In their previous report, Trend Micro researchers introduced the sophisticated cyberespionage campaign orchestrated by Earth Hundun, a threat actor known for targeting the Asia-Pacific region using the Waterbear malware and its latest iteration, Deuterbear. We first observed Deuterbear being used by Earth Hundun in October 2022, and it has since been part of the group’s subsequent campaigns.
Trend Micro analysis provided insights into the intricate workings of the downloader, detailing its infection flow, traffic behavior, anti-analysis techniques, and evolutionary trajectory. In this entry, we examine the behavior of the final Remote Access Trojan (RAT) that the researchers recently managed to download from a C&C server, based on an Earth Hundun campaign from 2024.
Read more…
Source: Trend Micro
Related:
- The Road Map To Sino-US Cyber Cooperation Requires Both Nations To Look In The Mirror
August 11, 2023
The United States often poses itself as a champion of international cybersecurity despite its extensive record of transgressions in the realm of cyber-attacks and surveillance, according to which some would even proclaim the nation a global adversary. Concurrently, China’s involvement in intentional cyber-attacks targeting vital American infrastructure and cyberspace remains increasingly prominent. Read more… Source: Forbes
- Germany says Charming Kitten hackers target Iran dissidents
August 10, 2023
Germany’s Federal Office for the Protection of the Constitution (BfV) on Thursday warned critics of the Iranian leadership living in Germany that they might be targeted by hackers. The agency said the Charming Kitten online espionage group works by building trust with victims to the extent that they expose data on themselves, and any online ...
- Spyware maker LetMeSpy shuts down after hacker deletes server data
August 5, 2023
Poland-based spyware LetMeSpy is no longer operational and said it will shut down after a June data breach wiped out its servers, including its huge trove of data stolen from thousands of victims’ phones. In a notice on its website in both English and Polish, LetMeSpy confirmed the “permanent shutdown” of the spyware service and that ...
- What is the status of US, Israel cyberwars?
July 22, 2023
On June 19, 2022, false rocket-warning sirens were activated in Jerusalem and Eilat, caused by a stunning cyber attack by Iran. Israel’s cyber authorities at the time tried to downplay the hack, which seemed to have significant national security implications. However, in a recent interview with The Jerusalem Post, Israel National Cyber Directorate Chief Gaby Portnoy ...
- Exploitation of Citrix Zero-Day by Possible Espionage Actors (CVE-2023-3519)
July 20, 2023
Security and networking devices are “edge devices,” meaning they are connected to the internet. If an attacker is successful in exploiting a vulnerability on these appliances, they can gain initial access without human interaction, which reduces the chances of detection. As long as the exploit remains undiscovered, the threat actor can reuse it to gain access ...
- CISA Releases Cybersecurity Advisory on Threat Actors Exploiting Citrix CVE-2023-3519
July 20, 2023
The Cybersecurity and Infrastructure Security Agency (CISA) released a Cybersecurity Advisory (CSA), Threat Actors Exploiting Citrix CVE-2023-3519 to Implant Webshells, to warn organizations about threat actors exploiting CVE-2023-3519, an unauthenticated remote code execution (RCE) vulnerability affecting NetScaler (formerly Citrix) Application Delivery Controller (ADC) and NetScaler Gateway. In June 2023, threat actors exploited this vulnerability as a ...