[ad_1]
BlackTech cyber-espionage APT (superior persistent menace) group has been noticed concentrating on Japanese corporations utilizing novel malware that researchers name ‘Flagpro’.
The menace actor makes use of Flagpro within the preliminary stage of an assault for community reconnaissance, to guage the goal’s setting, and to obtain second-stage malware and execute it.
Breaching company networks
The an infection chain begins with a phishing e mail crafted for the goal group, pretending to be a message from a reliable accomplice.
The e-mail carries a password-protected ZIP or RAR attachment that comprises a Microsoft Excel file (.XLSM) laced with a malicious macro. Working this code creates an executable within the startup listing, the Flagpro.
On its first execution, Flagpro connects to the C2 server by way of HTTP and sends system ID particulars obtained by working hardcoded OS instructions.
In response, the C2 can ship again further instructions or a second-stage payload that Flagpro can execute.
Supply: NTT Safety
The communication between the 2 is encoded with Base64, and there’s additionally a configurable time delay between connections to keep away from making a sample of identifiable operations.
Supply: NTT Safety
Based on a report by NTT Safety, Flagpro has been deployed towards Japanese corporations for greater than a yr, since not less than October 2020. The newest pattern the researchers might retrieve is from July 2021.
The focused entities are from varied sectors, together with protection applied sciences, media, and communications.
Flagpro v2.0
Sooner or later of their evaluation, NTT researchers seen a brand new model of Flagpro, which might robotically shut dialogs related to establishing exterior connections that might reveal its presence to the sufferer.
“Within the implementation of Flagpro v1.0, if a dialog titled “Home windows セキュリティ” is displayed when Flagpro accesses to an exterior website, Flagpro robotically clicks OK button to shut the dialog,” explains the NTT Safety report.
“This dealing with additionally works when the dialog is written in Chinese language or English. It signifies the targets are in Japan, Taiwan, and English-speaking international locations.”
Supply: NTT Safety
Possible a Chinese language actor
BlackTech APT is a lesser-known actor that TrendMicro researchers first noticed in the summertime of 2017 and is related to China.
Its typical targets are in Taiwan, though it often attacked corporations in Japan and Hong Kong to steal know-how.
In February 2021, a Unit 42 report related BlackTech to WaterBear; one other cyber-espionage group believed to be backed by the Chinese language authorities.
As an APT, BlackTech possesses the information and class to regulate its instruments to new experiences like this one, so Flagpro will probably now be modified for stealthier deployment.
Because the NTT report concludes: “Lately, they (BlackTech) have began utilizing different new malware known as “SelfMake Loader” and “Spider RAT”. It implies that they’re actively creating new malware.”
Defenders must pay attention to the brand new indicators of compromise associated to the brand new malware and observe all finest safety practices to take care of robust defenses towards subtle threats like BlackTech.
[ad_2]
