Chinese APT Billbug deploys new malware toolset in attack on multiple sectors – Source: www.csoonline.com

Chinese cyberespionage group Billbug has revamped its attack toolkit with new malware payloads in a wide-reaching campaign targeting multiple organizations in Southeast Asia. The new tools, which include credential stealers, a reverse shell, and an updated backdoor, were observed in attacks that lasted from August to February.

“Targets included a government ministry, an air traffic control organization, a telecoms operator, and a construction company,” researchers from Broadcom’s Symantec division wrote in a report on the activity. “In addition to this, the group staged an intrusion against a news agency located in another country in Southeast Asia and an air freight organization located in another neighboring country.”

Billbug, also known in the security industry as Lotus Blossom, Lotus Panda, Bronze Elgin, or Spring Dragon, is a cyberespionage group with suspected ties to the Chinese government that’s focused on obtaining intelligence from other Asian countries. It has been operating since at least 2009, mainly targeting government and military organizations.

In the latest campaigns the group has expanded its attacks to other sectors, including manufacturing, telecommunications, and media. Countries and territories more frequently targeted by Billbug include the Philippines, Vietnam, Hong Kong, Macau, Indonesia, Malaysia, and Taiwan.

DLL sideloading a new backdoor variant

Billbug’s main malware tool is a custom remote access trojan (RAT) known as Sagerunex,  which it has been using since at least 2016. Another custom backdoor in the group’s arsenal is known as Hannotog and in the past it has also used the Trensil trojan program, also known as Elise.

The latest campaign investigated by Symantec, but also documented by Cisco Talos in February, featured a new variant of Sagerunex that was deployed by a malware loader that takes advantage of legitimate executables from Trend Micro and Bitdefender — both security vendors — to perform DLL sideloading.

DLL sideloading is a technique that exploits the fact that some executable binaries are designed to load DLLs (libraries) with specific names from the same working directory. By placing a malicious DLL with the right name together with the vulnerable executable in the same directory and then running the executable, the malicious code from the DLL will be sideloaded into memory. The benefit for attackers is that endpoint security products are much less likely to trigger detections on code execution performed by digitally signed and legitimate executable files, especially those belonging to security products, as is the case with Billbug’s latest attacks.

The group’s new Sagerunex backdoor variant sets up persistence by registering itself as a system service and storing its contents in the registry.

DLL sideloading was also observed in recent attacks against the healthcare and pharmaceutical sectors via a new malware payload dubbed ResolverRAT, as reported by security firm Morphisec.

New credential stealers

The Symantec researchers have also observed two new credential stealer programs dubbed ChromeKatz and CredentialKatz. Both are designed to steal credentials stored in Google Chrome, with ChromeKatz also being capable of stealing session cookies. Session cookies can be placed inside browsers to indicate already authenticated sessions. Attackers can use them to bypass normal log-in processes and directly authenticate as users.

Another new payload deployed by Billbug in the recent campaign was a reverse shell tool capable of listening for incoming SSH connections on port 22. The attackers also used the open-source Zrok program, which enables users to expose services to the internet over a secure and encrypted peer-to-peer network.

Another publicly available tool observed by Symantec was datechanger.exe, a program that can alter the timestamps of files to make incident analysis and forensic investigations more challenging.

The Symantec report contains indicators of compromise in the form of file hashes for all the newly observed tools, which can help security teams hunt for potential Billbug compromises inside their own networks.