Chinese Hackers Caught Exploiting Popular Antivirus Products to Target Telecom Sector

A Chinese-aligned cyberespionage group has been observed
striking the telecommunication sector in Central Asia with versions
of malware such as ShadowPad and PlugX.

Cybersecurity firm SentinelOne tied the intrusions to an actor
it tracks under the name “Moshen Dragon,” with tactical overlaps
between the collective and another threat group referred to as
Nomad Panda (aka RedFoxtrot^[1]).

“PlugX and ShadowPad have a well-established history of use
among Chinese-speaking threat actors primarily for espionage
activity,” SentinelOne’s Joey Chen said^[2]. “Those tools have
flexible, modular functionality and are compiled via shellcode to
easily bypass traditional endpoint protection products.”

ShadowPad^[3], labeled a “masterpiece
of privately sold malware in Chinese espionage,” emerged as a
successor to PlugX in 2015, even as variants of the latter have
continually popped up as part of different campaigns associated
with Chinese threat actors.

Although known to be deployed by the government-sponsored
hacking group dubbed Bronze Atlas (aka APT41^[4], Barium, or Winnti)
since at least 2017, an ever-increasing number of other
China-linked threat actors have joined the fray.

Earlier this year, Secureworks attributed^[5]
distinct ShadowPad activity clusters to Chinese nation-state groups
that operate in alignment with the Chinese Ministry of State
Security (MSS) civilian intelligence agency and the People’s
Liberation Army (PLA).

The latest findings from SentinelOne dovetails with a previous report^[6]
from Trellix in late March that revealed a RedFoxtrot attack
campaign targeting telecom and defense sectors in South Asia with a
new variant of PlugX malware named Talisman^[7].

Moshen Dragon’s TTPs involve the abuse of legitimate antivirus
software belonging to BitDefender, Kaspersky, McAfee, Symantec, and
Trend Micro to sideload ShadowPad and Talisman on compromised
systems by means of a technique called DLL search order hijacking^[8].

In the subsequent step, the hijacked DLL is used to decrypt and
load the final ShadowPad or PlugX payload that resides in the same
folder as that of the antivirus executable. Persistence is achieved
by either creating a scheduled task or a service.

The hijacking of security products notwithstanding, other
tactics adopted by the group include the use of known hacking tools
and red team scripts to facilitate credential theft, lateral
movement and data exfiltration. The initial access vector remains
unclear as yet.

“Once the attackers have established a foothold in an
organization, they proceed with lateral movement by leveraging
Impacket within the network, placing a passive backdoor into the
victim environment, harvesting as many credentials as possible to
insure unlimited access, and focusing on data exfiltration,” Chen
said.