Common malware has led a group of researchers to link the once mysterious Sandman threat group, known for cyberattacks against telecom service providers across the world, to a growing web of Chinese government-backed advanced persistent threat groups.
The threat intelligence assessment is the result of a collaboration between Microsoft, SentinelLabs, and PwC, and offers just a small glimpse into the general complexity and breadth of the Chinese APT threat landscape, according to the researchers.
The new report says Lua development practices, as well as adoption of the Keyplug backdoor, appear to have been shared with China-based threat actor STORM-08/Red Dev 40, similarly known for targeting telcos in the Middle East and South Asia.
The report added that a Mandiant team first reported the Keyplug backdoor being used by the known Chinese group APT41 back in March 2022.
Microsoft and PwC teams found the Keyplug backdoor was being passed around multiple additional Chinese-based threat groups, the report added.
The latest Keyplug malware gives the group a new advantage, according to the researchers, with new obfuscation tools.
Growing, effective collaboration between an expanding maze of Chinese APT groups requires similar knowledge-sharing among the cybersecurity community, the report added.
This Cyber News was published on www.darkreading.com. Publication date: Mon, 11 Dec 2023 16:05:53 +0000