Cybersecurity researchers at Trend Micro have discovered a new campaign by Earth Longzhi targeting organizations based in Taiwan, Thailand, the Philippines, and Fiji.
As described in an advisory published Tuesday, the campaign relies on the Windows Defender executable to sideload DLLs while exploiting vulnerable drivers to bring in a vulnerable driver (BYOVD). ) method to disable security products installed on the host machine. .
“We also learned that Earth Longzhi used a new method of disabling security products. This technique is called “stack It’s called rambling. Trend Micro researchers Ted Lee and his Hara Hiroaki explained:
The campaign also observed the attackers installing drivers as kernel-level services via Microsoft Remote Procedure Calls (RPC) instead of leveraging traditional Windows APIs (Application Programming Interfaces).
“This is a clever way to circumvent typical API monitoring. Our research not only identified potential targets for Earth Longzhi, but also several including information on techniques that may be used in future campaigns. We also found some interesting samples.”
During our research, Trend Micro analyzed two separate Earth Longzhi campaigns that took place between 2020 and 2022. Gangs are subgroups of APT41.
More information on APT41 can be found here.
“This follow-up article to our previous report is intended to inform readers that Earth Longzhi continues to circulate and that improved TTPs are to be expected,” the company wrote. “While the samples we collected are similar to test files, they are still useful because they contain information about potential Chikyu Ryuji targets and new technologies that may be employed in the future.”
According to observed files, the team speculated that Chikyuryushi may target Vietnam and Indonesia in future campaigns.
“Notably, this group may be abusing Task Scheduler to elevate privileges and increase persistence. This is a new technique that may be used in future campaigns. said Lee and Hiroaki. “Another notable insight is that attackers tend to use open source projects to implement their own tools.”
The Trend Micro team added that there is evidence to suggest the group is improving its toolset during periods of inactivity.
“With this knowledge in mind, organizations should remain vigilant against the continued development of new stealth schemes by cybercriminals.”
