Chinese-linked APT Hackers Spying Orgs Over 10 Years Using DNS Tunneling To Evade Detection

Security researchers at SentinelLabs recently discovered that a Chinese-speaking APT adversary has been actively operating all of its operations since 2013 and has been executing all of its attacks since that time.

The hacking group is known as the “Aoqin Dragon” is focused on cyber-espionage, and their target sectors include:- 

  • Government
  • Education
  • Telecommunication organizations (Located in Singapore, Hong Kong, Vietnam, Cambodia, and Australia.)

Throughout the years, the techniques of threat actors have improved and evolved. However, some concepts and tactics remain the same.

Intrusion techniques

It has been revealed that in the time since Aoqin Dragon was first spotted, there were three distinct infection chains that it implemented. The oldest and most widespread of these attacks, used between 2012 and 2015, exploited vulnerabilities in Microsoft Office files, and the flaws exploited are known:-

  1. CVE-2012-0158
  2. CVE-2010-3333

As a result of this attack tactic, the security firm, FireEye was able to detect a spear-phishing campaign, coordinated by the Chinese-sponsored, “Naikon Group.” 

While this Chinese-sponsored threat group targeted a government agency in the Asia-Pacific region (APAC) and the US think tank in 2014.

Malware executables are masked with fake anti-virus icons to make it appear as if they were legit anti-virus products, tricking the user into running them, and then executing a malicious dropper on the target system.

The use of removable disk shortcut files has become increasingly important for Aoqin Dragon since its initial release in 2018. When clicked, it executes a DLL hijacking and loads an encrypted payload to create backdoors, which enables the backdoor to become operational.

In this particular case, the “Evernote Tray Application” is the name that the malware runs under and was executed as soon as the system got activated. Its payload is copied onto other devices on the network of the target as soon as the loader detects removable devices. As a result, they are also infected by the payload as well.

As noted earlier, the malware is displayed with the name tag of “Evernote Tray Application” and then executed when the system gets started. The loader copies the payload on removable devices in order to infect other devices through the target’s network if it detects removable devices.

Tools and commands used

To make it more difficult for the group’s data thefts and detect their identity, they use the following tools when copying files from compromised devices:-

  • Themida wrapping
  • Heyoka exfiltration tool
  • Exfil tool

It has been reported that the malware developers at Aoqin Dragon have revised Heyoka in a way that authorizes it to be customized to sustain the following commands that we have mentioned below:-

  • open a shell
  • get host drive information
  • search file function
  • input data in an exit file
  • create a file
  • create a process
  • get all process information in this host
  • kill process
  • create a folder
  • delete file or folder

Cyberespionage group Aoqin Dragon has been active for nearly a decade now and has become a formidable force in global cybercrime. 

In order to provide insight into the evolution of this activity cluster, SentinelLabs will continue to track it.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates

Balaji

BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Recent Posts

Threat Actors Exploit Google Docs And Weebly Services For Malware Attacks

Phishing attackers used Google Docs to deliver malicious links, bypassing security measures and redirecting victims…

6 hours ago

Python NodeStealer: Targeting Facebook Business Accounts to Harvest Login Credentials

The Python-based NodeStealer, a sophisticated info-stealer, has evolved to target new information and employ advanced…

7 hours ago

XSS Vulnerability in Bing.com Let Attackers Send Crafted Malicious Requests

A significant XSS vulnerability was recently uncovered in Microsoft’s Bing.com, potentially allowing attackers to execute…

9 hours ago

Meta Removed 2 Million Account Linked to Malicious Activities

 Meta has announced the removal of over 2 million accounts connected to malicious activities, including…

13 hours ago

Veritas Enterprise Vault Vulnerabilities Lets Attackers Execute Arbitrary Code Remotely

Critical security vulnerability has been identified in Veritas Enterprise Vault, a widely-used archiving and content…

14 hours ago

7-Zip RCE Vulnerability Let Attackers Execute Remote Code

A critical security vulnerability has been disclosed in the popular file archiving tool 7-Zip, allowing…

14 hours ago