Security Experts:

Connect with us

Hi, what are you looking for?



Hackers Attack Shipping and Logistics Firms Using Malware-Laden Handheld Scanners

Hackers Infect Handscanner With Malware

China-based threat actors are using sophisticated malware installed on handheld scanners to target shipping and logistics organizations from all over the world.

Hackers Infect Handscanner With Malware

China-based threat actors are using sophisticated malware installed on handheld scanners to target shipping and logistics organizations from all over the world.

The attack, dubbed “Zombie Zero,” has been analyzed by cybersecurity solutions provider TrapX, a company formerly known as CyberSense. According to TrapX, the attack begins at a Chinese company that provides hardware and software for handheld scanners used by shipping and logistics firms worldwide to inventory the items they’re handling.

The Chinese manufacturer installs the malware on the Windows XP operating systems embedded in the devices. Additionally, the threat is also distributed via the company’s support website, the security firm noted in its report (PDF).

The scanners transmit the data they collect (origin, destination, value, contents, etc.) via the customer’s wireless network. Once the customer starts using the device, the malware immediately sends this information back to a command and control (C&C) server located in China.

Interestingly, the C&C is located at the Lanxiang Vocational School, an educational institution said to be involved in the Operation Aurora attacks against Google, and which is physically located only one block away from the scanner manufacturer, TrapX said.

The malware used by the Zombie Zero attackers is highly sophisticated and polymorphic, the researchers said. In one attack they observed, 16 of the 48 scanners used by the victim were infected, and the malware managed to penetrate the targeted organization’s defenses and gain access to servers on the corporate network. The companies that use the scanners install security certificates for network authentication, but the certificates are compromised because the malware is already present on the device.

“By compromising cryptographic keys and digital certificates, Zombie Zero attackers obtained trusted, authenticated status on their victim’s network,” Kevin Bocek, vice president of security strategy and threat intelligence at Venafi, told SecurityWeek. “We are seeing this time and time again with APT1, Careto/Mask, and now Zombie Zero. The rising tide in circumventing keys and certificates will only increase as more sophisticated evasion and takeover techniques are required as all businesses and governments wake up to the fact they are being targeted and are already breached.”

Experts determined that the threat group targets servers storing corporate financial data, customer data and other sensitive information. A second payload downloaded by the malware then establishes a sophisticated C&C on the company’s finance servers, enabling the attackers to exfiltrate the information they’re after.

While this operation appears to be focusing on the shipping and logistics industry, TrapX says the malware has also been delivered to organizations in the manufacturing sector.

“The reality is that pre-installed malware exists. Some of it is installed because a vendor’s code base is compromised. Some of it is installed because of sloppy or incomplete security practices. Some is installed in firmware by either companies who are specifically targeting other corporate information, or because the company is supporting nation-state directives,” Jon Heimerl, senior security strategist at Solutionary, told SecurityWeek.

“The threat of pre-installed malware is, unfortunately, hard to detect. The best way to see it is probably through rigorous testing of hardware before it goes into a production environment, in an attempt to identify and isolate any hostile activity in a test bed. There are organizations that do an excellent job of creating a test bed that pretty much simulates their production environment, but this is relatively rare,” Heimerl added.

“The next best option is solid, real-time monitoring that may be able to detect the malware as it is activated, allowing the infected organization to take rapid mitigating actions,” he said. “Additionally, organizations can take care to use reliable equipment from well known providers in an attempt to shrink their potential exposure.”

RelatedDon’t Forget to Manage Supply Chain Risk

Related: NIST Publishes Draft of Federal IT Supply Chain Risk Management Guidelines

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.


Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.

Data Breaches

GoTo said an unidentified threat actor stole encrypted backups and an encryption key for a portion of that data during a 2022 breach.


The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.

CISO Strategy

Cybersecurity-related risk is a top concern, so boards need to know they have the proper oversight in place. Even as first-timers, successful CISOs make...

Malware & Threats

Microsoft plans to improve the protection of Office users by blocking XLL add-ins from the internet.


Artificial intelligence is competing in another endeavor once limited to humans — creating propaganda and disinformation.


Video games developer Riot Games says source code was stolen from its development environment in a ransomware attack