A well-known Chinese state-sponsored threat actor has been seen using a brand new remote access trojan (RAT) in its espionage campaigns against companies around the world. Cybersecurity researchers from Unit 42, Palo Alto Networks’ cybersecurity arm, published a report recently, saying that Gallium, as the threat actor is known, is using malware (opens in new tab) called PingPull.
PingPull is a “difficult-to-detect” backdoor that communicates with its command & control (C2) server via Internet Control Message Protocol (ICMP), which is not that common. It’s built on C++, and allows threat actors to run arbitrary commands on the compromised endpoint (opens in new tab).
"PingPull samples that use ICMP for C2 communications issue ICMP Echo Request (ping) packets to the C2 server," the report states. "The C2 server will reply to these Echo requests with an Echo Reply packet to issue commands to the system."
Share your thoughts on Cybersecurity and get a free copy of the Hacker's Manual 2022 (opens in new tab). Help us find how businesses are preparing for the post-Covid world and the implications of these activities on their cybersecurity plans. Enter your email at the end of this survey (opens in new tab) to get the bookazine, worth $10.99/£10.99.
Unit 42 also found versions of PingPull that communicate via HTTPS and TCP, as well as more than 170 IP addresses (opens in new tab) that can be associated with Gallium.
The state-sponsored threat actor was first spotted a decade ago, after which it was being linked with the attacks on five major telecommunications companies in southeast Asia, the publication says. Gallium was also observed attacking businesses in Europe, as well as Africa. Cybereason also calls it Soft Cell.
> Cyberattacks draining telecoms’ resources (opens in new tab)
> UK internet phone providers hit by major cyberattacks (opens in new tab)
> Cyberattacks on businesses saw a huge rise in 2021 (opens in new tab)
The jury is still out on how the group managed to compromise the target networks, with the media speculating it didn’t deviate much from its usual methodology of exploiting internet-exposed applications. It would then use these apps to deploy viruses (opens in new tab), or the China Chopper web shell.
"Gallium remains an active threat to telecommunications, finance, and government organizations across Southeast Asia, Europe, and Africa," the researchers added. "While the use of ICMP tunneling is not a new technique, PingPull uses ICMP to make it more difficult to detect its C2 communications, as few organizations implement inspection of ICMP traffic on their networks."
Via: Hacker News (opens in new tab)