Sunday, October 13, 2024
HomeMalwareChinese Hackers Launching Zegost Malware to Attack Government Networks Via Weaponized MS...

Chinese Hackers Launching Zegost Malware to Attack Government Networks Via Weaponized MS Powerpoint

Published on

Malware protection

Researchers discovered a new campaign with Zegost info stealer malware that believed to be originated from Chinese based threat actors who is targeting government networks in China.

Zegost uncovered back to 2011 since then attackers updated with various new functionalities and added new persistence capabilities, exploits to maintain the access.

Researchers believe that the malware only focuses on the Chinese government network, but it was unclear why threat actors targeting only government agencies.

- Advertisement - SIEM as a Service

By nature, the malware developed to steal the targeted victim’s information that resides in the compromised network with the ability to leverage multiple exploits.

Most of the exploits are often used by Italian offensive security company that was provided hacking tools to law enforcement and government agencies.

Attackers behind the Zegost malware using weaponized Microsoft powerpoint document and infect the victims once they open the malicious document.

Researchers also observed that one of these updates includes the usage of COM programming. As with many of the other uncommon strategies it uses, COM usage in malware is also not typically seen.

Zegost Malware Infection Process

Initially, malicious targeting victims via spear-phishing emails with an attachment of malicious file and trick victims to open it.

Zegost includes that several functionalities designed to clear the Application, Security, and System event logs after the infection to fly under the radar to evade the detection.

Once it completes the infection process, it starts identifying the targetted machine OS version and specification then checks to see if any of the following processes are running and sends the list out to the C2 server,

360tray.exe, 360sd.exe, avp.exe, KvMonXP.exe, RavMonD.exe, Mcshield.exe, egui.exe, NOD32, kxetray.exe, avcenter.exe, ashDisp.exe, rtvscan.exe, ksafe.exe, QQPCRTP.exe, K7TSecurity.exe, QQ.exe, QQ, knsdtray.exe, TMBMSRV.exe, Miner.exe, AYAgent.exe, patray.exe, V3Svc.exe, QUHLPSVC.EXE, QUICK HEAL, mssecess.exe, S.exe, 1433.exe, DUB.exe, ServUDaemon.exe, BaiduSdSvc.exe, vmtoolsd.exe, usysdiag.exe

It also focuses to collect the list of modem, proxies and LAN connectivity information, RDP port number, QQ login number and share to command and control server that control the attacker.

Malware also places the Keystroke Recorder to record the victim’s activities and share them into following C2 servers:

  • hxxp://lu1164224557.oicp.net:45450
  • hxxp://212951jh19.iok.la:9988

According to Fortinet research, “Our observations for this latest run, however, reveal that multiple subdomains that act as the command and control are based on Dynamic DNS domains (DDNS), and are coming from other locations beyond China, such as Singapore, Taiwan, and the United States.”

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates also you can take the Best Cybersecurity course online to keep yourself updated.

Also Read:

8 World’s Biggest Tech Giants Including TCS, CSC, HPE, NTT Data Hacked by Chinese Government Sponsored Hackers

Hackers From Chinese APT-27 Group Initiated 15000 Attacks Against MySQL Servers to Compromise Enterprise Networks

Chinese APT 10 Group Hacked Nearly 10 Telecom Networks and Stealing Users Call Records, PII, Credentials, Email Data and more

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Threat Actor ProKYC Selling Tools To Bypass Two-Factor Authentication

Threat actors are leveraging a newly discovered deepfake tool, ProKYC, to bypass two-factor authentication...

Mozilla Warns Of Firefox Zero-Day Actively Exploited In Cyber Attacks

A critical use-after-free vulnerability affecting Firefox and Firefox Extended Support Release (ESR) is being...

SpyCloud Embeds Identity Analytics in Cybercrime Investigations Solution to Accelerate Insider and Supply Chain Risk Analysis & Threat Actor Attribution

IDLink, SpyCloud’s new automated digital identity correlation capability, is now core to its industry-leading...

Abusix and Red Sift Form New Partnership, Leveraging Automation to Mitigate Cyber Attacks

The agreement has marked over 600,000 fraudulent domains for takedown in just two months...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

LemonDuck Malware Exploiting SMB Vulnerabilities To Attack Windwos Servers

The attackers exploited the EternalBlue vulnerability to gain initial access to the observatory farm,...

DCRAt Attacking Users Via HTML Smuggling To Steal Login Credentials

In a new campaign that is aimed at users who speak Russian, the modular...

LummaC2 Stealer Leverages Customized Control Flow Indirection For Execution

The LummaC2 obfuscator employs a novel control flow protection scheme designed specifically for its...