Chinese hackers abuse VLC Media Player to launch malware loader

Protection researchers have uncovered a prolonged-functioning destructive campaign from hackers involved with the Chinese federal government who are working with VLC Media Player to start a customized malware loader.

The marketing campaign appears to serve espionage reasons and has specific a variety of entities included in government, authorized, and spiritual pursuits, as well as non-governmental companies (NGOs) on at the very least a few continents.

This activity has been attributed to a threat actor tracked as Cicada (a.k.a. menuPass, Stone Panda, Potassium, APT10, Crimson Apollo) that has been active for much more than 15 decades, because at the very least 2006.

Employing VLC to deploy personalized malware loader

The begin of Cicada’s present marketing campaign has been tracked to mid-2021 and was continue to lively in February 2022. Researchers say that this action may go on now.

There is evidence that some preliminary accessibility to some of the breached networks was by way of a Microsoft Exchange server, indicating that the actor exploited a acknowledged vulnerability on unpatched devices.

Researchers at Symantec, a division of Broadcom, uncovered that following gaining obtain to the target machine the attacker deployed a custom made loader on compromised techniques with the enable of the common VLC media player.

Brigid O Gorman of Symantec Threat Hunter Staff instructed BleepingComputer that the attacker uses a thoroughly clean edition of VLC with a destructive DLL file in the identical route as the media player’s export features.

The method is recognized as DLL aspect-loading and it is greatly applied by menace actors to load malware into respectable procedures to disguise the destructive action.

Aside from the custom made loader, which O Gorman mentioned Symantec does not have a title but has been noticed in previous assaults attributed to Cicada/APT10, the adversary also deployed a WinVNC server to attain distant management more than victim methods.

The attacker also executed the Sodamaster backdoor on compromised networks, a resource believed to be applied solely by the Cicada threat group because at minimum 2020.

Sodamaster runs in the system memory (fileless) and is geared up to evade detection by seeking in the registry for clues of a sandbox natural environment or by delaying its execution.

The malware can also collect details about the technique, research for managing processes, and download and execute various payloads from the command and handle server.

Many other utilities have been noticed in this marketing campaign contain:

• RAR archiving resource – can help compress, encrypt, or archive documents, probable for exfiltration
• System/Community discovery – a way for attackers to learn about the methods or companies linked to an contaminated equipment
• WMIExec – Microsoft command-line tool that can be employed to execute commands on distant computer systems
• NBTScan – an open-source device that has been noticed staying employed by APT groups for reconnaissance in a compromised network

The attackers’ dwell time on the networks of some of the found victims lasted for as extensive as nine months, the scientists notice in a report today.

A wider focus

Many of the businesses focused in this marketing campaign surface to be govt-similar or NGOs (concerned in educational or spiritual actions), as nicely as organizations in the telecommunications, lawful, and pharmaceutical sectors.

Symantec researchers spotlight the huge geography of this Cicada campaign, which counts victims in the U.S., Canada, Hong Kong, Turkey, Israel, India, Montenegro, and Italy.

To take note, only a single sufferer is from Japan, a region that has been the emphasis of the Cicada team for many several years.

In contrast to the earlier targeting from this group, which centered on Japanese-linked organizations, the victims in this marketing campaign reveal that the danger actor has broadened its interest.

Although focused on Japanese-joined organizations, Cicada has focused in the past health care, protection, aerospace, finance, maritime, biotechnology, vitality, and government sectors.

At least two members of the APT10 menace team have been billed in the U.S. for computer system hacking action to assist the Chinese Ministry of State Security’s (MSS) Tianjin State Stability Bureau get mental property and private business enterprise info from managed company vendors, U.S. governing administration businesses, and over 45 technologies organizations.