Malware

Aside from exploiting a domain generation algorithm and conducting environment checks to prevent execution on other systems, the newly discovered Zloader variant has also been spread through the GhostSocks payload as part of an updated attack chain, a report from Zscaler ThreatLabz showed.

Attacks involved the exploitation of open-source and living-off-the-land tactics previously associated with Chinese advanced persistent threat groups, including the Rakshasa and Stowaway reverse proxy programs, the PlugX remote access trojan, and custom DLL files enabling login credential exfiltration, according to an analysis from the Symantec Threat Hunter Team.

After tapping Russian threat operation Storm-1837's backdoor to facilitate Tavdig loader compromise in January, Turla proceeded to leverage Storm-1919's Amadey botnet to distribute the XMRig cryptominer between March and April, according to an analysis from the Microsoft Threat Intelligence team.

Mandiant's proof-of-concept encodes C2 commands within QR codes rendered on web pages.

Threat actors behind the intrusions initially compromised internet-exposed apps and database servers with SQL injection before proceeding with PHPsert webshell distribution, reconnaissance, credential compromise, lateral movement, and custom Mimikatz injection for pass-the-hash intrusions, according to a joint report from SentinelOne SentinelLabs and Tinextra Cyber.

China appears to be merging its government and malware operations to create a new surveillance platform for Android devices.

Citrine Sleet's intrusion against Radiant Capital commenced in September with the spoofing of a former contractor on Telegram to lure a Radiant developer into downloading a ZIP file featuring a decoy PDF file and the InletDrift macOS malware, which facilitated backdoor injection, according to the investigation.