Chinese government-backed threat actor DEV-0147 has been spotted targeting South American diplomatic organizations using the ShadowPad remote access Trojan (RAT), also known as PoisonPlug.
Microsoft shared its findings on Twitter On Monday, it said the threat actor’s new campaign represented a notable expansion of the group’s data exfiltration operations, which previously targeted government agencies and think tanks in Asia and Europe.
From a technical perspective, the tech giant believes that DEV-0147 deployed ShadowPad, a RAT associated with other China-based actors to achieve persistence, and QuasarLoader, a Webpack loader. and confirmed that it would download and run additional malware.
“The DEV-0147 attack in South America involved exploiting on-premises identity infrastructure for reconnaissance and lateral movement, cobalt strike For command and control and data exfiltration,” read one of the Twitter posts.
“Microsoft 365 Defender detects these DEV-0147 attacks through Microsoft Defender for Identity and Defender for Endpoint. Enforcement is also strongly recommended for organizations. [multi-factor authentication] MFA. “
DEV-0147 isn’t the only actor using ShadowPad in China recently.a Advisory for June 2022 Research by Kaspersky has confirmed that Chinese attackers are using malware to target unpatched Microsoft Exchange servers in various Asian countries.
According to a security researcher at secure worksShadowPad evolved from PlugX malwareIt is frequently used by Chinese hostile groups associated with the Ministry of State Security (MSS) and the People’s Liberation Army (PLA).
“Available evidence at the time of this publication suggests that ShadowPad was deployed by MSS-related threat groups, as well as PLA-related threat groups operating on behalf of regional Theater Commands,” it reads. Secureworks Advisory From February 2022.
“This malware was likely developed by a threat actor belonging to BRONZE ATLAS and was subsequently shared with MSS and PLA threat groups around 2019. Any organization likely to be targeted by threat groups should be monitored. [tactics, techniques and procedures] TTPs associated with this malware. ”
