Chinese Espionage Hackers Target Tibetans Using New LOWZERO Backdoor

A China-aligned superior persistent threat actor recognized as TA413 weaponized just lately disclosed flaws in Sophos Firewall and Microsoft Place of work to deploy a hardly ever-prior to-witnessed backdoor termed LOWZERO as component of an espionage campaign aimed at Tibetan entities.

Targets primarily consisted of organizations involved with the Tibetan neighborhood, which includes enterprises connected with the Tibetan govt-in-exile.

The intrusions associated the exploitation of CVE-2022-1040 and CVE-2022-30190 (aka “Follina”), two distant code execution vulnerabilities in Sophos Firewall and Microsoft Business, respectively.

“This willingness to rapidly incorporate new methods and solutions of initial accessibility contrasts with the group’s ongoing use of very well recognised and noted capabilities, these as the Royal Street RTF weaponizer, and frequently lax infrastructure procurement tendencies,” Recorded Long term stated in a new specialized examination.

TA413, also regarded as LuckyCat, has been joined to relentlessly targeting companies and individuals affiliated with the Tibetan neighborhood at least since 2020 making use of malware these kinds of as ExileRAT, Sepulcher, and a malicious Mozilla Firefox browser extension dubbed FriarFox.

The group’s exploitation of the Follina flaw was earlier highlighted by Proofpoint in June 2022, while the greatest finish aim of the infection chains remained unclear.

Also place to use in a spear-phishing attack discovered in Could 2022 is a destructive RTF doc that exploited flaws in Microsoft Equation Editor to drop the custom LOWZERO implant. This is obtained by using a Royal Highway RTF weaponizer instrument, which is greatly shared between Chinese menace actors.

In a different phishing email despatched to a Tibetan goal in late May well, a Microsoft Word attachment hosted on the Google Firebase company attempted to leverage the Follina vulnerability to execute a PowerShell command made to download the backdoor from a distant server.

LOWZERO, the backdoor, is capable of obtaining further modules from its command-and-regulate (C2) server, but only on the issue that the compromised device is deemed to be of curiosity to the danger actor.

“The group continues to incorporate new abilities although also relying on tried-and-tested [tactics, techniques, and procedures,” the cybersecurity firm said.

“TA413’s adoption of both zero-day and recently published vulnerabilities is indicative of wider trends with Chinese cyber-espionage groups whereby exploits regularly appear in use by multiple distinct Chinese activity groups prior to their widespread public availability.”

Found this article interesting? Follow THN on Facebook, Twitter  and LinkedIn to read more exclusive content we post.

Some pieces of this post are sourced from:
thehackernews.com