Security experts uncovered a new malware campaign from BlackTeck, a Chinese cyberespionage APT group. According to a report from NTT Security, the group targeted Japan-based companies via a novel malware variant dubbed Flagpro.
“We have observed attack cases using Flagpro against multiple companies (Defense, Media, Communications) several times. In October 2020, a sample related to Flagpro was submitted to an online service. Therefore, Flagpro may have already been used for attacking cases at that point,” the report said.
Flagpro Malware Attack Chain
Researchers stated that attackers leveraged Flagpro malware in the initial stage of infection to compromise the targeted network, download a second-stage malware, and then execute. The Flagpro infection starts with a spearphishing email with an attached password-protected archived file (ZIP or RAR).
Also Read: Researchers Uncover New Malware Campaign Spreading ‘Blister’ Payload
The archived file includes an .xlsm format file (Excel macro) containing a malicious macro. Once the user activates the macro, the malware automatically downloads and creates an EXE file (containing Flagpro) in the startup directory. Once installed, Flagpro malware communicates with the hacker-operated C&C server and executes the received commands.
Flagpro’s main activities include:
- Download and execute a tool
- Execute OS commands and send the results
- Collect and send Windows authentication information
Indicators of Compromise (IoC)
- 54e6ea47eb04634d3e87fd7787e2136ccfbcc80ade34f246a12cf93bab527f6b
- e197c583f57e6c560b576278233e3ab050e38aa9424a5d95b172de66f9cfe970
- 655ca39beb2413803af099879401e6d634942a169d2f57eb30f96154a78b2ad5
- 840ce62f92fc519cd1a33b62f4b9f92a962b7fb28c12d2f607dec0b520e6a4b2
- ba27ae12e6f3c2c87fd2478072dfa2747d368a507c69cd90b653c9e707254a1d
- 77680fb906476f0d84e15d5032f09108fdef8933bcad0b941c9f375fedd0b2c9
- e81255ff6e0ed937603748c1442ce9d6588decf6922537037cf3f1a7369a8876
- 45[.]76.184.227
- 45[.]32.23.140
- 139[.]162.87.180
- 107[.]191.61.40
- 172[.]104.109.217
- misecure[.]com
- centosupdates[.]com
“We have observed attack cases using Flagpro against Japan since October 2020. The attack techniques have not changed a lot, but BlackTech uses more evading techniques. For example, they adjust decoy files and file names to their target and check the target’s environment carefully. Recently, they have started using other new malware called SelfMake Loader and Spider RAT. It means that they are actively developing new malware. Therefore, you need to pay attention to the attacks from BlackTech,” the report added.
