Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Bendy Bear: Novel Chinese Shellcode Linked With Cyber Espionage Group Black Tech

Summary: Unit 42 researchers analyzed BendyBear, a 10,000+ byte x64 shellcode stage-zero implant that downloads a more robust implant from a command and control server, and named it for its strong correlation with the WaterBear malware family active since 2009. The sample was identified through connections to a malicious C2 domain published by Taiwan's Ministry of Justice Investigation Bureau in August 2020, and it uses modified RC4 encryption, signature block verification, and polymorphic code to resist analysis.

What's compelling: BlackTech, the group the broader threat research community has assessed has ties to the Chinese government, is believed responsible for recent attacks against several East Asian government organizations, and BendyBear's size and anti-analysis techniques make it one of the most difficult-to-detect shellcode samples employed by an APT.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related