LuckyMouse Chinese APT Malware Launching Weaponized Waterholing Attack on Government Data Center

Chinese APT actor LuckyMouse also known as EmissaryPanda & APT27 campaign targeting government entities and national data center by inserting malicious scripts to compromise an official website and performing Watering hole Attack.

Watering hole Attack is specifically targeting the businesses and organizations group by infecting carefully selected websites and the attackers run exploits on well-known & trusted sites that they targeted audience used to visit regularly.

Attackers main motivation behind this attack is to gain access to the government resource and stealing the sensitive information.

Threat actor also using Powerful remote administration tool (RAT) called HyperBro Trojan that is regularly used by a variety of Chinese-speaking actors to create a backdoor.

LuckyMouse already targeted the government entities in central Asia and based on the Watering hole of government websites and the corresponding dates is to access the web pages via the data center and inject JavaScripts into them.

How Does this Watering hole Attack Champaign Works

Initially unknown distribution vector launching the weaponized Microsoft Office Equation Editor documents with CVE-2017-118822 which is widely used by Chinese-speaking actors since December 2017.

In this case, attacker targeting the data center employees by using Watering hole Attack and the C&C  server resolving IP address belongs to Ukrainian ISP network.

This network was controlled by Mikrotik router using firmware version 6.34.4 which was hacked to process the malware’s HTTP requests for this Waterhole champaign.

Once the infection started, this module drops the 3 files and the trojan is injected into svchost.exe’s process memory.

• a legit Symantec pcAnywhere (IntgStat.exe)
• a .dll launcher (pcalocalresloader.dll)
• decompressor (thumb.db)

Malware performing various anti-detection stages which are shown in the above picture that contains three dropped modules.

According to Kaspersky,The websites were compromised to redirect visitors to instances of both ScanBox and BEeF.

Finally, visitors of the infected government website will be redirected and these redirects were implemented by adding two malicious scripts obfuscated by a tool similar to the Dean Edwards packer.

The most unusual and interesting point here is the target. A national data center is a valuable source of data that can also be abused to compromise official websites. Another interesting point is the Mikrotik router, which we believe was hacked specifically for the campaign. Kaspersky researchers said.

Also Read:

Powerful APT Malware “Slingshot” Performs Highly Sophisticated Cyber Attack to Compromise Router

Russia Launch Heavy Cyber Attack on Singapore During Donald Trump & Kim Summit

MuddyWater Malware Attack Launch PowerShell Script to Open Backdoor in Windows PC via MS Word Document