Another Chinese Hacking Group Spotted Targeting Ukraine Amid Russia Invasion

A Chinese-speaking threat actor called Scarab has been
linked to a custom backdoor dubbed HeaderTip as part of a
campaign targeting Ukraine since Russia embarked on an invasion
last month, making it the second China-based hacking group after
Mustang Panda^[1]
to capitalize on the conflict.

“The malicious activity represents one of the first public
examples of a Chinese threat actor targeting Ukraine since the
invasion began,” SentinelOne researcher Tom Hegel said^[2]
in a report published this week.

SentinelOne’s analysis follows an advisory from Ukraine’s
Computer Emergency Response Team (CERT-UA) earlier this week
outlining^[3]
a spear-phishing campaign that leads to the delivery of a RAR
archive file, which comes with an executable that’s designed to
open a decoy file while stealthily dropping a malicious DLL called
HeaderTip in the background.

Scarab was first documented^[4]
by the Symantec Threat Hunter Team, part of Broadcom Software, in
January 2015, when it detailed highly targeted attacks against
Russian-speaking individuals since at least January 2012 to deploy
a backdoor called Scieron.

“If the attackers successfully compromise the victims’
computers, then they use a basic backdoor threat called
Trojan.Scieron to drop Trojan.Scieron.B onto the computer,”
Symantec researchers noted at the time. “Trojan.Scieron.B has a
rootkit-like component that hides some of its network activity and
features more enhanced back door functionality.”

HeaderTip’s connections to Scarab come from malware and
infrastructure overlaps to that of Scieron, with SentinelOne
calling the latter a predecessor of the newly discovered backdoor.
Designed as a 32-bit DLL file and written in C++, HeaderTip is 9.7
KB in size and its functionality is limited to acting as a
first-stage package for fetching next-stage modules from a remote
server.

“Based on known targets since 2020, including those against
Ukraine in March 2022, in addition to specific language use, we
assess with moderate confidence that Scarab is Chinese speaking and
operating under geopolitical intelligence collection purposes,”
Hegel said.