Mustang Panda Hackers Targets Philippines Government Amid South China Sea Tensions

The China-linked Mustang Panda actor has been connected to a cyber attack focusing on a Philippines authorities entity amid climbing tensions amongst the two countries above the disputed South China Sea.

Palo Alto Networks Device 42 attributed the adversarial collective to a few strategies in August 2023, principally singling out businesses in the South Pacific.

“The campaigns leveraged reputable software which include Stable PDF Creator and SmadavProtect (an Indonesian-centered antivirus remedy) to sideload malicious data files,” the organization mentioned.

“Menace authors also creatively configured the malware to impersonate respectable Microsoft targeted visitors for command and regulate (C2) connections.”

Mustang Panda, also tracked below the names Bronze President, Camaro Dragon, Earth Preta, RedDelta, and Stately Taurus, is assessed to be a Chinese sophisticated persistent danger (APT) energetic since at the very least 2012, orchestrating cyber espionage strategies concentrating on non-governmental businesses (NGOs) and authorities bodies across North The us, Europe, and Asia.

In late September 2023, Device 42 also implicated the risk actor to attacks aimed at an unnamed Southeast Asian government to distribute a variant of a backdoor identified as TONESHELL.

The most up-to-date campaigns leverage spear-phishing e-mail to supply a destructive ZIP archive file that contains a rogue dynamic-website link library (DLL) that is introduced applying a procedure called DLL facet-loading. The DLL subsequently establishes contact with a remote server.

It is really assessed that the Philippines govt entity was very likely compromised about a five-day time period between August 10 and 15, 2023.

The use of SmadavProtect is a regarded tactic adopted by Mustang Panda in new months, acquiring deployed malware expressly intended to bypass the security remedy.

“Stately Taurus proceeds to display its skill to conduct persistent cyberespionage operations as one of the most active Chinese APTs,” the researchers said.

“These functions target a selection of entities globally that align with geopolitical subjects of curiosity to the Chinese authorities.”

The disclosure comes as a South Korean APT actor named Higaisa has been uncovered targeting Chinese customers by means of phishing sites mimicking well-recognised software purposes these types of as OpenVPN.

“When executed, the installer drops and operates Rust-based mostly malware on the procedure, subsequently triggering a shellcode,” Cyble said late past month. “The shellcode performs anti-debugging and decryption functions. Afterward, it establishes encrypted command-and-command (C&C) interaction with a remote Danger Actor (TA).”

Discovered this write-up exciting? Observe us on Twitter  and LinkedIn to study a lot more exclusive written content we post.

Some areas of this posting are sourced from:
thehackernews.com