![\"\"](\"https:\/\/gaming-awards.com\/NEWS\/wp-content\/uploads\/2018\/09\/Hacker-300x199.jpg\")
TrendMicro security researchers have unearthed a cyber espionage operation carried out by an APT (Advanced Persistent Threat) group tracked as DRBControl that utilised a new family of malware. The invaders aimed at stealing databases and source code from betting companies in Southeast Asia, and likely in the Middle East and Europe.<\/p>\n
As per the Trend Micro analysis, \u201cThe threat actor is currently targeting users in Southeast Asia, particularly gambling and betting companies. Europe and the Middle East were also reported to us as being targeted, but we could not confirm this at the time of writing. Exfiltrated data was mostly comprised of databases and source codes, which led us to believe that the\u00a0group\u2019s main purpose is cyberespionage.\u201d<\/p>\n
The hackers used two previously unknown\u00a0backdoors, identified malware families such as\u00a0PlugX\u00a0and the\u00a0HyperBro\u00a0backdoor, along with custom post-exploitation tools. One of the\u00a0backdoors\u00a0exploits the file hosting service Dropbox as command-and-control (C&C). The new backdoor was discovered when the group used both standard and custom malware exploitation tools to attack a company in the Philippines.<\/p>\n
The group was also employing modified versions of common malware such as\u00a0Trochilus\u00a0RAT, PlugX RAT,\u00a0keyloggers\u00a0using the Microsoft Foundation Class (MFC) library, the custom in-memory HyperBro backdoor, and a Cobalt Strike sample.<\/p>\n
The attackers\u2019 arsenal includes post-exploitation tools such as tools for bypassing UAC (User Account Control), password dumpers (Quarks PwDump, modified Mimikatz, NetPwdDump), and code loaders.<\/p>\n
Experts have recognised two main\u00a0backdoors\u00a0(Type 1 and Type 2) used in attacks that were previously unknown in the threat environment.<\/p>\n
Another backdoor complements Type 1 \u2013 it executes malware downloaded from Dropbox and loaded in memory. Type 1 backdoor runs by utilizing DLL side-loading.<\/p>\n
The malware was employed for stealing PDF and Office documents, browser cookies, key logs, SQL dumps, and a KeePass manager database.<\/p>\n
Both\u00a0backdoors\u00a0implement\u00a0a\u00a0UAC system bypass – they also implement a\u00a0keylogging\u00a0feature.<\/p>\n
A first variant of the Type 1 backdoor was found to be released in late May 2019, while version 9.0 dates October 2019.<\/p>\n
The Type 2 backdoor was initially released in July 2019 – it was used in a spear-phishing attack distributing a\u00a0weaponised\u00a0MS Word document.<\/p>\n
These circumstances suggest that DRBControl has been active at least since 2017, but it is speculated it has had a longer run.<\/p>\n
For now, it is not possible to accurately associate the DRBControl group with a specific threat actor; it is not completely clear if the hackers belong to a new APT group or are a subgroup of a known Chinese APT group.<\/p>\n","protected":false},"excerpt":{"rendered":"
TrendMicro security researchers have unearthed a cyber espionage operation carried out by an APT (Advanced Persistent Threat) group tracked as DRBControl that utilised a new family of malware. The invaders aimed at stealing databases and source code from betting companies in Southeast Asia, and likely in the Middle East and Europe. As per the Trend […]<\/p>\n","protected":false},"author":5,"featured_media":36173,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,3,8],"tags":[],"class_list":["post-40696","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-headlines","category-igaming","category-latest"],"yoast_head":"\n