Security News Chinese Hacking Group APT41 Exploits Google Calendar to Target Governments

[Brownie2019]

Content source

https://www.securityweek.com/chinese-hacking-group-apt41-exploits-google-calendar-to-target-governments/

Chinese state-sponsored threat actor APT41 has targeted government entities with malware that uses Google Calendar for command-and-control (C&C), Google warns.

Also tracked as Barium, Winnti, Wicked Panda and Wicked Spider, APT41 is known for targeting organizations globally, across multiple sectors, including automotive, entertainment, government, logistics, media, shipping, and technology sectors.

In attacks observed in October 2024, the threat actor used a compromised government site to target other government entities with the ToughProgress malware that uses an attacker-controlled Google Calendar for C&C.
APT41 relied on phishing emails containing a link to a ZIP archive hosted on the compromised website, which contained a LNK file posing as a PDF document.
When opened, the LNK file launched a DLL (dubbed PlusDrop) that executed the next stage (PlusInject) designed to inject the final payload (ToughProgress) into the legitimate svchost process, using the process hollowing technique.
...

 

[Andy Ful]

Users on Windows 11 with enabled Smart App Control are protected against such attacks (the LNK file will be blocked).
Others are vulnerable, except when security can block shortcuts or detect post-execution fileless techniques (like process hollowing):

This malware has three distinct modules, deployed in series, each with a distinct function. Each module also implements stealth and evasion techniques, including memory-only payloads, encryption, compression, process hollowing, control flow obfuscation, and leveraging Google Calendar for C2.

Mark Your Calendar: APT41 Innovative Tactics | Google Cloud Blog

cloud.google.com

 

[Parkinsond]

Users on Windows 11 with enabled Smart App Control are protected against such attacks (the LNK file will be blocked).
Others are vulnerable, except when security can block shortcuts or detect post-execution fileless techniques (like process hollowing):

Mark Your Calendar: APT41 Innovative Tactics | Google Cloud Blog

cloud.google.com

or to use WHHLight; block LNK by SWH, as WDAC component does not.

 

[Zero Knowledge]

Smart, very smart. You have to give credit to them.

 

[Andy Ful]

The attackers enhanced the attack vector known for several years:
phishing ---> ZIP archive ----> LNK -----> RunDLL32 -----> DLL loader (decrypted payload) ----> Process Hollowing -----> abusing legal cloud services for C2

State-sponsored phishing is often successful, so antivirus software attempts to detect the attack when the DLL loader is executed. When RunDLL32 LOLBin is used, some AVs can efficiently block the attack via Advanced Threat Protection features (like Microsoft Defender ASR rules) or LOLBin restrictions (like Comodo Script Analysis). Such loaders have a low level of suspicious IOCs on the pre-execution stage, so the attack can be detected by Machine Learning only after some time. This time can be longer if the attackers use a runtime FUD malware (unique crypter). It is probable that this was the case in this smart attack.
Top AVs can detect Process Hollowing methods (especially Enterprise versions). But I am not sure how effective they are against evolving attack methods.

 

[Andy Ful]

Here are some tests that include Process Hollowing by EDRs:

https://www.av-comparatives.org/wp-content/uploads/2024/05/avc_ProcessInjection_2024_Bitdefender.pdf

https://www.av-comparatives.org/wp-content/uploads/2024/05/avc_ProcessInjection_2024_ESET.pdf

https://www.av-comparatives.org/wp-content/uploads/2024/05/avc_ProcessInjection_2024_Kaspersky.pdf

 

[Parkinsond]

Here are some tests that include Process Hollowing by EDRs:

https://www.av-comparatives.org/wp-content/uploads/2024/05/avc_ProcessInjection_2024_Bitdefender.pdf

https://www.av-comparatives.org/wp-content/uploads/2024/05/avc_ProcessInjection_2024_ESET.pdf

https://www.av-comparatives.org/wp-content/uploads/2024/05/avc_ProcessInjection_2024_Kaspersky.pdf

ESET and K have one "fail" for "Execution via Callback Function"; this means B wins?

 

[Andy Ful]

ESET and K have one "fail" for "Execution via Callback Function"; this means B wins?

Yes, in this particular test.

 

[piquiteco]

Users on Windows 11 with enabled Smart App Control are protected against such attacks (the LNK file will be blocked).
Others are vulnerable, except when security can block shortcuts or detect post-execution fileless techniques (like process hollowing):

Andy, are those who have WHHLight or Hard_Configurator installed protected against this type of exploit? But specifically LNK?

 

[Andy Ful]

Andy, are those who have WHHLight or Hard_Configurator installed protected against this type of exploit? But specifically LNK?

Yes. However, those security-oriented apps are not intended for use in "automotive, entertainment, government, logistics, media, shipping, and technology sectors," often attacked by state-sponsored actors.
These possible targets should use EDRs like those mentioned in my previous post (and eventually Application Control for Business).

 

[piquiteco]

often attacked by state-sponsored actors.

I'm sorry, I forgot the title of the post about Hacking Group APT41 similar to the Lazarus Group.

 

[Andy Ful]

In October 2024, Microsoft changed the Windows loader mechanism in Windows 11 24H2. This prevents the typical Process Hollowing attack.
This is probably good news for many users, but not necessarily for Enterprises.

New Process Hollowing Attack Vectors Discovered in Windows 11 (24H2) – What You Need to Know!

The release of Windows 11 version 24H2 brings several new features and updates, but it has also sparked cyber security concerns. According to researchers, a well-known malware technique called Process Hollowing (also referred to as RunPE) is facing compatibility challenges on this latest update.

www.linkedin.com

Pure Crypter Deploys Sophisticated Evasion Tactics to Evade Windows 11 24H2 Security Features

Pure Crypter has cemented its position as a prominent malware-as-a-service (MaaS) loader within the cybercriminal ecosystem.

cyberpress.org

In widespread attacks, the typical Process Hollowing will still be prevalent for some time due to the popularity of Windows 10.