Saturday, June 22, 2024

LuckyMouse Chinese APT Malware Launching Weaponized Waterholing Attack on Government Data Center

Chinese APT actor LuckyMouse also known as EmissaryPanda & APT27 campaign targeting government entities and national data center by inserting malicious scripts to compromise an official website and performing Watering hole Attack.

Watering hole Attack is specifically targeting the businesses and organizations group by infecting carefully selected websites and the attackers run exploits on well-known & trusted sites that they targeted audience used to visit regularly.

Attackers main motivation behind this attack is to gain access to the government resource and stealing the sensitive information.

Threat actor also using Powerful remote administration tool (RAT) called HyperBro Trojan that is regularly used by a variety of Chinese-speaking actors to create a backdoor.

LuckyMouse already targeted the government entities in central Asia and based on the Watering hole of government websites and the corresponding dates is to access the web pages via the data center and inject JavaScripts into them.

How Does this Watering hole Attack Champaign Works

Initially unknown distribution vector launching the weaponized Microsoft Office Equation Editor documents with CVE-2017-118822 which is widely used by Chinese-speaking actors since December 2017.

In this case, attacker targeting the data center employees by using Watering hole Attack and the C&C  server resolving IP address belongs to Ukrainian ISP network.

This network was controlled by Mikrotik router using firmware version 6.34.4 which was hacked to process the malware’s HTTP requests for this Waterhole champaign.

Once the infection started, this module drops the 3 files and the trojan is injected into svchost.exe’s process memory.

  • a legit Symantec pcAnywhere (IntgStat.exe)
  • a .dll launcher (pcalocalresloader.dll)
  • decompressor (thumb.db)

Malware performing various anti-detection stages which are shown in the above picture that contains three dropped modules.

According to Kaspersky,The websites were compromised to redirect visitors to instances of both ScanBox and BEeF.
                         The script that infected into compromised government websites

Finally, visitors of the infected government website will be redirected and these redirects were implemented by adding two malicious scripts obfuscated by a tool similar to the Dean Edwards packer.

The most unusual and interesting point here is the target. A national data center is a valuable source of data that can also be abused to compromise official websites. Another interesting point is the Mikrotik router, which we believe was hacked specifically for the campaign. Kaspersky researchers said.

Also Read:

Powerful APT Malware “Slingshot” Performs Highly Sophisticated Cyber Attack to Compromise Router

Russia Launch Heavy Cyber Attack on Singapore During Donald Trump & Kim Summit

MuddyWater Malware Attack Launch PowerShell Script to Open Backdoor in Windows PC via MS Word Document


Latest articles

PrestaShop Website Under Injection Attack Via Facebook Module

A critical vulnerability has been discovered in the "Facebook" module (pkfacebook) from for...

Beware Of Illegal OTT Platforms That Exposes Sensitive Personal Information

A recent rise in data breaches from illegal Chinese OTT platforms exposes that user...

Beware Of Zergeca Botnet with Advanced Scanning & Persistence Features

A new botnet named Zergeca has emerged, showcasing advanced capabilities that set it apart...

Mailcow Mail Server Vulnerability Let Attackers Execute Remote Code

Two critical vulnerabilities (CVE-2024-31204 and CVE-2024-30270) affecting Mailcow versions before 2024-04 allow attackers to...

Hackers Attacking Vaults, Buckets, And Secrets To Steal Data

Hackers target vaults, buckets, and secrets to access some of the most classified and...

Hackers Weaponizing Windows Shortcut Files for Phishing

LNK files, a shortcut file type in Windows OS, provide easy access to programs,...

New Highly Evasive SquidLoader Attacking Employees Mimic As Word Document

Researchers discovered a new malware loader named SquidLoader targeting Chinese organizations, which arrives as...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles