Summary:
Researchers have identified a new campaign of APT41, the threat actor associated with the Chinese government. They're calling the group Earth Longzhi. Since it first started being active in 2020, Earth Longzhi’s long-running campaign can be divided into two. During its first campaign, APT group targeted the government and health infrastructure, in Taiwan. In its second campaign the group targeted high-profile victims in the defense, aviation, and urban development industries in the Asian region. In its new campaign, the hackers used the custom cobalt strike loader named ‘Symatic’ to remove API hooks, to spawn a new process for process injection and masquerade the parent process to obfuscate the chain and to inject a decrypted payload.[/subscribe_to_unlock_form]
Summary:
Researchers have identified a new campaign of APT41, the threat actor associated with the Chinese government. They're calling the group Earth Longzhi. Since it first started being active in 2020, Earth Longzhi’s long-running campaign can be divided into two. During its first campaign, APT group targeted the government and health infrastructure, in Taiwan. In its second campaign the group targeted high-profile victims in the defense, aviation, and urban development industries in the Asian region. In its new campaign, the hackers used the custom cobalt strike loader named ‘Symatic’ to remove API hooks, to spawn a new process for process injection and masquerade the parent process to obfuscate the chain and to inject a decrypted payload.[emaillocker id="1283"]
Threat Profile:
References:
The following reports contain further technical details:
(Kindly exclude this link in the advisory mail)
[/emaillocker]