0
1
Security researchers have discovered a custom-built piece of malware that’s wreaking havoc in Asia for past several months and is capable of performing nasty tasks, like password stealing, bitcoin mining, and providing hackers complete remote access to compromised systems.
Dubbed Operation PZChao, the attack campaign discovered by the security researchers at Bitdefender have been targeting organizations in the government, technology, education, and telecommunications sectors in Asia and the United States.
Researchers believe nature, infrastructure, and payloads, including variants of the Gh0stRAT trojan, used in the PZChao attacks are reminiscent of the notorious Chinese hacker group—Iron Tiger.
However, this campaign has evolved its payloads to drop trojan, conduct cyber espionage and mine Bitcoin cryptocurrency.
The PZChao campaign is attacking targets across Asia and the U.S. by using similar attack tactics as of Iron Tiger, which, according to the researchers, signifies the possible return of the notorious Chinese APT group.
Since at least July last year, the PZChao campaign has been targeting organizations with a malicious VBS file attachment that delivers via highly-targeted phishing emails.
If executed, the VBS script downloads additional payloads to an affected Windows machine from a distribution server hosting « down.pzchao.com, » which resolved to an IP address (125.7.152.55) in South Korea at the time of the investigation.
The threat actors behind the attack campaign have control over at least five malicious subdomains of the « pzchao.com » domain, and each one is used to serve specific tasks, like download, upload, RAT related actions, malware DLL delivery.
The payloads deployed by the threat actors are « diversified and include capabilities to download and execute additional binary files, collect private information and remotely execute commands on the system, » researchers noted.
The first payload dropped on the compromised machines is a Bitcoin miner, disguised as a ‘java.exe’ file, that mines cryptocurrency every three weeks at 3 AM, when most people are not in front of their systems.
To read the original article:
https://thehackernews.com/2018/02/cyber-espionage-asia.html
