securityaffairs.co Open in urlscan Pro
2001:8d8:100f:f000::289  Public Scan

Form analysis
1 forms found in the DOM

Name: searchform — GET https://securityaffairs.co/wordpress/

<form role="search" method="get" name="searchform" id="searchform" action="https://securityaffairs.co/wordpress/">
  <div>
    <input type="text" value="" name="s" id="s" autocomplete="off" title="Search..." class="blur">
    <button type="submit">
      <i class="fa fa-search"></i>
    </button>
  </div>
  <div id="autocomplete"></div>
</form>

Text Content

 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * EXTENDED COOKIE POLICY
 * Contact me


MUST READ

Headlines
 * Anonymous continues to support Ukraine against the Russia
 * SolarWinds Warns of Attacks Targeting Web Help Desk Users
 * Ukraine SBU arrested a hacker who supported Russia during the invasion
 * B1txor20 Linux botnet use DNS Tunnel and Log4J exploit
 * Russia's disinformation uses deepfake video of Zelenskyy telling people to
   lay down arms
 * CISA adds 15 new flaws to the Known Exploited Vulnerabilities Catalog



 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * EXTENDED COOKIE POLICY
 * Contact me


CHINA-LINKED APT41 GROUP TARGETS US-BASED RESEARCH UNIVERSITY

August 21, 2019  By Pierluigi Paganini


Powered by pixfutureⓘ


SECURITY EXPERTS AT FIREEYE OBSERVED CHINESE APT41 APT GROUP TARGETING A WEB
SERVER AT A U.S.-BASED RESEARCH UNIVERSITY.

Experts at FireEye observed Chinese APT41 APT group targeting a web server at a
U.S.-based research university.

Powered by pixfutureⓘ

The APT41 has been active since at least 2012, it was involved in both
state-sponsored espionage campaigns and financially-motivated attacks since
2014. The group hit entities in several industries, including the gaming,
healthcare, high-tech, higher education, telecommunications, and travel services
industries.

Unlike other China-based actors, the group used custom malware in cyber
espionage operations, experts observed 46 different malware families and tools
in APT41 campaigns.

“APT41 is unique among tracked China-based actors in that it
leverages non-public malware typically reserved for espionage campaigns in what
appears to be activity for personal gain.” states the report published by
FireEye. “Explicit financially-motivated targeting is unusual among Chinese
state-sponsored threat groups, and evidence suggests APT41 has conducted
simultaneous cyber crime and cyber espionage operations from 2014 onward.”

FireEye experts published a detailed report on the evolution of the group’s
tactics, techniques, and procedures (TTPs), they found an overlap with other
known Chinese espionage operator like BARIUM and the Winnti APT groups.

APT41 leverages several techniques to carry out the initial compromise,
including spearphishing, moving laterally from trusted third parties, leveraging
stolen credentials.

Experts observed APT41 using spear-phishing email with attachments such as
compiled HTML (.chm) files.

The arsenal of the group includes backdoors, credential stealers, keyloggers,
and rootkits. The APT41 cyber espionage group also leveraged TeamViewer to
deploy its malware into the targets’ compromised environment.

The attack against a publicly-accessible web server at a U.S.-based research
university took place on April 2019. The hackers exploited the CVE-2019-3396
vulnerability in Atlassian Confluence Server to compromise the systems and load
additional payloads, including a variant of the China Chop web shell.

The attack involved two additional files, the HIGHNOON backdoor and a rootkit,
then within the next 35 minutes, the attackers used both the China Chopper web
shell and the HIGHNOON backdoor to send commands to the compromised server.

“HIGHNOON is a backdoor that consists of multiple components, including a
loader, dynamic-link library (DLL), and a rootkit. When loaded, the DLL may
deploy one of two embedded drivers to conceal network traffic and communicate
with its command and control server to download and launch memory-resident DLL
plugins.” reads the analysis published by FireEye.

Attackers used the HIGHNOON backdoor to execute a PowerShell command and
download a script from PowerSploit. This script appears to be a copy of
Invoke-Mimikatz post-exploitation tools, reflectively loading Mimikatz 2.0 into
memory.

The hackers also conducted additional reconnaissance and downloaded two
additional files, representing the dropper and encrypted/compressed payload
components of the ACEHASH malware. The ACEHASH malware is a credential stealer
and password dumping utility.

Summarizing the hackers were able to exploit the vulnerability in vulnerable
Confluence system to execute command and deploy custom malware. While Mimikatz
failed, the ACEHASH malware allowed the attackers to harvest a single credential
from the system. The good news is that FireEye successfully neutralized the
attack.



Pierluigi Paganini

(SecurityAffairs – APT41, hacking)


Powered by pixfutureⓘ
Share this...

Facebook
Twitter
Linkedin


SHARE THIS:

 * Twitter
 * Print
 * LinkedIn
 * Facebook
 * More
 * 

 * Tumblr
 * Pocket
 * 
 * 


APT41backdoorhacking newsmalwareSecurity AffairsSecurity News


--------------------------------------------------------------------------------

SHARE ON

 * 
 * 
 * 
 * 
 * 
 * 
 * 


PIERLUIGI PAGANINI

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and
Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he
is also a Security Evangelist, Security Analyst and Freelance Writer.
Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security
expert with over 20 years experience in the field, he is Certified Ethical
Hacker at EC Council in London. The passion for writing and a strong belief that
security is founded on sharing and awareness led Pierluigi to find the security
blog "Security Affairs" recently named a Top National Security Resource for US.
Pierluigi is a member of the "The Hacker News" team and he is a writer for some
major publications in the field such as Cyber War Zone, ICTTF, Infosec Island,
Infosec Institute, The Hacker News Magazine and for many other Security
magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency
and Bitcoin”.




--------------------------------------------------------------------------------

PREVIOUS ARTICLE

The Cost of Dealing With a Cybersecurity Attack in These 4 Industries

NEXT ARTICLE

Romania is going to exclude Huawei from its 5G Network

--------------------------------------------------------------------------------





YOU MIGHT ALSO LIKE


ANONYMOUS CONTINUES TO SUPPORT UKRAINE AGAINST THE RUSSIA

March 17, 2022  By Pierluigi Paganini

SOLARWINDS WARNS OF ATTACKS TARGETING WEB HELP DESK USERS

March 17, 2022  By Pierluigi Paganini






 * SPONSORED CONTENT
   
   
 * 


 * PIXFUTURE

 * 


 * DIGGING THE DEEP WEB: EXPLORING THE DARK SIDE OF THE WEB


 * CENTER FOR CYBER SECURITY AND INTERNATIONAL RELATIONS STUDIES


 * SUBSCRIBE SECURITY AFFAIRS NEWSLETTER


 * SECURITYAFFAIRS AWARDED AS BEST EUROPEAN CYBERSECURITY TECH BLOG AT EUROPEAN
   CYBERSECURITY BLOGGER AWARDS




More Story

THE COST OF DEALING WITH A CYBERSECURITY ATTACK IN THESE 4 INDUSTRIES

A cybersecurity issue can cause unexpected costs in several different areas,
which is the cost of Dealing with an attack...
Copyright 2021 Security Affairs by Pierluigi Paganini All Right Reserved.
Back to top
 * Home
 * Cyber Crime
 * Cyber warfare
 * APT
 * Data Breach
 * Deep Web
 * Digital ID
 * Hacking
 * Hacktivism
 * Intelligence
 * Internet of Things
 * Laws and regulations
 * Malware
 * Mobile
 * Reports
 * Security
 * Social Networks
 * Terrorism
 * ICS-SCADA
 * EXTENDED COOKIE POLICY
 * Contact me

This site uses cookies, including for analytics, personalization, and
advertising purposes. For more information or to change your cookie settings,
click here.

If you continue to browse this site without changing your cookie settings, you
agree to this use.
Accept Read More
Privacy and Cookies Policy
Close

PRIVACY OVERVIEW

This website uses cookies to improve your experience while you navigate through
the website. Out of these cookies, the cookies that are categorized as necessary
are stored on your browser as they are essential for the working of basic
functionalities...
Necessary
Necessary
Always Enabled
Necessary cookies are absolutely essential for the website to function properly.
This category only includes cookies that ensures basic functionalities and
security features of the website. These cookies do not store any personal
information.
Non-necessary
Non-necessary
Any cookies that may not be particularly necessary for the website to function
and is used specifically to collect user personal data via analytics, ads, other
embedded contents are termed as non-necessary cookies. It is mandatory to
procure user consent prior to running these cookies on your website.
SAVE & ACCEPT