Chinese Actors Use ‘3102’ Malware in Attacks on US Government and EU Media
Summary: Unit 42 observed two spear-phishing attacks on May 6 and May 11, 2015, against a U.S. government agency and a European media company, both delivering an Excel document named 電郵名單.xls that exploited CVE-2012-0158 in the MSComctlLib.TreeView ActiveX control to install the 3102 Trojan. The 3102 payload is a modular variant of the 9002 Trojan that loads plugins from the C2 server, including KeyLogger.dll, DownFileS.dll, FileManagerS.dll and ScreenSpyS.dll, and was signed with a certificate issued to A'digm, Inc. that also signed a 9002 sample tied to the Evilgrab watering hole on the President of Myanmar's website.
What you should know: The same digital certificate and shared C2 domains link these intrusions into a U.S. government network and a European media outlet to a single actor whose registrant emails trace to Chinese-language hacking forums, and the plugins observed in the attacks gave the operator keystroke logging, file access and full screen control.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Mentions
- CVE-2012-0158
- Related
- Bad Patch Cyber Risks ·