Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

The Question of Wire Lurker Attribution: Who Is Responsible?

Summary: A Chinese-language technology blogger traced WireLurker's command-and-control domain to two Apple App Store apps sharing the same developer, Lei Li, and QQ number, 127863672, with one app's support site, www.comeinbaby[.]com, serving as the C2 server. The trail led to an individual using the handle "段誉523" who admitted to iOS front-end and client-side development but denied responsibility for "backend issues" and offered to pass the blogger's questions to his boss, and the exchange ended without definitive closure.

What's compelling: Unit 42's account shows attribution stalling at a developer who says he only did front-end work and whose company name was never given, leaving the party actually running the C2 domain unidentified while community members believe he is at minimum covering for whoever is responsible.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related