Push Admin

Firm uncovers Chinese 'wide-scale' malware campaign vs Filipino internet users, gov't

Article (news)

ABS-CBN News

MANILA — Cybersecurity experts have uncovered a &quot;rare, wide-scale&quot; advanced persistent threat (APT) drive by Chinese &quot;actors&quot; against internet users in Southeast Asia, particularly in the Philippines.Cybersecurity firm Kaspersky, in its report released Wednesday, said it identified 100 victims in Myanmar and 1,400 in the Philippines, including government entities, that have fallen prey to spear-phishing emails containing malicious Word documents.According to Kaspersky, after users download the malicious file on one system, malware can spread to other hosts through removable USB drivesThe firm said APT campaigns usually target a few dozen users, but the recent discovery of such threats in Southeast Asia was extraordinary.&quot;This cluster of activity — dubbed LuminousMoth — has been conducting cyberespionage attacks against government entities since at least October 2020. While initially focusing their attention on Myanmar, the attackers have since shifted their focus to the Philippines,&quot; Kaspersky said.According to Aseel Kayal, a researcher of the Global Research and Analysis Team Security group, the shift of focus could be due to use of USB drives as spreading tools, or an infection vector that &quot;we’re not yet aware of being used in the Philippines.&quot;Kaspersky noted attackers usually use spear-phishing emails to &quot;gain an initial foothold in the system.&quot;&quot;Once clicked, this link downloads a RAR archive disguised as a Word document that contains the malicious payload,&quot; it said.The LuminousMoth then will try to infect other hosts through removable USB drives or other portable drives.&quot;If a drive is found, the malware creates hidden directories on the drive, where it then moves all of the victim’s files, along with the malicious executables,&quot; it said.The cyber infection uses a bogus version of Zoom and another steals cookies from the Chrome browser before the malware withdraws data to the command and control (C2) server, the firm explained.&quot;For the targets in Myanmar, these C2 servers were often domains that impersonated known news outlets,&quot; Kaspersky said.Its experts pinned the malicious activity on a group called &quot;HoneyMyte&quot;, which the firm said was a &quot;well-known, long-standing, Chinese-speaking threat actor, with medium to high confidence.&quot;&quot;HoneyMyte is primarily interested in gathering geopolitical and economic intelligence in Asia and Africa,&quot; Kaspersky said.Mark Lechtik, senior security researcher with the Global Research and Analysis Team, said the recent APT discovery in Southeast Asia points to a trend of Chinese hackers producing new and unknown malware.“We’re seeing increased activity by Chinese-speaking threat actors this past year, and this most likely won’t be the last of LuminousMoth. In addition, there’s a high chance the group will begin to further sharpen its toolset. We’ll be keeping an eye out for any future developments,” said Paul Rascagneres, a GReAT senior security researcher.<ul class="op-related-articles">	<li><a href="https://news.abs-cbn.com/business/03/03/21/microsoft-says-chinese-hackers-targeted-groups-via-server-software">Microsoft says Chinese hackers targeted groups via server software</a></li></ul>Last month, the Philippine Institute of Cyber Security Professionals (PICSPro) urged government to train new cybersecurity experts and upskill current practitioners as threats escalate and expertise remains &quot;disproportionately inadequate.&quot;Costs of ransomware attacks on Philippine firms have risen by 42 percent compared to 30 percent last year, PICSPro said, citing a UK-based study.<ul class="op-related-articles">	<li><a href="https://news.abs-cbn.com/business/06/07/21/philippines-hone-upskill-cybersecurity-experts">Philippines urged to hone, upskill cybersecurity experts</a></li></ul><div>RELATED VIDEO</div><figure class="op-interactive"><iframe allow="autoplay; fullscreen" frameBorder="0" height="100%" id="ivsplayer01" scrolling="no" src="https://player.ivideosmart.com/ivsplayer/v4/dist/html/iframe-src.html?iframeid=ivsplayer01&amp;key=e8c22c015ca9eafa76f1e3edfa03c603&amp;spid=3001339&amp;vid=1696767" width="100%"></iframe></figure><div class="iwantbar">Watch more in <a href="//www.iwantv.com.ph/">iWantv</a> or <a href="//tfc.tv/">TFC.tv</a></div>

MANILA — Cybersecurity experts have uncovered a "rare, wide-scale" advanced persistent threat (APT) drive by Chinese "actors" against internet users in Southeast Asia, particularly in the Philippines.

MANILA — Cybersecurity experts have uncovered a "rare, wide-scale" advanced persistent threat (APT) drive by Chinese "actors" against internet users in Southeast Asia, particularly in the Philippines.