InfoSecBulletin Cybersecurity for mankind
SentinelLabs and QGroup GmbH have conducted a joint investigation, revealing the presence of an enigmatic APT group. This group has set its sights on telco service providers in Europe and Asia, indicating an extensive cyberespionage endeavor.
SentinelLabs researcher Aleksandar Milenkoski says that a secretive APT group is using a complex modular backdoor. The backdoor is built on Lua, a programming language used mainly in embedded applications.
WhatsApp banned on all US House of Representatives devices
Kaspersky found “SparkKitty” Malware on Google Play, Apple App Store
OWASP AI Testing Guide Launched to Uncover Vulns in AI Systems
Axentec Launches Bangladesh’s First Locally Hosted Tier-4 Cloud Platform
Hackers Bypass Gmail MFA With App-Specific Password Reuse
Russia detects first SuperCard malware attacks via NFC
Income Property Investments exposes 170,000+ Individuals record
ALERT (CVE: 2023-28771)
Zyxel Firewalls Under Attack via CVE-2023-28771 by 244 IPs
CISA Flags Active Exploits in Apple iOS and TP-Link Routers
10K Records Allegedly from Mac Cloud Provider’s Customers Leaked Online
Sandman has developed a new type of backdoor called LuaJIT platform. This is not commonly seen in cyber threats. The whole operation is careful and deliberate, with minimal and calculated actions within infected networks. The main objective is to minimize the chances of being detected.
Sandman, an advanced threat actor, has recently been observed targeting telecommunications providers in the Middle East, Western Europe, and the South Asian subcontinent.
At the LABScon security conference, Milenkoski revealed that his group utilizes a malware known as LuaDream. This malware can extract system and user information, enabling more precise attacks.
“The implementation of LuaDream indicates a well-execuThe SentinelLabs researcher mentioned that the APT group behind this project is difficult to identify. However, they emphasized that the project is well-established, maintained, and actively developed on a large scale.
The fact that we have identified 36 unique LuaDream components and the project supports multiple protocols for C2 communication imply that this is a large-scale project. The LuaDream staging chain is expertly crafted to elude detection and counter analysis, effortlessly deploying the malware to memory,” he concluded.
SentinelLabs has confirmed that the LuaDream malware does not contain any backdoor capabilities targeting the LuaJIT platform. The threat actor leverages LuaJIT as a means to seamlessly infiltrate targeted organizations with backdooMilenkoski stated that even though the data shows that telcos in different parts of the world are being targeted by a cyberespionage group, LuaDream cannot be linked to any specific threat actor. This suggests that LuaDream may be the result of a hacker-for-hire service.dor.
SentinelLabs researchers also called attention to the use of the Lua programming language, noting that the use of LuaJIT in the context of APT malware is very rare.
In the past, threat hunters have seen highly modular, Lua-utilizing malware associated with high-end APTs like Flame, Animal Farm and Project Sauron, but the Sandman APT discovery suggests the developmental paradigm has trickled down to a broader set of actors, SentinelLabs researchers posited at the conference.
The LuaDream malware is similar to another malware called “DreamLand”. Kaspersky discovered this similarity in March 2023 while investigating APT activities against a government entity in Pakistan.
According to Milenkoski, these correlations suggest the existence of a potential wider campaign, indicating that Sandman’s actions may go as far back as 2022.
