South Korean educational, manufacturing, diplomatic, and political organizations are being targeted by new attacks perpetrated by a China-linked threat actor known as the Tonto Team.
See also: Atomic info-stealer: Beware! New macOS malware
“Recent cases have revealed that the group uses a file associated with anti-malware products to ultimately execute its malicious attacks,” the AhnLab Security Emergency Response Center (ASEC) said in a report published this week.
The Tonto Team, which has been active since at least 2009, has a history of targeting various sectors across Asia and Eastern Europe. Earlier this year, the group was blamed for a failed phishing attack on cybersecurity firm Group-IB.
See also: Linux version of RTM Locker ransomware targets VMware ESXi servers
The attack sequence discovered by ASEC begins with a Microsoft Compiled HTML Help (.CHM) file that executes a binary file to load a malicious DLL file (slc.dll) and launch ReVBShell, an open-source VBScript backdoor also used by another Chinese threat actor called Tick.
ReVBShell is then leveraged to download a second executable file, a legitimate Avast software configuration file (wsc_proxy.exe), which is then used to parallel load a second rogue DLL (wsc.dll), ultimately leading to the deployment of the Bisonal remote access trojan.
“The Tonto Team is constantly evolving through various means, such as using regular software for more sophisticated attacks,” ASEC said.
See also: UK: Connection problems on sites/apps of major banks
The use of CHM files as a malware distribution vehicle is not limited to Chinese threat actors – similar attack chains have been adopted by a North Korean nation-state group known as ScarCruft in attacks targeting its southern counterpart, to open backdoors on targeted hosts.
The adversary, also known as APT37, Reaper, and Ricochet Chollima, has also used LNK files to distribute the RokRAT malware. This malware is capable of collecting user credentials and downloading additional payloads.
Information source: thehackernews.com
