New APT Group ‘Lotus Bane’ Behind Recent Attacks on Vietnam’s Financial Entities

A financial entity in Vietnam was the goal of a earlier undocumented menace actor called Lotus Bane that was first detected in March 2023.

Singapore-headquartered Team-IB described the hacking outfit as an superior persistent risk team that is believed to have been active considering the fact that at minimum 2022.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

The precise specifics of the infection chain continue to be mysterious as however, but it involves the use of several malicious artifacts that serve as the stepping stone for the future-phase.

“The cybercriminals applied methods these types of as DLL side-loading and data exchange by using named pipes to operate destructive executables and create remote scheduled tasks for lateral movement,” the enterprise reported.

Team-IB explained to The Hacker News that the techniques used by Lotus Bane overlap with that of OceanLotus, a Vietnam-aligned risk actor also acknowledged as APT32, Canvas Cyclone (previously Bismuth), and Cobalt Kitty. This stems from the use of malware like PIPEDANCE for named pipes communication.

It can be value noting that PIPEDANCE was 1st documented by Elastic Security Labs in February 2023 in relationship with a cyber attack concentrating on an unnamed Vietnamese corporation in late December 2022.

“This similarity suggests attainable connections with or inspirations from OceanLotus, however, the distinctive concentrate on industries make it probably that they are distinctive,” Anastasia Tikhonova, head of Risk Intelligence for APAC at Team-IB, explained.

“Lotus Bane is actively participating in attacks primarily focusing on the banking sector in the APAC region. Although the regarded attack was in Vietnam, the sophistication of their strategies indicates the likely for broader geographical operations in APAC. The correct period of their action prior to this discovery is currently unclear, but ongoing investigations could shed extra mild on their heritage.”

The progress arrives as fiscal companies throughout Asia-Pacific (APAC), Europe, Latin The usa (LATAM), and North America have been the goal of quite a few highly developed persistent menace groups this sort of as Blind Eagle and the Lazarus Group over the earlier 12 months.

One more notable fiscally enthusiastic risk group is UNC1945, which has been observed targeting ATM change servers with the intention of infecting them with a custom made malware named CAKETAP.

“This malware intercepts info transmitted from the ATM server to the [Hardware Security Module] server and checks it against a established of predefined situations,” Group-IB mentioned. “If these disorders are satisfied, the information is altered prior to remaining sent out from the ATM server.”

UNC2891 and UNC1945 had been earlier in-depth by Google-owned Mandiant in March 2022 as getting deployed the CAKETAP rootkit on Oracle Solaris techniques to intercept messages from an ATM switching network and perform unauthorized cash withdrawals at distinct banking companies working with fraudulent playing cards.

“The existence and routines of both of those Lotus Bane and UNC1945 in the APAC area spotlight the require for continued vigilance and robust cybersecurity actions,” Tikhonova said. “These groups, with their distinct strategies and targets, underline the complexity of protecting in opposition to monetary cyber threats in modern electronic landscape.”

Observed this short article fascinating? Follow us on Twitter  and LinkedIn to go through a lot more distinctive content we publish.