Chinese Hackers Target Taiwanese Financial Institutions with a new Stealthy Backdoor

A Chinese innovative persistent threat (APT) team has been focusing on Taiwanese monetary institutions as portion of a “persistent campaign” that lasted for at minimum 18 months.

The intrusions, whose most important intent was espionage, resulted in the deployment of a backdoor known as xPack, granting the adversary considerable regulate above compromised equipment, Broadcom-owned Symantec stated in a report published past 7 days.

What is actually noteworthy about this marketing campaign is the sum of time the threat actor lurked on victim networks, affording the operators ample chance for in depth reconnaissance and exfiltrate probably sensitive facts pertaining to enterprise contacts and investments without having elevating any red flags.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

In a single of the unnamed economical companies, the attackers spent close to 250 times involving December 2020 and August 2021, even though a production entity had its network less than their look at for roughly 175 days.

While the initial accessibility vector applied to the breach the targets stays unclear, it is really suspected that Antlion leveraged a web application flaw to achieve a foothold and drop the xPack personalized backdoor, which is employed to execute system instructions, drop subsequent malware and instruments, and stage details for exfiltration.

Additionally, the threat actor made use of C++-based mostly tailor made loaders as well as a blend of reputable off-the-shelf instruments such as AnyDesk and residing-off-the-land (LotL) procedures to achieve distant entry, dump credentials, and execute arbitrary commands.

“Antlion is considered to have been associated in espionage things to do considering the fact that at least 2011, and this recent activity displays that it is nonetheless an actor to be informed of additional than 10 yrs right after it very first appeared,” the scientists mentioned.

The findings include to a developing listing of China-linked country-point out teams that have qualified Taiwan in current months, what with malicious cyber actions mounted by danger actors tracked as Tropic Trooper and Earth Lusca striking federal government, health care, transportation, and instructional institutions in the place.

Located this post attention-grabbing? Abide by THN on Facebook, Twitter  and LinkedIn to read through extra exclusive material we write-up.