Chinese Hackers Using Russo-Ukrainian War Decoys to Target APAC and European Entities

Cyber Security

Products You May Like

Dec 07, 2022Ravie Lakshmanan

The China-linked nation-state hacking group referred to as Mustang Panda is using lures related to the ongoing Russo-Ukrainian War to attack entities in Europe and the Asia Pacific.

That’s according to the BlackBerry Research and Intelligence Team, which analyzed a RAR archive file titled “Political Guidance for the new EU approach towards Russia.rar.” Some of the targeted countries include Vietnam, India, Pakistan, Kenya, Turkey, Italy, and Brazil.

Mustang Panda is a prolific cyber-espionage group from China that’s also tracked under the names Bronze President, Earth Preta, HoneyMyte, RedDelta, and Red Lich.

CyberSecurity

It’s believed to be active since at least July 2018, per Secureworks’ threat profile, although indications are that the threat actor has been targeting entities worldwide as early as 2012.

Mustang Panda is known to heavily rely on sending weaponized attachments via phishing emails to achieve initial infection, with the intrusions eventually leading to the deployment of the PlugX remote access trojan.

Russo-Ukrainian War

However, recent spear-phishing attacks undertaken by the group targeting government, education, and research sectors in the Asia Pacific region have involved custom malware like PUBLOAD, TONEINS, and TONESHELL, suggesting an expansion to its malware arsenal.

The latest findings from BlackBerry show that the core infection process has remained more or less the same, even as Mustang Panda continues to utilize geopolitical events to their advantage, echoing prior reports from Google and Proofpoint.

Contained within the decoy archive is a shortcut to a Microsoft Word file, which leverages DLL side-loading – a technique that was also employed in attacks aimed at Myanmar earlier this year – to kick off the execution of PlugX in memory, before displaying the document’s contents.

“Their attack chain remains consistent with the continued use of archive files, shortcut files, malicious loaders, and the use of the PlugX malware, although their delivery setup is usually customized per region/country to lure victims into executing their payloads in the hope of establishing persistence with the intent of espionage,” BlackBerry’s Dmitry Bestuzhev told The Hacker News.

Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.

Products You May Like

Articles You May Like

ISRO and IIT Guwahati Discover New Challenges in Theories of X-Ray Pulsar
Here’s How AI is Helping Astronomers to Understand Universe’s Fundamental Parameters
Realme 13 Pro+ 5G Monet Purple Colour Variant Launched in India: Availability, Offers
NCLT Approves Merger of Viacom 18, Star India After CCI Nod
A journey inside Epic Systems’ mythical and sprawling campus, a world away from Wall Street

Leave a Reply

Your email address will not be published. Required fields are marked *