Chinese Espionage Hackers Target Tibetans Using New LOWZERO Backdoor

Cyber Security

Products You May Like

A China-aligned advanced persistent threat actor known as TA413 weaponized recently disclosed flaws in Sophos Firewall and Microsoft Office to deploy a never-before-seen backdoor called LOWZERO as part of an espionage campaign aimed at Tibetan entities.

Targets primarily consisted of organizations associated with the Tibetan community, including enterprises associated with the Tibetan government-in-exile.

The intrusions involved the exploitation of CVE-2022-1040 and CVE-2022-30190 (aka “Follina”), two remote code execution vulnerabilities in Sophos Firewall and Microsoft Office, respectively.

CyberSecurity

“This willingness to rapidly incorporate new techniques and methods of initial access contrasts with the group’s continued use of well known and reported capabilities, such as the Royal Road RTF weaponizer, and often lax infrastructure procurement tendencies,” Recorded Future said in a new technical analysis.

TA413, also known as LuckyCat, has been linked to relentlessly targeting organizations and individuals associated with the Tibetan community at least since 2020 using malware such as ExileRAT, Sepulcher, and a malicious Mozilla Firefox browser extension dubbed FriarFox.

Chinese Espionage Hackers

The group’s exploitation of the Follina flaw was previously highlighted by Proofpoint in June 2022, although the ultimate end goal of the infection chains remained unclear.

Also put to use in a spear-phishing attack identified in May 2022 was a malicious RTF document that exploited flaws in Microsoft Equation Editor to drop the custom LOWZERO implant. This was achieved by employing a Royal Road RTF weaponizer tool, which is widely shared among Chinese threat actors.

CyberSecurity

In another phishing email sent to a Tibetan target in late May, a Microsoft Word attachment hosted on the Google Firebase service attempted to leverage the Follina vulnerability to execute a PowerShell command designed to download the backdoor from a remote server.

LOWZERO, the backdoor, is capable of receiving additional modules from its command-and-control (C2) server, but only on the condition that the compromised machine is deemed to be of interest to the threat actor.

“The group continues to incorporate new capabilities while also relying on tried-and-tested [tactics, techniques, and procedures,” the cybersecurity firm said.

“TA413’s adoption of both zero-day and recently published vulnerabilities is indicative of wider trends with Chinese cyber-espionage groups whereby exploits regularly appear in use by multiple distinct Chinese activity groups prior to their widespread public availability.”

Products You May Like

Articles You May Like

Realme 13 Pro+ 5G Monet Purple Colour Variant Launched in India: Availability, Offers
The sneaky way Big Tech is acquiring AI unicorns without buying the companies
Atlassian Confluence Vulnerability Exploited in Crypto Mining Campaigns
Chinese Volt Typhoon Exploits Versa Director Flaw, Targets U.S. and Global IT Sectors
Instagram Rolls Out New Fonts, Text Animations and Ability to Add Stickers to Photos

Leave a Reply

Your email address will not be published. Required fields are marked *