chinese espionage deploys new rootkit with

CHINESE ESPIONAGE DEPLOYS NEW ROOTKIT WITH DRIVER

For exfiltration: Earthworm, Termite, and TRAN.For lateral movement: BOUNCER and a customized version of PSExec.For network discovery: HTTP scanner and DCOM scanner.These packets are then stripped of any malware signature, evading security solutions which scan at the network level.Ī rich menu of exploits and tools has been found on targeted hosts in which Moriya has achieved kernel mode and persistence. Rather than proactively polling a command-and-control (C2) server for instructions, which would likely allow it to be detected as malicious, it waits for external communication from the threat actor who sends specially crafted packets directly to the compromised host. Moriya is also notable in its unique method for operating as a passive backdoor. The Moriya rootkit is able to operate in kernel mode and use this extremely low-level access to circumvent the network stack and evade common security monitoring methods focused on network activity.

CHINESE ESPIONAGE DEPLOYS NEW ROOTKIT WITH DRIVER

Rootkits as a tool are very powerful as they are deployed at system code level, usually as a driver file, kernel module, or something with very low-level access.

Operation Tunnelsnake is an ongoing cyber-espionage campaign being perpetrated by an advanced persistent threat (APT), thought to be Chinese-speaking and focused on prominent diplomatic targets in Asia.Īt the heart of the activity is a newly discovered rootkit dubbed Moriya. While the campaign appears thus far to be focused on Asia and Africa, IOCs have been published and should be investigated. A rootkit of unprecedented stealth and evasion has been uncovered while investigating the espionage campaign Operation Tunnelsnake.

Chinese espionage deploys new rootkit with