Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Chinese Alloy Taurus Updates Ping Pull Malware

Summary: Unit 42 researchers identified a new Linux variant of PingPull malware used by the Chinese APT group Alloy Taurus, communicating with the domain yrhsywu2009.zapto[.]org over port 8443 and using the same AES key, P29456789A1234sS, seen in the original Windows variant. Pivoting on that C2 domain, researchers also found a backdoor they track as Sword2033, one sample of which connects to 196.216.136[.]139 in South Africa via a domain impersonating the South African military.

What's compelling: Alloy Taurus has operated since at least 2012 against telecoms across Asia, Europe and Africa and has expanded into financial institutions and government entities, and its C2 infrastructure has been tied to SoftEther VPN, a service the group uses to maintain persistence.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related