Tuesday, March 5, 2024

LuckyMouse Chinese APT Malware Launching Weaponized Waterholing Attack on Government Data Center

Chinese APT actor LuckyMouse also known as EmissaryPanda & APT27 campaign targeting government entities and national data center by inserting malicious scripts to compromise an official website and performing Watering hole Attack.

Watering hole Attack is specifically targeting the businesses and organizations group by infecting carefully selected websites and the attackers run exploits on well-known & trusted sites that they targeted audience used to visit regularly.

Attackers main motivation behind this attack is to gain access to the government resource and stealing the sensitive information.

Threat actor also using Powerful remote administration tool (RAT) called HyperBro Trojan that is regularly used by a variety of Chinese-speaking actors to create a backdoor.

LuckyMouse already targeted the government entities in central Asia and based on the Watering hole of government websites and the corresponding dates is to access the web pages via the data center and inject JavaScripts into them.

How Does this Watering hole Attack Champaign Works

Initially unknown distribution vector launching the weaponized Microsoft Office Equation Editor documents with CVE-2017-118822 which is widely used by Chinese-speaking actors since December 2017.

In this case, attacker targeting the data center employees by using Watering hole Attack and the C&C  server resolving IP address belongs to Ukrainian ISP network.

This network was controlled by Mikrotik router using firmware version 6.34.4 which was hacked to process the malware’s HTTP requests for this Waterhole champaign.

Once the infection started, this module drops the 3 files and the trojan is injected into svchost.exe’s process memory.

  • a legit Symantec pcAnywhere (IntgStat.exe)
  • a .dll launcher (pcalocalresloader.dll)
  • decompressor (thumb.db)

Malware performing various anti-detection stages which are shown in the above picture that contains three dropped modules.

According to Kaspersky,The websites were compromised to redirect visitors to instances of both ScanBox and BEeF.
                         The script that infected into compromised government websites

Finally, visitors of the infected government website will be redirected and these redirects were implemented by adding two malicious scripts obfuscated by a tool similar to the Dean Edwards packer.

The most unusual and interesting point here is the target. A national data center is a valuable source of data that can also be abused to compromise official websites. Another interesting point is the Mikrotik router, which we believe was hacked specifically for the campaign. Kaspersky researchers said.

Also Read:

Powerful APT Malware “Slingshot” Performs Highly Sophisticated Cyber Attack to Compromise Router

Russia Launch Heavy Cyber Attack on Singapore During Donald Trump & Kim Summit

MuddyWater Malware Attack Launch PowerShell Script to Open Backdoor in Windows PC via MS Word Document


Latest articles

US Court Orders NSO Group to Handover Code for Spyware, Pegasus to WhatsApp

Meta, the company that owns WhatsApp, filed a lawsuit against NSO Group in 2019....

New SSO-Based Phishing Attack Trick Users into Sharing Login Credentials  

Threat actors employ phishing scams to trick individuals into giving away important details like...

U.S. Charged Iranian Hacker, Rewards up to $10 Million

The United States Department of Justice (DoJ) has charged an Iranian national, Alireza Shafie...

Huge Surge in Ransomware-as-a-Service Attacks targeting Middle East & Africa

The Middle East and Africa (MEA) region has witnessed a surge in ransomware-as-a-service (RaaS)...

New Silver SAML Attack Let Attackers Forge Any SAML Response To Entra ID

SolarWinds cyberattack was one of the largest attacks of the century in which attackers...

AI Worm Developed by Researchers Spreads Automatically Between AI Agents

Researchers have developed what they claim to be one of the first generative AI...

20 Million+ Cutout.Pro User Records Leaked On Hacking Forums

CutOut.Pro, an AI-powered photo and video editing platform, has reportedly suffered a data breach,...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Live Account Takeover Attack Simulation

Live Account Take Over Attack

Live Webinar on How do hackers bypass 2FA ,Detecting ATO attacks, A demo of credential stuffing, brute force and session jacking-based ATO attacks, Identifying attacks with behaviour-based analysis and Building custom protection for applications and APIs.

Related Articles