Sharp Panda Target Southeast Asia in Espionage Campaign Expansion

The menace actor recognized as Sharp Panda has been noticed focusing on Southeast Asian authorities entities with a toolset initial found out in 2021.

The Look at Point Exploration (CPR) crew explained the new campaign in an advisory posted previously today. Even though the campaign observed in 2021 applied a personalized backdoor termed VictoryDll, the most up-to-date a single noticed by the crew leverages a new model of the SoulSearcher loader and the Soul modular framework.

“Although samples of this framework from 2017–2021 were being formerly analyzed, this report is the most extensive search however at the Soul malware family members infection chain, such as a full complex evaluation of the most up-to-date variation, compiled in late 2022,” CPR wrote.

In accordance to the advisory, the analyzed sample confirmed similarities with earlier Sharp Panda campaigns, which includes the reality that the C&C servers of the attackers are geofenced and return payloads only to requests from the IP addresses of the international locations where by targets are situated.

Even more, the loader employed for first access features data accumulating capabilities, capturing hostnames, OS names and variations, program varieties (32/64 little bit), usernames, MAC addresses of networking adapters and data on antivirus remedies.

“If the risk actors find the victim’s machine to be a promising focus on, the reaction from the server incorporates the next phase executable in encrypted type and its MD5 checksum. Right after verifying the integrity of the been given information, the downloader loads the decrypted DLL to memory and commences its execution,” reads the advisory.

The next-stage SoulSearcher loader is installed, which subsequently executes the Soul backdoor key module and parses its configuration.

“The Soul most important module is responsible for speaking with the C&C server, and its major goal is to receive and load in memory further modules,” CPR states. “Interestingly, the backdoor configuration incorporates a ‘radio silence’-like characteristic, where by the actors can specify specific hrs in a 7 days when the backdoor is not allowed to converse with the C&C server.”

Talking about the module, the CPR staff included that, while the Soul framework has been made use of given that at minimum 2017, the danger actors at the rear of it have repeatedly been updating and refining it.

“Based on the complex results presented in our exploration, we think this marketing campaign is staged by advanced Chinese-backed danger actors, whose other resources, capabilities and place within the broader network of espionage functions are nevertheless to be explored.”

The CPR advisory arrives a pair of months following a individual Chinese APT recognised as Vixen Panda was joined to attacks targeting the Iranian government.

Some parts of this report are sourced from:
www.infosecurity-magazine.com