U.S Federal Agencies

In a decisive move to bolster cloud security, the Cybersecurity and Infrastructure Security Agency...

RiseLoader Attack Windows By Employed A VMProtect To Drop Multiple Malware Families

RiseLoader, a new malware family discovered in October 2024, leverages a custom TCP-based binary...