A cyber-espionage group believed to be sponsored by the Chinese government has been observed targeting military organizations in Southeast Asia in attacks involving previously undocumented malware, Bitdefender reported on Wednesday.
Linked to the Chinese People’s Liberation Army (PLA) over half a decade ago, the advanced persistent threat (APT) was revealed last year to have conducted a five-year stealth campaign against targets in Australia, Indonesia, the Philippines, Vietnam, Thailand, Myanmar, and Brunei. The group has been known to focus on government and military organizations.
Although reports on Naikon’s activity were so far published only in 2015 and 2020, the persistent APT has been quietly operational for at least a decade, making changes to its infrastructure and toolset to ensure it can stay under the radar.
Last year, after its activity was exposed, Naikon made a similar move: it switched to a new backdoor, although it continued to use previously known malware for the first stages of attack. The group has also been abusing legitimate software for nefarious purposes.
The latest campaign ran between June 2019 and March 2021, and one of the new backdoors, dubbed RainyDay, was first used in attacks in September 2020, Bitdefender says. To remain undetected, the APT would mimic legitimate software running on the infected machines. The purpose of the attacks remains espionage and data exfiltration, and the group continues to focus on Southeast Asian targets.
The RainyDay backdoor allows the attackers to perform reconnaissance on the infected machines, deploy reverse proxies, install scanners, execute tools for password dumping, move laterally on the vict ..
Support the originator by clicking the read the rest link below.