Connect with us

Hi, what are you looking for?



Hackers Attack Shipping and Logistics Firms Using Malware-Laden Handheld Scanners

Hackers Infect Handscanner With Malware

China-based threat actors are using sophisticated malware installed on handheld scanners to target shipping and logistics organizations from all over the world.

Hackers Infect Handscanner With Malware

China-based threat actors are using sophisticated malware installed on handheld scanners to target shipping and logistics organizations from all over the world.

The attack, dubbed “Zombie Zero,” has been analyzed by cybersecurity solutions provider TrapX, a company formerly known as CyberSense. According to TrapX, the attack begins at a Chinese company that provides hardware and software for handheld scanners used by shipping and logistics firms worldwide to inventory the items they’re handling.

The Chinese manufacturer installs the malware on the Windows XP operating systems embedded in the devices. Additionally, the threat is also distributed via the company’s support website, the security firm noted in its report (PDF).

The scanners transmit the data they collect (origin, destination, value, contents, etc.) via the customer’s wireless network. Once the customer starts using the device, the malware immediately sends this information back to a command and control (C&C) server located in China.

Interestingly, the C&C is located at the Lanxiang Vocational School, an educational institution said to be involved in the Operation Aurora attacks against Google, and which is physically located only one block away from the scanner manufacturer, TrapX said.

The malware used by the Zombie Zero attackers is highly sophisticated and polymorphic, the researchers said. In one attack they observed, 16 of the 48 scanners used by the victim were infected, and the malware managed to penetrate the targeted organization’s defenses and gain access to servers on the corporate network. The companies that use the scanners install security certificates for network authentication, but the certificates are compromised because the malware is already present on the device.

“By compromising cryptographic keys and digital certificates, Zombie Zero attackers obtained trusted, authenticated status on their victim’s network,” Kevin Bocek, vice president of security strategy and threat intelligence at Venafi, told SecurityWeek. “We are seeing this time and time again with APT1, Careto/Mask, and now Zombie Zero. The rising tide in circumventing keys and certificates will only increase as more sophisticated evasion and takeover techniques are required as all businesses and governments wake up to the fact they are being targeted and are already breached.”

Advertisement. Scroll to continue reading.

Experts determined that the threat group targets servers storing corporate financial data, customer data and other sensitive information. A second payload downloaded by the malware then establishes a sophisticated C&C on the company’s finance servers, enabling the attackers to exfiltrate the information they’re after.

While this operation appears to be focusing on the shipping and logistics industry, TrapX says the malware has also been delivered to organizations in the manufacturing sector.

“The reality is that pre-installed malware exists. Some of it is installed because a vendor’s code base is compromised. Some of it is installed because of sloppy or incomplete security practices. Some is installed in firmware by either companies who are specifically targeting other corporate information, or because the company is supporting nation-state directives,” Jon Heimerl, senior security strategist at Solutionary, told SecurityWeek.

“The threat of pre-installed malware is, unfortunately, hard to detect. The best way to see it is probably through rigorous testing of hardware before it goes into a production environment, in an attempt to identify and isolate any hostile activity in a test bed. There are organizations that do an excellent job of creating a test bed that pretty much simulates their production environment, but this is relatively rare,” Heimerl added.

“The next best option is solid, real-time monitoring that may be able to detect the malware as it is activated, allowing the infected organization to take rapid mitigating actions,” he said. “Additionally, organizations can take care to use reliable equipment from well known providers in an attempt to shrink their potential exposure.”

RelatedDon’t Forget to Manage Supply Chain Risk

Related: NIST Publishes Draft of Federal IT Supply Chain Risk Management Guidelines

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

SecurityWeek’s Threat Detection and Incident Response Summit brings together security practitioners from around the world to share war stories on breaches, APT attacks and threat intelligence.


Securityweek’s CISO Forum will address issues and challenges that are top of mind for today’s security leaders and what the future looks like as chief defenders of the enterprise.


Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.


Luxury retailer Neiman Marcus Group informed some customers last week that their online accounts had been breached by hackers.


As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...


Satellite TV giant Dish Network confirmed that a recent outage was the result of a cyberattack and admitted that data was stolen.


Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.

CISO Strategy

SecurityWeek spoke with more than 300 cybersecurity experts to see what is bubbling beneath the surface, and examine how those evolving threats will present...