News from the AI & ML world
DeeperML - #apt
|
@cyberscoop.com
//
A Chinese state-sponsored hacking group, identified as UNC5174, is actively targeting Linux and macOS systems using a combination of custom malware and open-source tools. This espionage-minded group, believed to have ties to the Chinese government, is known to target Western governments, technology companies, research institutions, and think tanks. Security researchers at Sysdig have recently observed a new campaign where UNC5174 leverages tools like VShell, a publicly available Remote Access Trojan (RAT), and SNOWLIGHT malware to compromise systems and mask their malicious activities. The group's activities, which include targeting over 20 nations in government, finance, and defense sectors, highlights the increasing trend of APT groups adopting open-source tools to enhance their operational security and evade detection.
UNC5174 is utilizing VShell, an open-source RAT popular among Chinese cybercriminals, for post-exploitation activities. VShell, distributed as a fake Cloudflare authenticator application in some instances, and the SNOWLIGHT malware are used to deploy fileless malware on victim systems. The group also employs WebSockets, a set of open-source communication protocols, to encrypt and conceal their command-and-control communications. The use of these readily available tools allows UNC5174 to blend in with more common cybercriminal activity, making attribution significantly more challenging. According to Sysdig, their runtime capture found very little of note in the network traffic once the connection was upgraded to a WebSocket. The adoption of open-source tools represents a shift for UNC5174, as nearly all of its previously observed tooling was custom-built and difficult to copy. The group's new campaign, observed as recently as January 2025, sees them using a payload called "dnsloger," part of the SNOWLIGHT family, alongside VShell. UNC5174 is also leveraging in-depth knowledge of Linux-based operating systems, implementing methods for persistence, defensive evasion, and injection techniques, with motives likely revolving around espionage and selling access to compromised environments. The initial access vector remains unknown, but the group has been spotted targeting Linux systems, posing a significant risk to organizations due to their stealthy and sophisticated techniques.
Share:
References :
Classification:
Sathwik Ram@seqrite.com
//
Pakistan-linked SideCopy APT has escalated its cyber operations, employing new tactics to infiltrate crucial sectors. Seqrite Labs APT team uncovered these new tactics deployed since the last week of December 2024. The Advanced Persistent Threat (APT) group, previously focused on Indian government, defence, maritime sectors, and university students, is expanding its targeting scope.
The group has broadened its targets to include critical sectors such as railways, oil & gas, and external affairs ministries. One notable shift in their recent campaigns is the transition from using HTML Application (HTA) files to adopting Microsoft Installer (MSI) packages as a primary staging mechanism. This evolution is marked by increasingly sophisticated methods, such as reflective DLL loading and AES encryption via PowerShell. Furthermore, SideCopy is actively repurposing open-source tools like XenoRAT and SparkRAT to enhance their penetration and exploitation capabilities. The group customizes these tools and employs a newly identified Golang-based malware dubbed CurlBack RAT, specifically designed to execute DLL side-loading attacks. Recent campaigns demonstrate an increased use of phishing emails masquerading as government officials to deliver malicious payloads, often using compromised official domains and fake domains mimicking e-governance services.
Share:
References :
Classification:
@cyberscoop.com
//
The Chinese nation-state hacking group Salt Typhoon, despite facing US sanctions, continues to actively target telecommunications providers. Between December 2024 and January 2025, Recorded Future observed Salt Typhoon breaching five telecom firms, including a US-based affiliate of a UK telecom provider, a US internet service provider, and companies in Italy, South Africa, and Thailand. The group also performed reconnaissance on a Myanmar-based telecom provider.
Salt Typhoon exploited vulnerabilities in Cisco IOS XE software, specifically CVE-2023-20198 and CVE-2023-20273, to compromise unpatched Cisco devices. They attempted to compromise over 1,000 Cisco routers globally, focusing on those within telecom networks. Additionally, Salt Typhoon targeted universities, including the University of California and Utah Tech, potentially seeking access to research related to telecommunications and engineering.
Share:
References :
Classification:
|
BenchmarksBlogsResearch Tools |