Privacy Ninja

New Flagpro Malware Linked to Chinese State-backed Hackers

New Flagpro Malware Linked to Chinese State-backed Hackers

BlackTech cyber-espionage APT (advanced persistent threat) group has been spotted targeting Japanese companies using novel malware that researchers call ‘Flagpro’.

The threat actor uses Flagpro in the initial stage of an attack for network reconnaissance, to evaluate the target’s environment, and to download second-stage malware and execute it.

Breaching corporate networks

The infection chain begins with a phishing email crafted for the target organization, pretending to be a message from a trustworthy partner.

Also Read: The 3 Main Benefits Of PDPA For Your Business

The email carries a password-protected ZIP or RAR attachment that contains a Microsoft Excel file (.XLSM) laced with a malicious macro. Running this code creates an executable in the startup directory, the Flagpro.

On its first execution, Flagpro connects to the C2 server via HTTP and sends system ID details obtained by running hardcoded OS commands.

In response, the C2 can send back additional commands or a second-stage payload that Flagpro can execute.

An example of a sent command
An example of a sent command
Source: NTT Security

The communication between the two is encoded with Base64, and there’s also a configurable time delay between connections to avoid creating a pattern of identifiable operations.

Communication between Flagpro and the C2
Communication between Flagpro and the C2
Source: NTT Security

According to a report by NTT Security, Flagpro has been deployed against Japanese firms for more than a year, since at least October 2020. The most recent sample the researchers could retrieve is from July 2021.

The targeted entities are from various sectors, including defense technologies, media, and communications.

Also Read: What Do 4 Messaging Apps Get From You? Read The iOS Privacy App Labels

Flagpro v2.0

At some point in their analysis, NTT researchers noticed a new version of Flagpro, which can automatically close dialogs relevant to establishing external connections that could reveal its presence to the victim.

“In the implementation of Flagpro v1.0, if a dialog titled “Windows セキュリティ” is displayed when Flagpro accesses to an external site, Flagpro automatically clicks OK button to close the dialog,” explains the NTT Security report.

“This handling also works when the dialog is written in Chinese or English. It indicates the targets are in Japan, Taiwan, and English-speaking countries.”

Inserted code serving as obfuscation in Flagpro v2.0
Inserted code serving as obfuscation in Flagpro v2.0
Source: NTT Security

Likely a Chinese actor

BlackTech APT is a lesser-known actor that TrendMicro researchers first spotted in the summer of 2017 and is associated with China.

Its typical targets are in Taiwan, although it occasionally attacked companies in Japan and Hong Kong to steal technology.

In February 2021, a Unit 42 report connected BlackTech to WaterBear; another cyber-espionage group believed to be backed by the Chinese government.

As an APT, BlackTech possesses the knowledge and sophistication to adjust its tools to new reports like this one, so Flagpro will likely now be modified for stealthier deployment.

As the NTT report concludes: “Recently, they (BlackTech) have started using other new malware called “SelfMake Loader” and “Spider RAT”. It means that they are actively developing new malware.”

Defenders need to take note of the new indicators of compromise related to the new malware and follow all best security practices to maintain strong defenses against sophisticated threats like BlackTech.

Outsourced Data Protection Officer – It is mandatory to appoint a Data Protection Officer. We help our clients quickly comply with their PDPA & data protection requirements.

Vulnerability Assessment Penetration Testing – Find loopholes in your websites, mobile apps or systems.

Smart Contract Audit – Leverage our industry-leading suite of blockchain security analysis tools, combined with hands-on review from our veteran smart contract auditors.

0 Comments

Leave a Reply

Your email address will not be published. Required fields are marked *

KEEP IN TOUCH

Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection

REPORTING DATA BREACH TO PDPC?

We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.
×

Powered by WhatsApp Chat

× Chat with us