Researchers ID new RAT developed by Chinese hacking group with growing target list

The remote access trojan mimics legitimate computer activity to make it harder to detect, the researchers said.

An established Chinese hacking group known for targeting telecommunications, finance and government organizations around the world has developed a “new, difficult-to-detect” remote access trojan it is using as part of its espionage activities, researchers with Palo Alto Networks’ Unit 42 said in research published Monday.

The researchers spotted the malware as part of their ongoing monitoring of a hacking group known as Gallium, a Chinese state-sponsored group active since at least 2012 according to Mitre, a nonprofit research organization funded by private grants and the U.S. government.

Gallium has extended its targeting beyond telecommunications over the last year, the Unit 42 researchers wrote, to include financial institutions and government entities.

The remote access trojan (RAT), dubbed “PingPull” by the researchers, can make it more difficult to detect its command and control communications in part by leveraging the ICMP protocol, typically used by devices on a network to diagnose communication issues and send error reports. The use of ICMP is not a novel technique, but PingPull makes detection harder “as few organizations implement inspection of ICMP traffic on their networks,” the researchers wrote.

It’s not clear in how many of the observed campaigns PingPull was used, but the researchers observed the group hitting targets in Afghanistan, Australia, Belgium, Cambodia, Malaysia, Mozambique, the Philippines, Russia and Vietnam, they said.

There are also PingPull variants that rely on different protocols for command and control operations, including HTTP(S), which relates to the ways data travels between a web browser and a website, and the Transmission Control Protocol or TCP, which enables programs and devices to exchange messages over a network.

Regardless of the variant, the malware mimics legitimate computer operations to try and blend into normal activity. The malware can perform a variety of activities once inside a system, such as reading, writing and deleting files and copying and moving files, the researchers wrote.

“GALLIUM remains an active threat to telecommunications, finance and government organizations across Southeast Asia, Europe and Africa,” the researchers wrote.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure