Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Stately Taurus Activity in Southeast Asia Links to Bookworm Malware

Summary: Unit 42 researchers found infrastructure overlaps linking Stately Taurus activity against ASEAN-affiliated organizations to a variant of the Bookworm malware, first published about in 2015 and previously unattributed to any threat actor. The Myanmar activity used a legitimate signed executable to sideload BrMod104.dll, a PubLoad variant that connects to 123.253.32[.]15 and masquerades as a Windows update request using the host www.asia.microsoft.com.

Why it matters: A threat group active against Southeast Asian government targets has kept the same malware family in service for nearly a decade by repackaging its shellcode into new form factors, so signature-based detection built on the 2015 samples would miss the 2021-2022 builds.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Threat Actors & Nation-State
Related