Alloy Taurus Hackers Update PingPull Malware to Target Linux Systems

The menace actor recognized as Alloy Taurus has been noticed deploying a new variant of the PingPull malware focusing on Linux units.

Assessed by Palo Alto Networks’ Device 42 to be a Chinese highly developed persistent risk (APT) group focusing on espionage campaigns, Alloy Taurus has been lively considering that at the very least 2012.

Read far more on China-primarily based threat actors: EU Cybersecurity Company Warns Towards Chinese APTs

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

“This group has historically qualified telecommunications businesses working throughout Asia, Europe and Africa,” wrote Device 42 in an advisory revealed earlier these days. “In the latest several years, we have also observed the team extend their focusing on to consist of monetary establishments and federal government entities.”

As part of the new marketing campaign, the security researchers explained they also observed Alloy Taurus focusing on folks in South Africa and Nepal.

The Linux sample noticed by Device 42 was originally discovered as benign by most distributors. Nevertheless, even further assessment unveiled that it matched the communication composition, parameters and instructions of the identified PingPull malware. 

The malicious resource is developed to talk with its command-and-regulate (C2) server working with encrypted information and can get and execute commands from the server. The final results of these commands are then despatched back again to the server for further more action. 

In accordance to Device 42, this Linux variant of PingPull malware utilizes the same AES crucial as the original Windows PE (Preinstallation Natural environment) variant for encrypting its interaction with the C2 server.

Even though investigating the C2 area of the PingPull Linux variant, scientists also identified an further sample that communicated with the identical domain. 

This malware was identified to be a backdoor the workforce termed Sword2033. The backdoor supports 3 essential features: uploading and downloading data files to and from the system, and executing instructions. These instructions are similar in value and features to all those utilized by the PingPull malware. More analysis of the C2 infrastructure unveiled links to Alloy Taurus pursuits.

“The identification of a Linux variant of PingPull malware, as properly as latest use of the Sword2033 backdoor, implies that the team carries on to evolve their functions in assistance of their espionage actions,” reads the advisory.

“We persuade all companies to leverage our findings to tell the deployment of protective actions to protect from this threat group.”

The conclusions occur amid Russian-backed hackers turning to cyber-espionage in Ukraine.