Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cybercrime

Hackers Attack Shipping and Logistics Firms Using Malware-Laden Handheld Scanners

Hackers Infect Handscanner With Malware

China-based threat actors are using sophisticated malware installed on handheld scanners to target shipping and logistics organizations from all over the world.

Hackers Infect Handscanner With Malware

China-based threat actors are using sophisticated malware installed on handheld scanners to target shipping and logistics organizations from all over the world.

The attack, dubbed “Zombie Zero,” has been analyzed by cybersecurity solutions provider TrapX, a company formerly known as CyberSense. According to TrapX, the attack begins at a Chinese company that provides hardware and software for handheld scanners used by shipping and logistics firms worldwide to inventory the items they’re handling.

The Chinese manufacturer installs the malware on the Windows XP operating systems embedded in the devices. Additionally, the threat is also distributed via the company’s support website, the security firm noted in its report (PDF).

The scanners transmit the data they collect (origin, destination, value, contents, etc.) via the customer’s wireless network. Once the customer starts using the device, the malware immediately sends this information back to a command and control (C&C) server located in China.

Interestingly, the C&C is located at the Lanxiang Vocational School, an educational institution said to be involved in the Operation Aurora attacks against Google, and which is physically located only one block away from the scanner manufacturer, TrapX said.

The malware used by the Zombie Zero attackers is highly sophisticated and polymorphic, the researchers said. In one attack they observed, 16 of the 48 scanners used by the victim were infected, and the malware managed to penetrate the targeted organization’s defenses and gain access to servers on the corporate network. The companies that use the scanners install security certificates for network authentication, but the certificates are compromised because the malware is already present on the device.

“By compromising cryptographic keys and digital certificates, Zombie Zero attackers obtained trusted, authenticated status on their victim’s network,” Kevin Bocek, vice president of security strategy and threat intelligence at Venafi, told SecurityWeek. “We are seeing this time and time again with APT1, Careto/Mask, and now Zombie Zero. The rising tide in circumventing keys and certificates will only increase as more sophisticated evasion and takeover techniques are required as all businesses and governments wake up to the fact they are being targeted and are already breached.”

Experts determined that the threat group targets servers storing corporate financial data, customer data and other sensitive information. A second payload downloaded by the malware then establishes a sophisticated C&C on the company’s finance servers, enabling the attackers to exfiltrate the information they’re after.

Advertisement. Scroll to continue reading.

While this operation appears to be focusing on the shipping and logistics industry, TrapX says the malware has also been delivered to organizations in the manufacturing sector.

“The reality is that pre-installed malware exists. Some of it is installed because a vendor’s code base is compromised. Some of it is installed because of sloppy or incomplete security practices. Some is installed in firmware by either companies who are specifically targeting other corporate information, or because the company is supporting nation-state directives,” Jon Heimerl, senior security strategist at Solutionary, told SecurityWeek.

“The threat of pre-installed malware is, unfortunately, hard to detect. The best way to see it is probably through rigorous testing of hardware before it goes into a production environment, in an attempt to identify and isolate any hostile activity in a test bed. There are organizations that do an excellent job of creating a test bed that pretty much simulates their production environment, but this is relatively rare,” Heimerl added.

“The next best option is solid, real-time monitoring that may be able to detect the malware as it is activated, allowing the infected organization to take rapid mitigating actions,” he said. “Additionally, organizations can take care to use reliable equipment from well known providers in an attempt to shrink their potential exposure.”

RelatedDon’t Forget to Manage Supply Chain Risk

Related: NIST Publishes Draft of Federal IT Supply Chain Risk Management Guidelines

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Learn how the LOtL threat landscape has evolved, why traditional endpoint hardening methods fall short, and how adaptive, user-aware approaches can reduce risk.

Watch Now

Join the summit to explore critical threats to public cloud infrastructure, APIs, and identity systems through discussions, case studies, and insights into emerging technologies like AI and LLMs.

Register

People on the Move

Cloud security startup Upwind has appointed Rinki Sethi as Chief Security Officer.

SAP security firm SecurityBridge announced the appointment of Roman Schubiger as the company’s new CRO.

Cybersecurity training and simulations provider SimSpace has appointed Peter Lee as Chief Executive Officer.

More People On The Move

Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.