Chinese Hackers Distributing SMS Bomber Tool with Malware Hidden Inside

A danger cluster with ties to a hacking group known as Tropic Trooper has been spotted applying a formerly undocumented malware coded in Nim language to strike targets as part of a recently uncovered marketing campaign.

The novel loader, dubbed Nimbda, is “bundled with a Chinese language greyware ‘SMS Bomber’ device that is most probable illegally dispersed in the Chinese-speaking web,” Israeli cybersecurity organization Examine Place stated in a report.

“Whoever crafted the Nim loader took special care to give it the exact executable icon as the SMS Bomber that it drops and executes,” the scientists stated. “Consequently the full bundle works as a trojanized binary.”

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

SMS Bomber, as the identify implies, permits a consumer to enter a phone number (not their individual) so as to flood the victim’s machine with messages and possibly render it unusable in what is actually a denial-of-company (DoS) attack.

The actuality that the binary doubles up as SMS Bomber and a backdoor indicates that the attacks are not just aimed at those people who are customers of the tool — a “alternatively unorthodox target” — but also extremely specific in nature.

Tropic Trooper, also acknowledged by the monikers Earth Centaur, KeyBoy, and Pirate Panda, has a track file of putting targets located in Taiwan, Hong Kong, and the Philippines, generally concentrating on govt, health care, transportation, and substantial-tech industries.

Contacting the Chinese-speaking collective “notably sophisticated and perfectly-equipped,” Trend Micro final yr pointed out the group’s capacity to evolve their TTPs to stay beneath the radar and depend on a broad range of custom resources to compromise its targets.

The most up-to-date attack chain documented by Look at Position starts with the tampered SMS Bomber instrument, the Nimbda loader, which launches an embedded executable, in this scenario the authentic SMS bomber payload, when also also injecting a different piece of shellcode into a notepad.exe method.

This kicks off a 3-tier an infection process that entails downloading a future-stage binary from an obfuscated IP handle specified in a markdown file (“EULA.md”) which is hosted in an attacker-controlled GitHub or Gitee repository.

The retrieved binary is an upgraded edition of a trojan named Yahoyah which is developed to obtain information about neighborhood wi-fi networks in the victim machine’s vicinity as nicely as other procedure metadata and exfiltrate the specifics again to a command-and-handle (C2) server.

Yahoyah, for its component, also functions as a conduit to fetch the ultimate-stage malware, which is downloaded in the type of an image from the C2 server. The steganographically-encoded payload is a backdoor identified as TClient and has been deployed by the team in past strategies.

“The observed exercise cluster paints a photograph of a concentrated, established actor with a crystal clear intention in brain,” the scientists concluded.

“Generally, when 3rd-party benign (or benign-showing up) equipment are hand-picked to be inserted into an an infection chain, they are picked to be the minimum conspicuous doable the alternative of an ‘SMS Bomber’ resource for this goal is unsettling, and tells a complete story the second 1 dares to extrapolate a motive and an meant target.”

Discovered this report intriguing? Follow THN on Fb, Twitter  and LinkedIn to examine more exclusive information we submit.