Hackers Deploy Shadowpad Backdoor and Target Industrial Control Systems in Asia

Russian cybersecurity firm Kaspersky uncovered an attack marketing campaign focusing on unpatched Microsoft Trade servers in distinctive Asian countries.

According to an advisory launched by the organization on Monday, once they acquired preliminary access via the above vulnerabilities, the risk actors deployed the ShadowPad malware on the industrial manage devices (ICS) of telecommunications corporations in Pakistan and Afghanistan and a logistics and a transport organization in Malaysia.

Kaspersky explained it 1st spotted the threat in Oct 2021, with the hackers exploiting the CVE-2021-26855 vulnerability in Microsoft Exchange. Nonetheless, signals of the attacks on impacted methods seem to be to date back again as much as March 2021.

“During the investigation, researchers uncovered larger-scale activity by the danger actor in the network of the telecommunications business and also recognized other victims of the marketing campaign,” reads the advisory.

Through the attack campaign, the ShadowPad backdoor was reportedly downloaded to target desktops as the mscoree.dll file, which was, in transform, introduced by a respectable executable file named AppLaunch.exe.

Attackers would then start ShadowPad working with DLL hijacking in OleView, a legitimate OLE-COM object viewing software. At the time they obtained the original foothold into the procedure, the risk actors would deliver commands manually, then instantly.

Further applications applied by the hackers for the duration of these cyber-attacks reportedly include the CobaltStrike framework, the PlugX backdoor and various BAT information. A complete list is available in the original text of the advisory.

In conditions of attribution, Kaspersky reported the freshly determined attacks on a wide variety of organizations had an practically totally distinctive set of ways, tactics and processes (TTP).

“The attackers’ TTP enabled us to url these attacks to a Chinese-talking risk actor, and we noticed victims found in diverse regions. This suggests that the actor we have discovered may perhaps have broader geographical pursuits and we could assume a lot more victims to be found out in different international locations in the long run.”

At the time of creating, on the other hand, the antivirus enterprise mentioned they could not be confident of the top objective of the attacker, but they feel it may perhaps be data harvesting.

“We believe that it is very probably that this risk actor will strike again and we will come across new victims in unique international locations.”

Some pieces of this write-up are sourced from:
www.infosecurity-journal.com