InfoSecBulletin Cybersecurity for mankind
SentinelLabs and QGroup GmbH have conducted a joint investigation, revealing the presence of an enigmatic APT group. This group has set its sights on telco service providers in Europe and Asia, indicating an extensive cyberespionage endeavor.
SentinelLabs researcher Aleksandar Milenkoski says that a secretive APT group is using a complex modular backdoor. The backdoor is built on Lua, a programming language used mainly in embedded applications.
CVSS 9.6: IBM QRadar & Cloud Pak Security Flaws Exposed
ALERT
Thousands of IP addresses compromised nationwide: CIRT warn
New Android Malware ‘Crocodilus’ Targets Banks in 8 Countries
Qualcomm Patches 3 Zero-Days Used in Targeted Android Attacks
Critical RCE Flaw Patched in Roundcube Webmail
Hacker claim Leak of Deloitte Source Code & GitHub Credentials
CISA Issued Guidance for SIEM and SOAR Implementation
Linux flaws enable password hash theft via core dumps in Ubuntu, RHEL, Fedora
Australia enacts mandatory ransomware payment reporting
Why Govt Demands Foreign CCTV Firms to Submit Source Code?
Sandman has developed a new type of backdoor called LuaJIT platform. This is not commonly seen in cyber threats. The whole operation is careful and deliberate, with minimal and calculated actions within infected networks. The main objective is to minimize the chances of being detected.
Sandman, an advanced threat actor, has recently been observed targeting telecommunications providers in the Middle East, Western Europe, and the South Asian subcontinent.
At the LABScon security conference, Milenkoski revealed that his group utilizes a malware known as LuaDream. This malware can extract system and user information, enabling more precise attacks.
“The implementation of LuaDream indicates a well-execuThe SentinelLabs researcher mentioned that the APT group behind this project is difficult to identify. However, they emphasized that the project is well-established, maintained, and actively developed on a large scale.
The fact that we have identified 36 unique LuaDream components and the project supports multiple protocols for C2 communication imply that this is a large-scale project. The LuaDream staging chain is expertly crafted to elude detection and counter analysis, effortlessly deploying the malware to memory,” he concluded.
SentinelLabs has confirmed that the LuaDream malware does not contain any backdoor capabilities targeting the LuaJIT platform. The threat actor leverages LuaJIT as a means to seamlessly infiltrate targeted organizations with backdooMilenkoski stated that even though the data shows that telcos in different parts of the world are being targeted by a cyberespionage group, LuaDream cannot be linked to any specific threat actor. This suggests that LuaDream may be the result of a hacker-for-hire service.dor.
SentinelLabs researchers also called attention to the use of the Lua programming language, noting that the use of LuaJIT in the context of APT malware is very rare.
In the past, threat hunters have seen highly modular, Lua-utilizing malware associated with high-end APTs like Flame, Animal Farm and Project Sauron, but the Sandman APT discovery suggests the developmental paradigm has trickled down to a broader set of actors, SentinelLabs researchers posited at the conference.
The LuaDream malware is similar to another malware called “DreamLand”. Kaspersky discovered this similarity in March 2023 while investigating APT activities against a government entity in Pakistan.
According to Milenkoski, these correlations suggest the existence of a potential wider campaign, indicating that Sandman’s actions may go as far back as 2022.
