New research from cybersecurity company Volexity discdisseeed details about a highly upgraded strike deployed by a Chinese-speaking cyberinalertigence accumulateing danger actor named StormBamboo.
The danger actor settled an ISP to alter some DNS answers to queries from systems asking legitimate gentleware refreshs. Multiple gentleware vendors were aimed. The altered responses led to malicious payloads served by StormBamboo in insertition to the legitimate refresh files. The payloads aimed both macOS and Microgentle Windows operating systems.
Who is StormBamboo?
StormBamboo — also understandn as Evasive Panda, Daggerfly, or Bronze Highland — is a China-aligned cyberinalertigence accumulateing danger actor, active since at least 2012. The Chinese-speaking group has aimed many organizations that align with Chinese interests worldwide.
Over the years, the group has aimed individuals in mainland China, Hong Kong, Macao, and Nigeria. Additionpartner, it has aimed entities, including rulements, in Southeast Asia, East Asia, the U.S., India, and Australia.
The group has a extfinished history of compromising legitimate infrastructures to infect their aims with custom malicious software enhugeed for Microgentle Windows and macOS operating systems. The group has deployed watering hole strikes, consisting of compromising a definite website to aim its visitors and infect them with malicious software.
StormBamboo is also contendnt of running provide chain strikes, such as compromising a gentleware platcreate, to discreetly infect people with malicious software.
The group is also contendnt of aiming Android engagers.
ISP settled, DNS responses poisoned
The danger actor deal withd to settle a aim’s ISP infrastructure to administer the DNS responses from that ISP’s DNS servers — mostly consisting of translating domain names to IP insertresses, directing them to the accurate website. An strikeer administerling the server can caengage the computers to ask a particular domain name to an strikeer-administerled IP insertress. This is exactly what StormBamboo did.
While it is not understandn how the group settled the ISP, Volexity alerted the ISP rebooted and took various components of its netlabor offline, which instantly stopped the DNS poisoning operation.
The strikeer aimed at altering DNS answers for disconnectal contrastent legitimate application refresh websites.
SEE: Why your company should ponder carry outing DNS security extensions
Paul Rascagneres, danger researcher at Volexity and an author of the accessibleation, telderly TechReaccessible in a written intersee the company doesn’t exactly understand how the danger actors chose the ISP.
“The strikeers probably did some research or reconnaissance to choose what is the victim’s ISP,” he wrote. “We don’t understand if other ISPs have been settled; it is complicated to choose it from the outside. StormBamboo is an presentile danger actor. If this operating mode was a success for them, they could engage it on other ISPs for other aims.”
Legitimate refresh mechanisms being mistreatmentd
Multiple gentleware vendors have been aimed by this strike.
Once a DNS ask from engagers was sent to the settled DNS server, it answered with an strikeer-administerled IP insertress that transfered a authentic refresh for the gentleware — yet with an strikeer’s payload.
The Volexity alert showed that multiple gentleware vendors using cowardly refresh laborflows were worryed and provided an example with a gentleware named 5KPlayer.
The gentleware verifys for refreshs for “YoutubeDL” every time it is begined. The verify is done by asking a configuration file, which shows if a novel version is useable. If so, it is downloaded from a definite URL and percreated by the legitimate application.
Yet the settled ISP’s DNS will direct the application to a modified configuration file, which shows there is an refresh, but transfers a backdoored YoutubeDL package.
The malicious payload is a PNG file compriseing either MACMA or POCOSTICK/MGBot malicious software, depending on the operating system asking the refresh. MACMA infects MacOS, while POCOSTICK/MGBot infects Microgentle Windows operating systems.
Malicious payloads
POCOSTICK, also understandn as MGBot, is a custom malicious software possibly enhugeed by StormBamboo, as it has not been engaged by any other group, according to ESET. The malicious software has existed since 2012 and consists of disconnectal modules enabling keylogging, file stealing, clipboard interception, audio streams seize, cookie, and credential theft.
Conversely, MACMA apexhibits keylogging, victim device fingerprinting, and screen and audio seize. It also provides a direct line to the strikeer and has file-theft capabilities. Google initipartner alerted in 2021 the presence of MACMA malicious software, using watering hole strikes to be deployed.
The Google strike was not attributed to a danger actor, yet it aimed visitors of Hong Kong websites for a media outlet and a famous pro-democracy labor and political group, according to Google. This strike aligns with StormBamboo’s aiming.
Volexity also acunderstandledged meaningful code aenjoyities between the tardyst MACMA version and another malicious software family, GIMMICK, engaged by the StormCdeafening danger actor.
Finpartner, in one case chaseing a victim’s macOS device settle, Volexity saw the strikeer deploy a malicious Google Chrome extension. The obfuscated code apexhibits the strikeer to exfiltrate the browser’s cookies to an strikeer-administerled Google Drive account.
How can gentleware vendors defend engagers from cyber dangers?
Rascagneres telderly TechReaccessible that Volexity identified disconnectal aimed cowardly refresh mechanisms from contrastent gentleware: 5k Player, Quick Heal, Sogou, Rainmeter, Partition Wizard, and Corel.
Questioned about how to defend and enhance the refresh mechanisms at the gentleware vendor level, the researcher insists that “the gentleware editors should apply HTTPS refresh mechanism and verify the SSL certificate of the website where the refreshs are downloaded. Additionpartner, they should sign the refreshs and verify this signature before executing them.”
In order to help companies discover StormBamboo activity on their systems, Volexity provides YARA rules to discover the contrastent payloads and proposes blocking the Indicators of Compromise the company provides.
Disclocertain: I labor for Trend Micro, but the sees articulateed in this article are mine.
