Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Malware & Threats

Well-Funded Threat Group Targets Asian Firms

A well-funded and well-organized threat group that focuses its activities on Asian companies has been using Bifrose code to develop its own backdoors, Trend Micro reported on Thursday.

A well-funded and well-organized threat group that focuses its activities on Asian companies has been using Bifrose code to develop its own backdoors, Trend Micro reported on Thursday.

Bifrose, also known as Bifrost, is a piece of malware that has been around since at least September 2008. In September 2014, researchers reported seeing a new version of Bifrose, one that used the Tor network for command and control (C&C) communications, being used in targeted attacks.

In the past, the Bifrose source code was sold on the underground market for as much as $10,000. Researchers at Trend Micro believe a threat actor that has been active since at least 2010 acquired the Bifrose source code and used it to create other backdoors.

“Our research indicates that the group has sufficient financial resources to purchase the source code of a widely available malware tool, and the human resources to design improved versions of its own backdoors based on this,” Trend Micro threats analyst Razor Huang explained.

According to the security firm, the APT actor likely purchased the Bifrose source code, improved its functions, designed a new installation flow, created a new builder, and made its backdoor capabilities simpler and more concise. The result was a new backdoor that became known as Kivars, a threat that is capable of targeting 64-bit systems since mid-2014.

The malware, which has been used by the threat group since 2010, allows attackers to download and upload files, take screenshots, log keystrokes, manipulate active windows, and execute mouse and keyboard actions.

Trend Micro linked Bifrose to Kivars based on several clues, including the format of the initial message sent to the C&C server, and program database (PDB) paths in Kivars containing the string “BR,” likely a reference to Bifrose RAT.

Another backdoor developed by the threat actor based on Bifrose has been dubbed Xbow. The malware, which has been used since mid-2010, contains folder paths that are similar to Bifrose and Kivars, and some variants include functionality that is also present in Bifrose.

Advertisement. Scroll to continue reading.

The operation monitored by Trend Micro, dubbed Shrouded Crossbow, has focused on Asian government contractors, privatized government agencies, and companies in the financial, healthcare, computer and consumer electronics sectors.

Based on mutexes created by Xbow and other evidence, the security firm believes the threat group has separate teams for each activity. One team, which has at least 10 members, is responsible for developing the malware. Another team is in charge of infiltrating the targeted organizations via spear-phishing emails that contain malicious attachments.

A third team is believed to be in charge of maintaining the group’s extensive C&C infrastructure. Experts have uncovered more than 100 C&C server and the attackers keep expanding it with new domains.

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

Expert Insights

Related Content

Cybercrime

The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Cybercrime

A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Malware & Threats

The NSA and FBI warn that a Chinese state-sponsored APT called BlackTech is hacking into network edge devices and using firmware implants to silently...

Application Security

Virtualization technology giant VMware on Tuesday shipped urgent updates to fix a trio of security problems in multiple software products, including a virtual machine...

Cyberwarfare

An engineer recruited by intelligence services reportedly used a water pump to deliver Stuxnet, which reportedly cost $1-2 billion to develop.

Malware & Threats

Unpatched and unprotected VMware ESXi servers worldwide have been targeted in a ransomware attack exploiting a vulnerability patched in 2021.

Malware & Threats

Apple’s cat-and-mouse struggles with zero-day exploits on its flagship iOS platform is showing no signs of slowing down.

Cybercrime

No one combatting cybercrime knows everything, but everyone in the battle has some intelligence to contribute to the larger knowledge base.