China-based threat actors are using sophisticated malware installed on handheld scanners to target shipping and logistics organizations from all over the world.
The attack, dubbed “Zombie Zero,” has been analyzed by cybersecurity solutions provider TrapX, a company formerly known as CyberSense. According to TrapX, the attack begins at a Chinese company that provides hardware and software for handheld scanners used by shipping and logistics firms worldwide to inventory the items they’re handling.
The Chinese manufacturer installs the malware on the Windows XP operating systems embedded in the devices. Additionally, the threat is also distributed via the company’s support website, the security firm noted in its report (PDF).
The scanners transmit the data they collect (origin, destination, value, contents, etc.) via the customer’s wireless network. Once the customer starts using the device, the malware immediately sends this information back to a command and control (C&C) server located in China.
Interestingly, the C&C is located at the Lanxiang Vocational School, an educational institution said to be involved in the Operation Aurora attacks against Google, and which is physically located only one block away from the scanner manufacturer, TrapX said.
The malware used by the Zombie Zero attackers is highly sophisticated and polymorphic, the researchers said. In one attack they observed, 16 of the 48 scanners used by the victim were infected, and the malware managed to penetrate the targeted organization’s defenses and gain access to servers on the corporate network. The companies that use the scanners install security certificates for network authentication, but the certificates are compromised because the malware is already present on the device.
“By compromising cryptographic keys and digital certificates, Zombie Zero attackers obtained trusted, authenticated status on their victim’s network,” Kevin Bocek, vice president of security strategy and threat intelligence at Venafi, told SecurityWeek. “We are seeing this time and time again with APT1, Careto/Mask, and now Zombie Zero. The rising tide in circumventing keys and certificates will only increase as more sophisticated evasion and takeover techniques are required as all businesses and governments wake up to the fact they are being targeted and are already breached.”
Experts determined that the threat group targets servers storing corporate financial data, customer data and other sensitive information. A second payload downloaded by the malware then establishes a sophisticated C&C on the company’s finance servers, enabling the attackers to exfiltrate the information they’re after.
While this operation appears to be focusing on the shipping and logistics industry, TrapX says the malware has also been delivered to organizations in the manufacturing sector.
“The reality is that pre-installed malware exists. Some of it is installed because a vendor’s code base is compromised. Some of it is installed because of sloppy or incomplete security practices. Some is installed in firmware by either companies who are specifically targeting other corporate information, or because the company is supporting nation-state directives,” Jon Heimerl, senior security strategist at Solutionary, told SecurityWeek.
“The threat of pre-installed malware is, unfortunately, hard to detect. The best way to see it is probably through rigorous testing of hardware before it goes into a production environment, in an attempt to identify and isolate any hostile activity in a test bed. There are organizations that do an excellent job of creating a test bed that pretty much simulates their production environment, but this is relatively rare,” Heimerl added.
“The next best option is solid, real-time monitoring that may be able to detect the malware as it is activated, allowing the infected organization to take rapid mitigating actions,” he said. “Additionally, organizations can take care to use reliable equipment from well known providers in an attempt to shrink their potential exposure.”
Related: Don’t Forget to Manage Supply Chain Risk
Related: NIST Publishes Draft of Federal IT Supply Chain Risk Management Guidelines