According to the most recent study, an advanced persistent threat (APT) actor known as Budworm targeted a U.S.-based organisation for the first time in more than six years. The gang has recently carried out strikes across continents, including the first reported attacks against the United States in a lot of years.
According to a report by the Symantec Threat Intelligence team, a division of Broadcom Software, the assault was directed at an undisclosed American state legislature.
Other “strategic important” incursions that occurred in the last six months targeted a hospital in South East Asia, a multinational electronics business, and a government of a Middle Eastern nation.
Budworm, also known as APT27, Bronze Union, Emissary Panda, Lucky Mouse, and Red Phoenix is a threat actor that is thought to work for China. Budworm attacks utilises a combination of customized and freely accessible tools to exfiltrate valuable information.
In a description of the nation-state organisation, Secureworks states that Bronze Union “maintains a high degree of operational flexibility in order to adapt to the surroundings it operates in,” highlighting its capacity to “keep access to critical systems for a lengthy period of time.”
HyperBro is a well-known backdoor credited to the antagonistic collective that has been in use since at least 2013 and is still being developed. PlugX, SysUpdate, and the China Chopper web shell are some of its other utilities.
The threat actor used vulnerabilities in Log4Shell in the most recent assaults to compromise servers and install web shells, opening the door for the use of HyperBro, PlugX, Cobalt Strike, and credential dumping tools. The HyperBro malware family, which is frequently loaded through a method known as dynamic-link library (DLL) side-loading, continues to be Budworm’s primary payload. Attackers do this by putting a malicious DLL in a location where a trustworthy DLL should reside. The malicious programme is then used by the attacker (having installed it themselves). The payload is subsequently loaded and run by the genuine application.
The endpoint privilege control programme CyberArk Viewfinity has been side-loaded by Budworm in recent attacks. Attackers frequently rename the programs, which by default is known as vf host.exe, in order to make it appear to be a different file. SecurityHealthService.exe, secu.exe, vfhost.exe, vxhost.exe, vx.exe, and v.exewere among the masked names.
The new information makes Budworm’s connection to an attack on an American target public for the second time. The U.S. government said earlier this month that several nation-state hacking groups broke into a military industry organisation using Microsoft Exchange Server’s ProxyLogon weaknesses to dump China Chopper and HyperBro.
The group’s activities “appears to have been predominantly concentrated on Asia, the Middle East, and Europe in more recent years,” according to the researchers. “A return of assaults against targets in the United States might indicate a shift in the group’s aim.”
Budworm is renowned for undertaking daring assaults against priceless targets. While allegations of Budworm targeting American organisations were common six to eight years ago, the group’s activities seems to have shifted more recently to Asia, the Middle East, and Europe. But this is the second occasion in recent months that Budworm has been connected to assaults on a target in the United States.
Budworm’s toolkit was cited in a recent CISA report on various APT organisations assaulting a defence industry firm. Attacks against targets headquartered in the United States can resume, indicating a shift in the group’s priorities.