InfoSecBulletin Cybersecurity for mankind
SentinelLabs and QGroup GmbH have conducted a joint investigation, revealing the presence of an enigmatic APT group. This group has set its sights on telco service providers in Europe and Asia, indicating an extensive cyberespionage endeavor.
SentinelLabs researcher Aleksandar Milenkoski says that a secretive APT group is using a complex modular backdoor. The backdoor is built on Lua, a programming language used mainly in embedded applications.
RockYou2024: Massive 10-Billion Password Leak
ISPC first get together held with a festive look
ISACA Dhaka chapter election
Iqbal hossain president, Azad secretary for ISACA Dhaka chapter
Emerging Eldorado ransomware focuses on Windows, VMware ESXi VMs
OVHcloud faces record 840 million DDoS Attack Using MikroTik Routers
New report; Polyfill[.]io Attack Impacts Over 380,000 Hosts
![New report; Polyfill[.]io Attack Impacts Over 380,000 Hosts](https://infosecbulletin.com/wp-content/uploads/2024/07/Untitled-1-8.jpg)
Apache HTTP Server Update Patches Critical Source Code Disclosure Flaw
Microsoft Uncovers Flaws in Rockwell Automation PanelView Plus
Researchers detect 28 new Ransomwares in June
Vote for DHAKA, Vote for ISACA at 6 July
Sandman has developed a new type of backdoor called LuaJIT platform. This is not commonly seen in cyber threats. The whole operation is careful and deliberate, with minimal and calculated actions within infected networks. The main objective is to minimize the chances of being detected.
Sandman, an advanced threat actor, has recently been observed targeting telecommunications providers in the Middle East, Western Europe, and the South Asian subcontinent.
At the LABScon security conference, Milenkoski revealed that his group utilizes a malware known as LuaDream. This malware can extract system and user information, enabling more precise attacks.
“The implementation of LuaDream indicates a well-execuThe SentinelLabs researcher mentioned that the APT group behind this project is difficult to identify. However, they emphasized that the project is well-established, maintained, and actively developed on a large scale.
The fact that we have identified 36 unique LuaDream components and the project supports multiple protocols for C2 communication imply that this is a large-scale project. The LuaDream staging chain is expertly crafted to elude detection and counter analysis, effortlessly deploying the malware to memory,” he concluded.
SentinelLabs has confirmed that the LuaDream malware does not contain any backdoor capabilities targeting the LuaJIT platform. The threat actor leverages LuaJIT as a means to seamlessly infiltrate targeted organizations with backdooMilenkoski stated that even though the data shows that telcos in different parts of the world are being targeted by a cyberespionage group, LuaDream cannot be linked to any specific threat actor. This suggests that LuaDream may be the result of a hacker-for-hire service.dor.
SentinelLabs researchers also called attention to the use of the Lua programming language, noting that the use of LuaJIT in the context of APT malware is very rare.
In the past, threat hunters have seen highly modular, Lua-utilizing malware associated with high-end APTs like Flame, Animal Farm and Project Sauron, but the Sandman APT discovery suggests the developmental paradigm has trickled down to a broader set of actors, SentinelLabs researchers posited at the conference.
The LuaDream malware is similar to another malware called “DreamLand”. Kaspersky discovered this similarity in March 2023 while investigating APT activities against a government entity in Pakistan.
According to Milenkoski, these correlations suggest the existence of a potential wider campaign, indicating that Sandman’s actions may go as far back as 2022.
