In their previous report, Trend Micro researchers introduced the sophisticated cyberespionage campaign orchestrated by Earth Hundun, a threat actor known for targeting the Asia-Pacific region using the Waterbear malware and its latest iteration, Deuterbear. We first observed Deuterbear being used by Earth Hundun in October 2022, and it has since been part of the group’s subsequent campaigns.
Trend Micro analysis provided insights into the intricate workings of the downloader, detailing its infection flow, traffic behavior, anti-analysis techniques, and evolutionary trajectory. In this entry, we examine the behavior of the final Remote Access Trojan (RAT) that the researchers recently managed to download from a C&C server, based on an Earth Hundun campaign from 2024.
Read more…
Source: Trend Micro
Related:
- Israeli Government Agencies Visit NSO Group Offices
July 29, 2021
Authorities from multiple agencies of the Israeli government paid a visit the offices of the NSO Group as part of a new investigation into claims that the secretive firm is selling its spyware to threat actors for targeted attacks, according to the Israeli Ministry of Defense. A single tweet from the ministry announced the raid on ...
- TA456 hackers built an elaborate online profile to fool their targets into downloading malware
July 28, 2021
Iranian hackers spent 18 months masquerading as an aerobics instructor in a cyber-espionage campaign designed to infect employees and contractors working in defence and aerospace with malware in order to steal usernames, passwords and other information which could be exploited. Active since at least 2019, the campaign used Facebook, Instagram and emails to pose as the ...
- Russia, US launch cybersecurity dialogue, three rounds already held
July 28, 2021
Russia and the US have launched bilateral cybersecurity dialogue, with three formal rounds already held, Russian Deputy Foreign Minister Sergey Ryabkov told reporters on Wednesday. “We are beginning to have a better understanding of security issues in the cyber sphere and its different aspects, starting with the use of the corresponding malware with criminal intent and ...
- WhatsApp chief claims government officials among 1,400 WhatsApp users targeted in 2019 attack
July 24, 2021
Senior government officials around the world – including individuals in high national security positions who are “allies of the US” – were targeted by governments with NSO Group spyware in a 2019 attack against 1,400 WhatsApp users, according to the messaging app’s chief executive. Will Cathcart disclosed the new details about individuals who were targeted in ...
- France warns of APT31 cyberspies targeting French organizations
July 21, 2021
Today, the French national cyber-security agency warned of an ongoing series of attacks against a large number of French organizations coordinated by the Chinese-backed APT31 hacking group. “It appears from our investigations that the threat actor uses a network of compromised home routers as operational relay boxes in order to perform stealth reconnaissance as well as ...
- Safeguarding Critical Infrastructure Against Threats From The People’s Republic Of China
July 19, 2021
As today’s announcement from the White House indicates, the cyber threat from the People’s Republic of China (PRC) continues to evolve and poses a real risk to the nation’s critical infrastructure, as well as businesses and organization of all sizes at home and around the world. CISA regularly shares actionable information to help security professionals ...