Chinese Hackers Utilize Golang Malware in DragonSpark Attacks to Evade Detection

Jan 24, 2023Ravie LakshmananCyber Espionage / Golang

Organizations in East Asia are being targeted by a likely
Chinese-speaking actor dubbed DragonSpark while
employing uncommon tactics to go past security layers.

“The attacks are characterized by the use of the little known
open source SparkRAT and malware that attempts to evade detection
through Golang source code interpretation,” SentinelOne said^[1]
in an analysis published today.

A striking aspect of the intrusions is the consistent use of
SparkRAT to conduct a variety of activities, including stealing
information, obtaining control of an infected host, or running
additional PowerShell instructions.

The threat actor’s end goals remain unknown as yet, although
espionage or cybercrime is likely to be the motive. DragonSpark’s
ties to China stem from the use of the China Chopper^[2]
web shell to deploy malware – a widely used attack pathway among
Chinese threat actors.

Furthermore, not only do the open source tools used in the cyber
assaults originate from developers or companies with links to
China, the instructure for staging the payloads are located in
Taiwan, Hong Kong, China, and Singapore, some of which belong to
legitimate businesses.

The command-and-control (C2) servers, on the other hand, are
situated in Hong Kong and the U.S., the cybersecurity firm
said.

Initial access avenues entail compromising internet-exposed web
servers and MySQL database servers to drop the China Chopper web
shell. The foothold is then leveraged to carry out lateral
movement, privilege escalation, and malware deployment using open
source tools like SharpToken^[3], BadPotato^[4], and GotoHTTP^[5].

Also delivered to the hosts are custom malware capable of
executing arbitrary code and SparkRAT^[6], a cross-platform remote
access trojan that can run system commands, manipulate files and
processes, and siphon information of interest.

Another malware of note is the Golang-based m6699.exe, which
interprets at runtime the source code contained within it so as to
fly under the radar and launch a shellcode loader that’s engineered
to contact the C2 server for fetching and executing the next-stage
shellcode.

“Chinese-speaking threat actors are known to frequently use open
source software in malicious campaigns,” the researchers
concluded.

“Since SparkRAT is a multi-platform and feature-rich tool, and
is regularly updated with new features, we estimate that the RAT
will remain attractive to cybercriminals and other threat actors in
the future.”