The APT group targeted an international NGO present in China through the MgBot backdoor used for cyber espionage activities
Researchers of ESET, a global European leader in the cybersecurity market, have discovered a campaign conducted by the APT Evasive Panda group, in which the update channels of legitimate Chinese applications were altered to also distribute the installer of the MgBot malware, Evasive Panda's flagship cyberespionage backdoor. At the center of the operation, which according to ESET telemetry began in 2020, were Chinese members of an international non-governmental organization (NGO). The targeted users were located in Gansu, Guangdong and Jiangsu provinces.
In January 2022, ESET Research discovered that during an update, a legitimate Chinese application had been compromised with an installer of the Evasive Panda backdoor, called MgBot, as happened in 2020 with several other legitimate applications developed by Chinese companies.
"Evasive Panda uses the MgBot backdoor which has seen little evolution since its discovery in 2014. As far as we know, the backdoor has not been used by any other group. Therefore, we consider this activity attributable to Evasive Panda," he says Facundo Muñoz, richercer of ESET who discovered this latest campaign. “During our investigation, we found that when performing automatic updates, several legitimate application software components also downloaded MgBot backdoor installers from legitimate URLs and IP addresses,” explains Muñoz.
ESET researchers hypothesized that installers were distributed either through supply-chain compromise or adversary-in-the-middle (AitM) attacks to distribute the malware.
"Given the targeted nature of the attacks, it is hypothesized that the attackers had to compromise the update servers of QQ (popular instant messaging program in Chinese) to introduce a mechanism for identifying target users in order to distribute the malware only to them, filtering out users not deemed of interest and distributing legitimate updates to them. This is because we have recorded cases in which legitimate updates were downloaded through the same compromised protocols," explains Muñoz. “On the other hand, AitM approaches to interception would be possible if attackers were able to compromise vulnerable devices such as routers or gateways and if they had access to the ISP infrastructure.”
MgBot's modular architecture allows it to extend its functionality by receiving and deploying modules on the compromised machine. The backdoor's features include logging keystrokes, stealing files, credentials and content from Tencent's QQ and WeChat messaging apps, and capturing audio streams and text copied to the clipboard.
Evasive Panda (also known as BRONZE HIGHLAND and Daggerfly) is a Chinese-speaking APT group that has been active since at least 2012. ESET Research has observed the group conducting cyberespionage against individuals in mainland China, Hong Kong, Macau, and Nigeria. A victim of this campaign was verified to be located in Nigeria and was compromised through NetEase's Chinese Mail Master software.
For more technical information on the latest Evasive Panda campaign, see the article “Evasive Panda APT group delivers malware via updates for popular Chinese software” su WeLiveSecurity.
