New group found using Microsoft-signed certificates in attacks

Wednesday, 23 August 2023 08:26

New group found using Microsoft-signed certificates in attacks Featured

By Sam Varghese

Image by Mohamed Hassan from Pixabay

A hitherto unknown group of attackers has used legitimate certificates signed by Microsoft to attack companies in Asia, the security firm Symantec claims.

Most of the victims were from Hong Kong and the attack group, given the name Carderbee, used a backdoor known as Korplug aka PlugX, the firm's Threat Hunter Team said in a blog post on Tuesday.

The software which was used as transport for the attack was a legitimate application, known as Cobra DocGuard, sold by a Chinese company known as EsafeNet and used to protect, encrypt and decrypt software.

The Symantec research cited a report from Slovakian security firm ESET that claimed a malicious update to EsafeNet enabled the compromise of a gambling company in Hong Kong in 2022.

This was the second attack on this gambling firm, with the technique used also being similar. On the earlier occasion, a group known as Budworm, aka LuckyMouse or APT 27, was found to be behind the attack, leading ESET to attribute the 2022 attack to the same group.

The 2022 attack used a variant of the Korplug malware which had the word ESET in a header indicating that it may have been modified to bypass ESET products, the Symantec researchers noted.

The Symantec team said a signed version of Korplug was also used in the attack that it investigated, ann intrusion that began in April 2023.

"However, we did not find any other evidence to indicate that this attack was carried out by Budworm," the team noted. "Korplug is a backdoor that is known to be used by multiple APTs, including APT41 and Budworm.

"We do not have any indication of the industry sectors of the companies targeted in this recent activity, just their geographic location.

"Accordingly, it was not possible to link this activity definitively to a known group, which is why we attributed it to a new group, Carderbee."

While the Symantec researchers found the Cobra DocGuard software installed on about 2000 computers in the targeted companies, only about 100 displayed malicious activity.

The researchers pointed out that the use of Microsoft-signed malware was common, pointing to a December 2022 post from the Google-owned security outfit Mandiant which found a driver sample signed with a Microsoft Windows Hardware Compatibility Authenticode signature.

"It seems clear the attackers... are patient and skilled actors. They leverage both a supply chain attack and signed malware to carry out their activity in an attempt to stay under the radar," the researchers concluded.

"The fact that they appear to only deploy their payload on a handful of the computers they gain access to also points to a certain amount of planning and reconnaissance on behalf of the attackers behind this activity.

"Software supply chain attacks remain a major issue for organisations in all sectors, with multiple high-profile supply chain attacks occurring in the last 12 months, including the MOVEit, X_Trader, and 3CX attacks."

Read 589 times

Please join our community here and become a VIP.

Subscribe to ITWIRE UPDATE Newsletter here
JOIN our iTWireTV our YouTube Community here
BACK TO LATEST NEWS here

GARTNER MARKET GUIDE FOR NDR 2022

You probably know that we are big believers in Network Detection and Response (NDR).

Did you realise that Gartner also recommends that security teams prioritise NDR solutions to enhance their detection and response?

Picking the right NDR for your team and process can sometimes be the biggest challenge.

If you want to try out a Network Detection and Response tool, why not start with the best?

Vectra Network Detection and Response is the industry's most advanced AI-driven attack defence for identifying and stopping malicious tactics in your network without noise or the need for decryption.

Download the 2022 Gartner Market Guide for Network Detection and Response (NDR) for recommendations on how Network Detection and Response solutions can expand deeper into existing on-premises networks, and new cloud environments.

DOWNLOAD NOW!

PROMOTE YOUR WEBINAR ON ITWIRE

It's all about Webinars.

Marketing budgets are now focused on Webinars combined with Lead Generation.

If you wish to promote a Webinar we recommend at least a 3 to 4 week campaign prior to your event.

The iTWire campaign will include extensive adverts on our News Site itwire.com and prominent Newsletter promotion https://itwire.com/itwire-update.html and Promotional News & Editorial. Plus a video interview of the key speaker on iTWire TV https://www.youtube.com/c/iTWireTV/videos which will be used in Promotional Posts on the iTWire Home Page.

Now we are coming out of Lockdown iTWire will be focussed to assisting with your webinars and campaigns and assistance via part payments and extended terms, a Webinar Business Booster Pack and other supportive programs. We can also create your adverts and written content plus coordinate your video interview.

We look forward to discussing your campaign goals with you. Please click the button below.

MORE INFO HERE!