Saturday, November 2, 2024
HomeComputer SecurityChinese State-Sponsored ATP 10 Hackers Launching Cyber Attack On U.S Utilities

Chinese State-Sponsored ATP 10 Hackers Launching Cyber Attack On U.S Utilities

Published on

Malware protection

Researchers discovered a new malware dubbed “LookBack” distributed via spear-phishing email campaign to attack the entities in the United States.

Based on the telemetry data, the attack believed to be initiated by Chinese sponsored threat actors also known as APT 10, one of the sophisticated hacking group in the world and the group has a long history of targeting commercial activities including aviation, satellite, and maritime technology, industrial factory automation, finance, telecommunications and more.

Spear-phishing emails impersonate the US-based engineering licensing board and the email delivered from the threat actors who controlled domains nceess [.]com. Nceess[.]com which appears to be owned by the US National Council of Examiners for Engineering and Surveying.

- Advertisement - SIEM as a Service

Further analysis revealed that the spear-phishing emails carried malicious word documents with the macro that tricks victims to enable it to drop the malware dubbed “Lookback”.

Researchers from Proofpoint found a remote access trojan associated with a proxy mechanism to establish a connection with the command & control server to communicate further operations.

Threat actors using a sophisticated delivery mechanism to deliver the Lookback malware to target the utilities and critical infrastructure.

LookBack  Malware  Exploitation  Process

Through Malicious document, threat actors try to install the LookBack malware by tricking victims to enable the VBA macro which drops the three Privacy Enhanced Mail (PEM) files to the host: tempgup.txt, tempgup2.txt, and tempsodom.txt. 

The result of LookBack malware execution, macro launches GUP.exe and the libcurl.dll loaders separately.

LookBack malware developed to act as a remote access trojan which is written in C++ that relies on a proxy communication tool which is responsible to transfer data from infected host to command & control server.

This RAT functionality is powerful enough to enumerate of services viewing of process, system, and file data; deleting files; executing commands; taking screenshots; moving and clicking the mouse; rebooting the machine and deleting itself from an infected host, Proofpoint reported.

Following components are carried by LookBack RAT,

A command and control proxy tool (referred to as GUP)  

A malware loader comprised of a legitimate libcurl.dll file with one export function modified to execute shellcode.  

A communications module (referred to as SodomNormal) which creates a C&C channel with the GUP proxy tool.  

A remote access Trojan component (referred to as SodomMain), which is delivered following decoding the initial beacon response received via the GUP proxy tool and the SodomNormal local host proxy module.  

A that is described in these components masquerade as legitimate opensource software and the legitimate GUP.exe versions were utilized that were digitally signed by Notepad++

The SodomMain module is LookBack malware’s remote access Trojan module that can send and receive numerous commands to the command and control server that including,

Get process listing 
Kill process 
Executes cmd[.] exe command 
Gets drive type 
Find files 
Read files 
Delete files 
Write to files 
Execute files 
Enumerate services 
Starts services 
Delete services 
Takes a screenshot of desktop 
Move/Click Mouse and take a screenshot  
Exit 
Removes self (libcurl[.] dll)  
Shutdown 
Reboot   

“The profile of this campaign is indicative of specific risk to US-based entities in the utility sector. Phishing emails leveraged the knowledge of the licensing bodies utilized within the utility sector for social engineering purposes that communicated urgency and relevance to their targets.” Proofpoint said.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity course online to keep yourself updated.

Also Read:

Chinese APT 10 Group Hacked Nearly 10 Telecom Networks and Stealing Users Call Records, PII, Credentials, Email Data and more

Chinese APT 10 Hackers Attack Government and Private Organizations Through Previously Unknown Malware

Chinese Hackers from APT 10 Hacking Group Charged for a Cyber Attack on NASA

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS...

ATPC Cyber Forum to Focus on Next Generation Cybersecurity and Artificial Intelligence Issues

White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch...

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan...

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS...

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan...

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on...