Chinese language Hackers Noticed Utilizing Linux Variant of PingPull in Focused Cyberattacks

Apr 26, 2023Ravie LakshmananLinux / Cyber Menace

The Chinese language nation-state group dubbed Alloy Taurus is utilizing a Linux variant of a backdoor referred to as PingPull in addition to a brand new undocumented instrument codenamed Sword2033.

That is in accordance with findings from Palo Alto Networks Unit 42, which discovered current malicious cyber exercise carried out by the group focusing on South Africa and Nepal.

Alloy Taurus is the constellation-themed moniker assigned to a menace actor that is recognized for its assaults focusing on telecom corporations since at the very least 2012. It is also tracked by Microsoft as Granite Hurricane (beforehand Gallium).

Final month, the adversary was attributed to a marketing campaign referred to as Tainted Love focusing on telecommunication suppliers within the Center East as a part of a broader operation known as Delicate Cell.

Latest cyber espionage assaults mounted by Alloy Taurus have additionally broadened their victimology footprint to incorporate monetary establishments and authorities entities.

PingPull, first documented by Unit 42 in June 2022, is a distant entry trojan that employs the Web Management Message Protocol (ICMP) for command-and-control (C2) communications.

The Linux taste of the malware boasts of comparable functionalities as its Home windows counterpart, permitting it to hold out file operations and run arbitrary instructions by transmitting from the C2 server a single higher case character between A and Okay, and M.

“Upon execution, this pattern is configured to speak with the area yrhsywu2009.zapto[.]org over port 8443 for C2,” Unit 42 stated. “It makes use of a statically linked OpenSSL (OpenSSL 0.9.8e) library to work together with the area over HTTPS.”

Apparently, PingPull’s parsing of the C2 directions mirrors that of the China Chopper, a web shell broadly utilized by Chinese language menace actors, suggesting that the menace actor is repurposing present supply code to plot customized instruments.

A better examination of the aforementioned area has additionally revealed the existence of one other ELF artifact (i.e., Sword2033) that helps three primary features, together with importing and exfiltrating information and executing instructions.

The malware’s hyperlinks to Alloy Taurus stems from the truth that the area resolved to an IP handle that was beforehand recognized as an lively indicator of compromise (IoC) related to a previous marketing campaign focusing on corporations working in Southeast Asia, Europe, and Africa.

The focusing on of South Africa, per the cybersecurity firm, comes towards the backdrop of the nation holding a joint 10-day naval drill with Russia and China earlier this 12 months.

“Alloy Taurus stays an lively menace to telecommunications, finance and authorities organizations throughout Southeast Asia, Europe and Africa,” Unit 42 stated.

“The identification of a Linux variant of PingPull malware, in addition to current use of the Sword2033 backdoor, means that the group continues to evolve their operations in help of their espionage actions.”