Cybersecurity researchers at Symantec’s Threat Hunter Team recently discovered that the Redfly threat actor group used ShadowPad Trojan to breach an Asian national grid for 6 months.
Artificial intelligence-driven cyber threats grow as technology advances, significantly influencing and boosting threat actor sophistication.
Persistent espionage attacks by threat actors on critical national infrastructure (CNI) raise global concerns among governments and CNI entities.
In this security breach, the threat actors successfully stole the credentials and compromised computers.
The latest attack is part of the ongoing global CNI espionage wave, with the following countries on high alert after the Volt Typhoon’s U.S. infiltration:-
ShadowPad is initially a modular, short-lived underground RAT, now tied to espionage groups like APT41. Recent power grid attacks linked to Redfly, distinct from Blackfly and Grayfly.
Here below, we have mentioned all the tools that the threat actors use in these attacks:-
With DoControl, you can keep your SaaS applications and data safe and secure by creating workflows tailored to your needs. It’s an easy and efficient way to identify and manage risks. You can mitigate the risk and exposure of your organization’s SaaS applications in just a few simple steps.
Initial intrusion on February 28, 2023, followed by ShadowPad execution on May 17, confirming attackers’ presence. A suspicious 1.bat file ran on May 16, leading to PackerLoader execution in the %TEMP% directory.
Next, all-user access is granted to dump_diskfs.sys driver, potentially for file system dumps and exfiltration. From the following Windows registry, the credentials were dumped:-
On May 19, attackers returned, running PackerLoader and 1.bat, then with the help of a sneaky “displayswitch.exe” file, Redfly launched their malicious payload.
While besides this, they later used PowerShell to spy on the writable drives. Apart from this, the displayswitch.exe was triggered in %TEMP% on May 26 and swiftly dumped the registry credentials and erased the security logs.
Next, the attackers used ProcDump on May 29 and Oleview on May 31 for malicious activities and possibly leveraged the stolen credentials for lateral movement.
Over the past year, threat actors have actively targeted and attacked the CNI organizations. Even their attack frequency has also significantly increased, which is now a concerning factor.
Threat actors maintaining a long-term presence on grids pose the risk of disruptive attacks in nation-states during political tension.
Keep informed about the latest Cyber Security News by following us on Google News, Linkedin, Twitter, and Facebook.
As Tax Day on April 15 approaches, a alarming cybersecurity threat has emerged targeting U.S.…
Insikt Group has uncovered two new malware families, TerraStealerV2 and TerraLogger, attributed to the notorious…
MintsLoader, a malicious loader first observed in 2024, has emerged as a formidable tool in…
Cybercriminals are intensifying their efforts to undermine multi-factor authentication (MFA) through adversary-in-the-middle (AiTM) attacks, leveraging…
A recent investigation by the FortiGuard Incident Response (FGIR) team has uncovered a sophisticated, long-term…
StealC, a notorious information stealer and malware downloader first sold in January 2023, has rolled…