Suspected Chinese hackers return with unusual attacks on domestic gambling companies

The Winnti Group's gambling targets are usually in other parts of Asia.

It’s rare for Chinese hackers to turn their gaze inward on domestic companies. But a well-known group appears to have been targeting online gambling firms in China with new malware.

The malware, which Trend Micro dubbed BIOPASS RAT, goes after Chinese gambling companies with a watering hole attack, where hackers try to infect websites commonly used by its targets.

“Notably, a large number of features were implemented to target and steal the private data of popular web browsers and instant messengers that are primarily used in Mainland China,” Trend Micro said in a report on Friday.

Digital clues that Trend Micro identified point to the Chinese hacking outfit the Winnti Group as a culprit. Its activity overlaps with that of the Chinese government hackers known as APT41, such that it’s sometimes mentioned as a second name for the group. That’s a joint cybercrime and espionage organization of hackers whose goals usually align with that of the Chinese government.

It’s not unusual for Winnti to go after the gambling industry in Asia, although it’s better known for targeting the video game industry. What is unusual is that this time, the Asian gambling targets are within China’s borders. (The Chinese government has frequently been accused of turned its hacking powers onto minority Uyghurs.)

“Quite interesting for a APT41 (Winnti)-linked group to target domestic users of gambling sites,” German researcher Timo Steffens observed on Twitter. “Online gambling is prohibited in mainland China, enforced by the Ministry of Public Security (MPS). Last year, thousands of gamblers were arrested.”

The new Winnti activity aroused particular interest in Germany, following a joint 2019 investigation from German news outlets BR and NDR about Winnti’s extensive targeting of German companies — although a U.S. Army cyber account also highlighted the Trend Micro research.

Trend Micro found the attack’s techniques noteworthy as well.

“What makes BIOPASS RAT particularly interesting is that it can sniff its victim’s screen by abusing the framework of Open Broadcaster Software (OBS) Studio, a popular live streaming and video recording app, to establish live streaming to a cloud service,” the company wrote.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure