Chinese hackers have unleashed a never-before

After decrypting the binary and finding SprySOCKS, the researchers used the information they found to search VirusTotal for related files. Their search turned up a version of the malware with the release number 1.1. The version Trend Micro found was 1.3.6. The multiple versions suggest that the backdoor is currently under development.

The command-and-control server that SprySOCKS connects to has major similarities to a server that was used in a campaign with a different piece of Windows malware known as RedLeaves. Like SprySOCKS, RedLeaves was also based on Trochilus. Strings that appear in both Trochilus and RedLeaves also appear in the SOCKS component that was added to SprySOCKS. The SOCKS code was borrowed from the HP-Socket, a high-performance network framework with Chinese origins.

Trend Micro is attributing SprySOCKS to a threat actor it has dubbed Earth Lusca. The researchers discovered the group in 2021 and documented it the following year. Earth Lusca targets organizations around the world, primarily in governments in Asia. It uses social engineering to lure targets to watering-hole sites where targets are infected with malware. Besides showing interest in espionage activities, Earth Lusca seems financially motivated, with sights set on gambling and cryptocurrency companies.

The same Earth Lusca server that hosted SprySOCKS also delivered the payloads known as Cobalt Strike and Winnti. Cobalt Strike is a hacking tool used by security professionals and threat actors alike. It provides a full suite of tools for finding and exploiting vulnerabilities. Earth Lusca was using it to expand its access after getting an initial toehold inside a targeted environment. Winnti, meanwhile, is the name of both a suite of malware that has been in use for more than a decade as well as the identifier for a host of distinct threat groups, all connected to the Chinese government’s intelligence apparatus, which has been among the world’s most prolific hacking syndicates.

Monday’s Trend Micro report provides IP addresses, file hashes, and other evidence that people can use to determine if they’ve been compromised. Earth Lusca generally infects systems using recently fixed vulnerabilities often referred to as n-days. Timely patching is the best defense. Monday’s report provided no additional details on prevention or removal of the malware.