Threat Bulletin: Weaponized Software Targets Chinese-speaking Organizations
Thumbnail
A series of sophisticated cyberattacks targeting organizations in Chinese-speaking regions have been identified, utilizing a multi-stage loader called PNGPlug to deliver the ValleyRAT malware. The attacks begin with phishing tactics, leading to the installation of a malicious MSI package that deploys the malware while maintaining a facade of legitimacy. Affected: Chinese-speaking organizations, Hong Kong, Taiwan, China

Keypoints :

  • Attacks are targeting organizations in Hong Kong, Taiwan, and China.
  • Utilizes a multi-stage loader named PNGPlug to deliver the ValleyRAT payload.
  • The attack begins with a phishing webpage prompting victims to download a malicious MSI package.
  • The MSI package executes benign applications while extracting an encrypted malware payload.
  • PNGPlug loader patches ntdll.dll for memory injection and checks for antivirus software.
  • ValleyRAT malware employs advanced techniques such as shellcode execution, obfuscation, and persistence mechanisms.
  • Attribution of the campaign is linked to the Silver Fox APT group.
  • Highlights operational gaps in cybersecurity measures among targeted organizations.
  • Attackers use legitimate software as a delivery mechanism for malware.

MITRE Techniques :

  • T1071.001 – Application Layer Protocol: The loader communicates with the command-and-control (C2) server to fetch additional malicious components.
  • T1203 – Exploitation for Client Execution: The attack exploits users through a phishing webpage to download a malicious MSI package.
  • T1059.001 – Command and Scripting Interpreter: The loader runs commands to inject malicious payloads into memory.
  • T1027 – Obfuscated Files or Information: The use of .png file extensions conceals the malicious payloads.
  • T1547.001 – Boot or Logon Autostart Execution: The loader modifies the registry to maintain persistence.

Indicator of Compromise :

  • [IP Address] 156.247.33[.]53
  • [File Hash] 08dad42da5aba6ef48fca27c783f78f06ab9ea7a933420e4b6b21e12e550dd7d
  • [File Hash] 33bc111238a0c6f10f6fe3288b5d4efe246c20efd8d85b4fe88f7d602d70738e
  • [File Hash] 50a64e97c6a5417023f3561f33291b448ce830a4d99c40356af67301c8fa7523
  • [File Hash] 45.195.148[.]107
  • Check the article for all found IoCs.

Full Research: https://intezer.com/blog/malware-analysis/weaponized-software-targets-chinese/