chinese espionage deploys new rootkit with

CHINESE ESPIONAGE DEPLOYS NEW ROOTKIT WITH WINDOWS

The attackers deployed several malicious tools on each system, including droppers, loaders, fully featured HTTP(S) backdoors, HTTP(S) uploaders and downloaders,” Kálnai explained.

“Attacks started after these documents were opened. In both cases observed by ESET, targets were presented with job offers: the employee in the Netherlands via LinkedIn messaging and the person in Belgium via email.

CHINESE ESPIONAGE DEPLOYS NEW ROOTKIT WITH WINDOWS

“It uses techniques against Windows kernel mechanisms that have never been observed in malware before.” “This tool, in combination with the vulnerability, disables the monitoring of all security solutions on compromised machines,” reads the advisory. Before that, however, ESET said the vulnerability was exploited at least twice via a specific user–mode module. The company patched the flaw, which affects Dell DBUtil drivers, in May 2021. “The campaign started with spearphishing emails containing malicious Amazon–themed documents and targeted an employee of an aerospace company in the Netherlands and a political journalist in Belgium,” ESET wrote in an advisory by Peter Kálnai, senior malware researcher, published over the weekend.Īccording to the company, the primary goal of the attackers was data exfiltration, which was executed via the CVE–2021–21551 vulnerability. The campaign, which shows the hacker group’s ever–evolving techniques, was spotted by ESET security researchers in the autumn of 2021. The North Korea–backed threat actor known as Lazarus Group has been observed deploying a Windows rootkit by exploiting a Dell firmware driver.

Chinese espionage deploys new rootkit with