An updated version of a backdoor malware previously used in targeted attacks against high-profile Southeast Asian organizations has resurfaced, this time targeting ISPs and governmental entities in the Middle East. The new variant of the EagerBee backdoor, as detected by researchers at Kaspersky, showcases significant advancements in its capabilities and components.

EagerBee operates primarily in memory to enhance its stealth and evade traditional endpoint security solutions. It conceals its command shell activities by injecting malicious code into legitimate processes executed within explorer.exe or the targeted user’s session, seamlessly blending with normal system operations, making detection and analysis more challenging, as explained by Kaspersky senior security researcher Saurabh Sharma.

The earlier version of this malware was linked to attacks by three Chinese state-aligned threat clusters collaborating in Operation Crimson Palace to steal sensitive information from a government organization in Southeast Asia. Now, the latest EagerBee variant used in the Middle East attacks includes several new advanced features, such as a service injector to embed the backdoor into running services and various undocumented plug-ins for post-installation deployment of additional payloads, file system exploration, command shell execution, and more, according to Sharma.

The attribution of EagerBee to different Chinese threat actors, particularly the CoughingDown group, remains muddled, given the complexities of tracking specific actors in state-sponsored attacks. Evidence from the Middle East attacks suggests a connection between EagerBee and CoughingDown, indicated by code overlap found in a malicious DLL file used in the attack and a multiplug-in malware previously developed by CoughingDown, leading to an assessment linking the two threat groups with medium confidence, as outlined by Sharma.

The advanced features of the EagerBee backdoor include key plug-ins orchestrated by a module to perform malicious activities, such as gathering victim-specific data and reporting system information like memory usage, system locale, time-zone settings, and Windows encoding to the command and control server. This orchestrator module also checks for elevated privileges, collects process details, and waits for commands to be executed by various backdoor plug-ins, including a file manager, process manager, remote access manager, and service manager.

Despite the challenges in pinpointing the initial infection vector for EagerBee, securing network perimeters against such threats is crucial. While previous attacks in Asia exploited the Exchange ProxyLogon flaw, there is no evidence of its use in the recent Middle East attacks. However, defenders are advised to patch ProxyLogon promptly, as it remains a popular exploit method among attackers. The evolution of EagerBee in the Middle East attacks underscores the constant advancements in malware frameworks, emphasizing the need for organizations to enhance their security measures to combat sophisticated threats effectively.

Source link