Chinese espionage group APT27 moves into ransomware

Researchers have discovered that the Chinese espionage team APT27 has moved into extra economically-enthusiastic cybercrimes, using ransomware to encrypt main servers at key gaming corporations globally.

In a site launched by Profero and Security Joes, scientists reported the crew initial started subsequent APT27 intently in early 2020 when they responded to the ransomware incident. During that investigation they found malware discovered by TrendMicro back again in July 2019, which was connected to a marketing campaign by APT27 and Winnti, acknowledged as DRBControl. Equally groups are linked to China.

The Profero/Security Joes report on the ransomware incidents observed particularly sturdy hyperlinks to APT27 in conditions of code similarities and methods, methods and treatments. They explained what stood out in this incident was the encryption of main servers making use of BitLocker, a push encryption software designed into Windows. The technique was unusual, presented risk actors commonly drop the ransomware to the machines as opposed to making use of nearby tools. What solidified their perception that APT27 had moved into monetarily-enthusiastic cybercrime was a report in April 2020 by Beneficial Technologies that discovered APT27 experienced also dropped the Polar ransomware on units.  

Austin Merritt, cyber risk intelligence analyst at Electronic Shadows, said the sizeable use of tooling that has historically been connected to Chinese danger actors indicates it is realistically doable that APT27 or Winnti could have been dependable for the ransomware actions outlined by the Profero/Security Joes report. Merritt included that other country-point out affiliated APTs this kind of as TA505 (Russia) and Lazarus Team (North Korea) have made use of ransomware in the previous.

“As lots of ransomware variants are deployed employing commodity malware variants, these types of as TrickBot and Emotet, it’s usually challenging to pinpoint attribution to just one precise APT,” Merritt stated. “Given the prominence of ransomware across the threat landscape, it is very likely that economically-determined country-condition threat actors will use ransomware in potential attacks.”

Some pieces of this short article are sourced from:
www.scmagazine.com