New Malware Uncovered Linked to Chinese Cybercriminals Targeting Southeast Asian Gaming Sector
May 10, 2013
Recent findings by researchers at Trend Micro reveal a sophisticated form of malware associated with the Winnti group, a well-known Chinese cybercriminal organization. This backdoor malware primarily targets organizations within the Southeast Asian video gaming industry, utilizing tactics designed to exploit vulnerabilities in legitimate software.
The malware, identified as “Bkdr_Tengo.A,” masquerades as the system DLL file “winmm.dll.” According to Trend Micro’s Eduardo Altares, the malware is embedded within a legitimate tool known as Aheadlib, which is commonly used for system analysis. This clever disguise allows the attackers to infiltrate user systems more easily, maintaining a guise of legitimacy.
Notably, the backdoor is unencrypted and its analysis reveals a concerning functionality: it is designed to steal sensitive files, specifically those associated with Microsoft Office, as well as .PDF and .TIFF formats. These stolen files are surreptitiously stored in a folder called $NtUninstallKB080515$ within the Windows directory. Additionally, a log file named Usblog_DXM.log is created, which likely tracks the stolen data or the infection process.
This breach has raised alarms regarding the tactics employed by the Winnti group. The attack likely involved several phases, as described in the MITRE ATT&CK framework, particularly in relation to initial access and persistence. The use of a legitimate analysis tool for infiltration points to a strategic method of exploiting existing trust in software, showcasing the attackers’ sophisticated approach to gaining control over user systems.
Business owners, particularly in the technology and gaming sectors, should exercise heightened vigilance in their cybersecurity measures. The ability of attackers to camouflage malware within trusted applications underscores the necessity for robust security protocols and regular system audits. As this situation continues to unfold, it is imperative for organizations to remain informed and proactive in addressing potential vulnerabilities that could leave them exposed to similar attacks.
The emergence of this new malware variant illustrates the ongoing and evolving threat landscape in cybersecurity, with state-sponsored actors employing advanced techniques to achieve their objectives. As such, an enhanced understanding of these tactics and preemptive action against possible exploits are crucial for safeguarding sensitive information and maintaining operational integrity.