Evasive Panda APT group delivers malware through updates for in style Chinese language software program

ESET researchers have found a marketing campaign that we attribute to the APT group often known as Evasive Panda, the place replace channels of reliable purposes had been mysteriously hijacked to ship the installer for the MgBot malware, Evasive Panda’s flagship backdoor.

Evasive Panda profile

Evasive Panda (also called BRONZE HIGHLAND and Daggerfly) is a Chinese language-speaking APT group, active since at least 2012. ESET Analysis has noticed the group conducting cyberespionage in opposition to people in mainland China, Hong Kong, Macao, and Nigeria. Authorities entities had been focused in China, Macao, and Southeast and East Asian international locations, particularly Myanmar, the Philippines, Taiwan, and Vietnam, whereas different organizations in China and Hong Kong had been additionally focused. In keeping with public reviews, the group has additionally focused unknown entities in Hong Kong, India, and Malaysia.

The group implements its personal customized malware framework with a modular structure that enables its backdoor, often known as MgBot, to obtain modules to spy on its victims and improve its capabilities.

Marketing campaign overview

In January 2022, we found that whereas performing updates, a reliable Chinese language utility had acquired an installer for the Evasive Panda MgBot backdoor. Throughout our investigation, we found that the malicious exercise went again to 2020.

Chinese language customers had been the main focus of this malicious exercise, which ESET telemetry exhibits beginning in 2020 and persevering with all through 2021. The focused customers had been situated within the Gansu, Guangdong, and Jiangsu provinces, as proven in Determine 1.

Determine 1. Map of China exhibiting the place customers had been focused

Nearly all of the Chinese language victims are members of a global NGO that operates in two of the beforehand talked about provinces.

One extra sufferer was additionally found to be situated within the nation of Nigeria.

Attribution

Evasive Panda makes use of a customized backdoor often known as MgBot, which was publicly documented in 2014 and has seen little evolution since then; to the perfect of our data, the backdoor has not been utilized by another group. On this cluster of malicious exercise, solely the MgBot malware was noticed deployed on victimized machines, together with its toolkit of plugins. Due to this fact, with excessive confidence we attribute this exercise to Evasive Panda.

Technical evaluation

Throughout our investigation, we found that when performing automated updates, a reliable utility software program part downloaded MgBot backdoor installers from reliable URLs and IP addresses.

In Desk 1, we offer the URL from the place the obtain originated, in accordance with ESET telemetry knowledge, together with the IP addresses of the servers, as resolved on the time by the person’s system; due to this fact, we imagine that these IP addresses are reliable. In keeping with passive DNS data, all of those IP addresses match the noticed domains, due to this fact we imagine that these IP addresses are reliable.

Desk 1. Malicious obtain areas in accordance with ESET telemetry

Hypotheses of compromise

After we analyzed the probability of a number of strategies that would clarify how the attackers managed to ship malware by reliable updates, we had been left with two eventualities: supply-chain compromise, and adversary-in-the-middle assaults. For each eventualities we may even consider antecedents of comparable assaults by different Chinese language-speaking APT teams.

Tencent QQ is a well-liked Chinese language chat and social media service. Within the subsequent sections, we’ll use the Tencent QQ Home windows consumer software program updater, QQUrlMgr.exe (listed in Desk 1), for our examples, provided that we have now the best variety of detections from downloads by this specific part.

Provide-chain compromise state of affairs

Given the focused nature of the assaults, we speculate that attackers would have wanted to compromise the QQ replace servers to introduce a mechanism to establish the focused customers to ship them the malware, filtering out non-targeted customers and delivering them reliable updates – we registered circumstances the place reliable updates had been downloaded by the identical abused protocols.

Whereas not an Evasive Panda case, a main instance of this kind of compromise is in our report Operation NightScout: Supply‑chain attack targets online gaming in Asia, the place attackers compromised the replace servers of a software program developer firm primarily based in Hong Kong. In keeping with our telemetry, greater than 100,000 customers had the BigNox software program put in, however solely 5 had malware delivered by an replace. We suspect that the attackers compromised the BigNox API on the replace server to answer to the updater part on the machines of focused customers with a URL to a server the place the attackers hosted their malware; non-targeted customers had been despatched the reliable replace URL.

Based mostly on that antecedent, in Determine 2 we illustrate how the supply-chain compromise state of affairs may have unfolded in accordance with observations in our telemetry. Nonetheless, we should warn the reader that that is purely hypothesis and primarily based on our static evaluation, with very restricted info, of QQUrlMgr.exe (SHA-1: DE4CD63FD7B1576E65E79D1D10839D676ED20C2B).

Determine 2. Sequence diagram of the hypothesized supply-chain compromise

It is usually value noting that in our analysis we had been by no means capable of retrieve a pattern of the XML “replace” knowledge – neither a reliable, nor a malicious, XML pattern – from the server contacted by QQUrlMgr.exe. The “replace test” URL is hardcoded, in obfuscated kind, within the executable, as proven in Determine 3.

Determine 3. Obfuscated URL within the reliable QQUrlMgr.exe binary

Deobfuscated, the whole replace test URL is:

http://c.gj.qq[.]com/fcgi-bin/busxml?busid=20&supplyid=30088&guid=CQEjCF9zN8Zdyzj5S6F1MC1RGUtw82B7yL+hpt9/gixzExnawV3y20xaEdtektfo&dm=0

The server responds with XML-formatted knowledge encoded with base64 and encrypted with an implementation of the TEA algorithm utilizing a 128-bit key. This knowledge comprises directions to obtain and execute a file, together with different info. Because the decryption key can be hardcoded, as proven in Determine 4, it could possibly be identified to the attackers.

Determine 4. Hardcoded key within the reliable QQUrlMgr.exe binary

QQUrlMgr.exe then downloads the indicated file, unencrypted, through HTTP and hashes its contents with the MD5 algorithm. The result’s checked in opposition to a hash current within the replace test response XML knowledge, as seen in Determine 5. If the hashes match, QQUrlMgr.exe executes the downloaded file. This reinforces our speculation that the attackers would wish to regulate the XML server-side mechanism within the replace server to have the ability to present the proper MD5 hash of the malware installer.

Determine 5. QQUrlMgr.exe code that orchestrates the obtain of the replace

We imagine that this state of affairs would clarify our observations; nonetheless, many questions are left unanswered. We reached out to Tencent’s Security Response Center to substantiate the legitimacy of the total URL from the place the malware was downloaded; replace.browser.qq[.]com is – on the time of writing – unreachable, however Tencent couldn’t verify whether or not the total URL was reliable.

Adversary-in-the-middle state of affairs

On 2022-06-02, Kaspersky revealed a research report in regards to the capabilities of the Chinese language-speaking LuoYu APT group and their WinDealer malware. Much like what we noticed on this cluster of Evasive Panda victims, their researchers discovered that, since 2020, victims of LuoYu had acquired the WinDealer malware by updates through the reliable utility qgametool.exe from the PPTV software program, additionally developed by a Chinese language firm.

WinDealer has a puzzling functionality: as a substitute of carrying a listing of established C&C servers to contact in case of a profitable compromise, it generates random IP addresses within the 13.62.0.0/15 and 111.120.0.0/14 ranges from China Telecom AS4134. Though a small coincidence, we observed that the IP addresses of the focused Chinese language customers on the time of receiving the MgBot malware had been on the AS4134 and AS4135 IP addresses ranges.

Potential explanations for what allows these capabilities for its C&C infrastructure are that LuoYu both management a considerable amount of units related to the IP addresses on these ranges, or that they can do adversary-in-the-middle (AitM) or attacker-on-the-side interception on the infrastructure of that individual AS.

AitM kinds of interception could be doable if the attackers – both LuoYu or Evasive Panda – had been capable of compromise weak units corresponding to routers or gateways. As an antecedent, in 2019 ESET researchers discovered that the Chinese language APT group often known as BlackTech was performing AitM assaults by compromised ASUS routers and delivering the Plead malware by ASUS WebStorage software program updates.

With entry to ISP spine infrastructure – by authorized or unlawful means – Evasive Panda would have the ability to intercept and reply to the replace requests carried out through HTTP, and even modify packets on the fly. In April 2023, Symantec researchers reported on Evasive Panda concentrating on a telecommunications group in Africa.

Wrap-up

In the end, with out additional proof, we can’t show or discard one speculation in favor of the opposite, provided that such capabilities are at hand for Chinese language APT teams.

Toolset

MgBot

MgBot is the first Home windows backdoor utilized by Evasive Panda, which in accordance with our findings has existed since at the least 2012 and, as talked about on this weblog submit, was publicly documented at VirusBulletin in 2014. It was developed in C++ with an object-oriented design, and has the capabilities to speak through TCP and UDP, and lengthen its performance through plugin modules.

MgBot’s installer and backdoor, and their performance, haven’t modified considerably because it was first documented. Its chain of execution is identical as described on this report by Malwarebytes from 2020.

MgBot Plugins

MgBot’s modular structure permits it to increase its performance by receiving and deploying modules on the compromised machine. Desk 2 lists the identified plugins and their performance. You will need to be aware that the plugins don’t have distinctive inner identification numbers; due to this fact we’re figuring out them right here by their DLL names on disk, which we have now by no means seen change.

Desk 2. Record of plugin DLL recordsdata

Nearly all of the plugins are designed to steal info from extremely in style Chinese language purposes corresponding to QQ, WeChat, QQBrowser, and Foxmail – all of them purposes developed by Tencent.

Conclusion

We found a marketing campaign that we attribute to the Evasive Panda APT group, concentrating on customers in mainland China, delivering their MgBot backdoor by replace protocols of purposes from well-known Chinese language corporations. We additionally analyzed the plugins of the MgBot backdoor and located nearly all of them are designed to spy on customers of Chinese language software program by stealing credentials and knowledge.

IoCs

Information

Community

MITRE ATT&CK methods

This desk was constructed utilizing version 12 of the MITRE ATT&CK framework.