Bad backdoor found in server software used by financial institutions

“ShadowPad is an example of how dangerous and wide-scale a successful supply-chain attack can be," one researcher said.

Software security used globally by banks, energy firms and pharmaceutical manufacturers had a backdoor surreptitiously added by an advanced attacker that allowed a full takeover of target networks.

Kaspersky Lab researchers published a report on Tuesday warning about the backdoor, called ShadowPad, which affected products sold by NetSarang, a software company headquartered in the United States and South Korea. The backdoor was active from July 17 to Aug. 4, when it was sniffed out by Kaspersky researchers who found suspicious DNS requests in a Hong Kong financial institution using NetSarang’s software.

News of ShadowPad comes on the heels of June’s NotPetya outbreak. A backdoor in the Ukranian tax software M.E.Doc allowed attackers to push malware to victims through the software’s update feature, outlining how backdoored supply-chain attacks can lead to weaponized updates. Kaspersky pointed to other attacks similar to ShadowPad including the 2013’s WinNTi malware and 2015’s PlugX Trojan.

“ShadowPad is an example of how dangerous and wide-scale a successful supply-chain attack can be,” Kaspersky’s Igor Soumenkov said. “Given the opportunities for reach and data collection it gives to the attackers, most likely it will be reproduced again and again with some other widely used software component.”

The backdoor was actively exploited at least once in the Hong Kong financial company’s networks, Kaspersky confirmed, urging any other users to take immediate action — here’s the appropriate update — to identify affected software. The investigation is ongoing. The malicious entry point sits in the nssock2.dll library, from which it sends out basic information like computer, domain and user names every eight hours until it’s specifically activated by the attackers.

The extent of damage or exfiltrated data during incident at the Hong Kong company remain publicly unclear.

“Attribution is hard and the attackers were very careful to not leave obvious traces,” researchers wrote. “However certain techniques were known to be used in another malware like PlugX and Winnti, which were allegedly developed by Chinese-speaking actors.”

The affected products are Xmanager Enterprise 5.0, Xmanager 5.0, Xshell 5.0, Xftp 5.0 and Xlpd 5.0, according to NetSarang.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure