Chinese hacking group returns with new tactics for espionage campaign

Video: High-end hotel data thieves return to target government officials

A Chinese hacking operation is back with new malware attack techniques and has switched its focus to conducting espionage on western corporations, having previously targeted organisations and individuals in Taiwan, Tibet, and the Philippines.

Dubbed KeyBoy, the advanced persistent threat actor has been operating out of China since at least 2013 and in that time has mainly focused its campaigns against targets in South East Asia region.

The last publicly known actively by KeyBoy saw it target the Tibetan Parliament between August and October 2016, according to researchers, but following that the group appeared to cease activity -- or at least managed to get off the radar.

But now the group has reemerged and is targeting western organisations with malware which allows them to secretly perform malicious activities on infected computers. They include taking screenshots, key-logging, browsing and downloading files, gathering extended system information about the machine, and shutting down the infected machine.

KeyBoy's latest activity has been uncovered by security analysts at PwC, who've analysed the new payload and found it includes new infection techniques replacing legitimate Windows binaries with a copy of the malware.

Like similar espionage campaigns by other hacking operations, the campaign begins with emails containing a malicious document - in the case analysed by PwC, the lure was a Microsoft Word document named ' Q4 Work Plan.docx'.

But rather than delivering macros or an exploit, the lure uses the Dynamic Data Exchange (DDE) protocol to fetch and download a remote payload. Microsoft has previously described DDE as a feature, not a flaw.

See also: Cyberwar: A guide to the frightening future of online conflict

In this case, Word tells the user there's been an error and the document needs updating - if this instruction is run, a remote fake DLL payload is run, which in turn serves up a dropper for the malware.

Once the process has been run and the malware is installed, the initial DLL is deleted, leaving no trace of the malicious fake. As the malware also disables Windows File Protection and related popups, it therefore isn't immediately obvious to system administrators that a legitimate DLL was replaced.

Once inside the target system, the attackers are free to conduct espionage campaigns as they please - although PwC researchers have listed possible indicators of compromise which organisations can use to discover if there are traces of KeyBoy in the network.

Similar techniques and attack capabilities have been observed in past KeyBoy campaigns, leading researchers to conclude that this campaign is by the same group.

Researchers have yet to uncover which specific organisations or sectors KeyBoy is targeting with its latest campaign, but say that the group has now turned its attention to conducting corporate espionage on organisations in the west.

Aside from knowing that they're based in China, it's not yet been possible to uncover the KeyBoy hacker group or identify their ultimate motives. While it has some of the hallmarks of a state-backed operation, previous research into the group says any type of criminal gang could operate this style of campaign.

The corporate espionage campaign is now targeting organisations in the west, warn researchers.

Image: iStock

Previous and related coverage

Hackers target security researchers with malware-laden document

State-backed hackers are trying to deliver malware to people interested in cybersecurity, using malicious documents about a real conference as a lure.

New code injection method exposes all versions of Windows to cyberattack

To make matters worse, there is no fix.

Security awareness and training policy [Tech Pro Research]

This policy is designed to help your IT staff guide employees toward understanding and adhering to best security practices that are relevant to their job responsibilities.

READ MORE ON CYBER CRIME

from Latest Topic for ZDNet in... http://ift.tt/2iWVtSd