InfoSecBulletin Cybersecurity for mankind
SentinelLabs and QGroup GmbH have conducted a joint investigation, revealing the presence of an enigmatic APT group. This group has set its sights on telco service providers in Europe and Asia, indicating an extensive cyberespionage endeavor.
SentinelLabs researcher Aleksandar Milenkoski says that a secretive APT group is using a complex modular backdoor. The backdoor is built on Lua, a programming language used mainly in embedded applications.
B1ack’s Stash Releases 1 Million Credit Cards on a Deep Web Forum
Cisco Confirms
Salt Typhoon Exploited CVE-2018-0171 to Target U.S. Telecom Networks
AWS Key Hunter
Test this free automated tool to hunt for exposed AWS secrets
Check Point Flaw Used to Deploy ShadowPad and Ransomware
CVE-2024-12284
Citrix Issues Security Update for NetScaler Console
CISA and FBI ALERT
Ghost ransomware to breach organizations in 70 countries
Hacker chains multiple vulns to attack Palo Alto Firewall
150 Gov.t Portal affected
Black-Hat SEO Poisoning Indian “.gov.in, .ac.in” domain
CVE-2018-19410 Exposes 600 PRTG Instances in Bangladesh
Builder claims Rs 150 cr for data loss; AWS faces FIR In Bengaluru
Sandman has developed a new type of backdoor called LuaJIT platform. This is not commonly seen in cyber threats. The whole operation is careful and deliberate, with minimal and calculated actions within infected networks. The main objective is to minimize the chances of being detected.
Sandman, an advanced threat actor, has recently been observed targeting telecommunications providers in the Middle East, Western Europe, and the South Asian subcontinent.
At the LABScon security conference, Milenkoski revealed that his group utilizes a malware known as LuaDream. This malware can extract system and user information, enabling more precise attacks.
“The implementation of LuaDream indicates a well-execuThe SentinelLabs researcher mentioned that the APT group behind this project is difficult to identify. However, they emphasized that the project is well-established, maintained, and actively developed on a large scale.
The fact that we have identified 36 unique LuaDream components and the project supports multiple protocols for C2 communication imply that this is a large-scale project. The LuaDream staging chain is expertly crafted to elude detection and counter analysis, effortlessly deploying the malware to memory,” he concluded.
SentinelLabs has confirmed that the LuaDream malware does not contain any backdoor capabilities targeting the LuaJIT platform. The threat actor leverages LuaJIT as a means to seamlessly infiltrate targeted organizations with backdooMilenkoski stated that even though the data shows that telcos in different parts of the world are being targeted by a cyberespionage group, LuaDream cannot be linked to any specific threat actor. This suggests that LuaDream may be the result of a hacker-for-hire service.dor.
SentinelLabs researchers also called attention to the use of the Lua programming language, noting that the use of LuaJIT in the context of APT malware is very rare.
In the past, threat hunters have seen highly modular, Lua-utilizing malware associated with high-end APTs like Flame, Animal Farm and Project Sauron, but the Sandman APT discovery suggests the developmental paradigm has trickled down to a broader set of actors, SentinelLabs researchers posited at the conference.
The LuaDream malware is similar to another malware called “DreamLand”. Kaspersky discovered this similarity in March 2023 while investigating APT activities against a government entity in Pakistan.
According to Milenkoski, these correlations suggest the existence of a potential wider campaign, indicating that Sandman’s actions may go as far back as 2022.
