New Flagpro malware linked to Chinese state-backed hackers | Usa science news

 The cyber espionage group APT (Advanced Persistent Threat) Blackwell has been targeting Japanese companies with a new type of malware that researchers call “Flag pro”. Second level malware and run it. 

Breaching corporate networks

The chain of infection begins with a phishing e-mail that was developed for the target organization and pretends to be a message from a trusted partner.

 The e-mail contains a password-protected ZIP or RAR attachment with a Microsoft Excel file [.XLSM] linked to a malicious macro. Running this code creates an executable file in the Flag pro home directory. 

When it first runs, Flagpro connects to the C2 server over HTTP and sends the system identification details obtained by executing hard-coded operating system commands. 

In response, the C2 can send additional commands or a second-level payload that Flag pro can execute. 

An example of a sent command Source: NTT Security

Communication between the two is base64 encoded, and there is also a configurable delay between connections to avoid creating an identifiable operating model.

Communication between Flagpro and the C2 Source: NTT Security

 Flagpro has been used against Japanese companies for more than a year, at the latest since October 2020, according to a report by NTT Security. 

The most recent samples the researchers were …read more

Source:: TechCrunch

(Visited 2 times, 2 visits today)
NASA Chooses Spacex To Launch A Self Propelled Space Station To The Moon

This content was originally published here.

Laat een reactie achter

Het e-mailadres wordt niet gepubliceerd.