androidAPT27Breaking NewsChinaCyber espionagehackingintelligencemalwaremobilePierluigi PaganiniRATReportssecurite informatiqueSecurity Affairs

CSE Malware ZLab – Chinese APT27 ’s long-term espionage campaign in Syria is still ongoing

Researchers at CSE Cybsec ZLab analyzed a malicious code involved in a long-term espionage campaign in Syria attributed to Chinese APT27 group.

A few days ago, the security researcher Lukas Stefanko from ESET discovered an open repository containing some Android applications.

APT27 syria

 

The folder was found on a compromised website at the following URL:

hxxp://chatsecurelite.uk[.]to

This website is written in Arabic language and translating its content it seems to offer a secure messaging app. The homepage shows how the application works and includes some slides about it.

Security researchers from CSE Cybsec Z-Lab analyzed the content of the folder and discovered an Android spyware that was developed to exfiltrate sensitive information from victims’ devices.

The malicious code was used to compromise entities in the area, the researchers discovered that it was part or the arsenal of a Chinese APT group tracked as APT27, aka Golden Rat Organization.

The APT27 group focused its activity in Syria in the last couple of years, it used both Windows and Android malware to compromise target devices. Its code was not so sophisticated, anyway, the activity of the group is still ongoing.

Searching online we have found only one team of researchers that tracked the activity of the APT27 group in Syria since 2016, it was a group of researchers at 360 Threat Intelligence Center.

The analysis published by the team revealed the activity of the APT27 in Syria, the code analyzed by malware analysts at Zlab at CSE Cybsec and the one dissected by 360 Threat Intelligence Center is quite identical.

The 360 Threat Intelligence Center is dated 2017, the experts at CSE Cybsec collected evidence that the cyber espionage is still ongoing and that the threat actor continues to improve its malicious code.

Further details on the malware samples analyzed by CSE Cybsec, including the IoCs and Yara Rules are available in the report published by researchers at ZLAb.

You can download the full ZLAB Malware Analysis Report at the following URL:

http://csecybsec.com/download/zlab/20180723_CSE_APT27_Syria_v1.pdf

 


Pierluigi Paganini

(Security Affairs – APT27, Syria)


The post CSE Malware ZLab – Chinese APT27 ’s long-term espionage campaign in Syria is still ongoing appeared first on Security Affairs.