chinese espionage group deploys windows systems

#Chinese espionage group deploys windows systems install

Trend Micro noted that the targeted IP addresses in Brazil belong to a commercial VPN service and that the threat actor may have 'used this VPN service to test the deployment of their watering hole attacks.' This involves delivering the malicious script only to those visitors whose IP addresses match specific criteria -Īn IP address subnet located in Shenyang, ChinaĪ specific IP address located in Nagoya, Japan, and The booby-trapped script is said to have been injected into the websites video pages, with the installer ('Codec-AVC1.msi') subsequently employed to load WhiskerSpy.īut the attack also exhibits some clever tricks in an attempt to sidestep detection.

#Chinese espionage group deploys windows systems install

'When a targeted visitor tries to watch videos on the website, a malicious script injected by the attacker displays a message prompt notifying the victims with a video codec error to entice them to download and install a trojanized codec installer,' researchers Joseph C Chen and Jaromir Horejsi said. The compromise was discovered at the end of last year. The cybersecurity company said the website of an unnamed pro-North Korean organization was hacked and modified to distribute the WhiskerSpy implant.

The differentiating factor in the latest attacks is a shift to social engineering to trick users into visiting compromised websites related to North Korea, according to a new report from Trend Micro released last week.

Previously documented intrusions have entailed the use of watering holes that leverage browser exploits in Google Chrome and Internet Explorer to activate the infection chain. The cyber espionage threat actor tracked as Earth Kitsune has been observed deploying a new backdoor called WhiskerSpy as part of a social engineering campaign.Įarth Kitsune, active since at least 2019, is known to primarily target individuals interested in North Korea with self-developed malware such as dneSpy and agfSpy.