Webworm Hackers Using Modified RATs in Latest Cyber Espionage Attacks

A threat actor tracked under the moniker Webworm has been
linked to bespoke Windows-based remote access trojans, some of
which are said to be in pre-deployment or testing phases.

“The group has developed customized versions of three older
remote access trojans (RATs), including Trochilus RAT^[1], Gh0st RAT^[2], and 9002 RAT^[3],” the Symantec Threat
Hunter team, part of Broadcom Software, said^[4]
in a report shared with The Hacker News.

The cybersecurity firm said at least one of the indicators of
compromise (IOCs) was used in an attack against an IT service
provider operating in multiple Asian countries.

It’s worth pointing out that all the three backdoors are
primarily associated with Chinese threat actors such as Stone Panda
(APT10), Aurora Panda (APT17), Emissary Panda (APT27), and
Judgement Panda (APT31), among others, although they have been put
to use by other hacking groups.

Symantec said the Webworm threat actor exhibits tactical
overlaps with another new adversarial collective documented by
Positive Technologies earlier this May as Space Pirates^[5], which was found
striking entities in the Russian aerospace industry with novel
malware.

Space Pirates, for its part, intersects with previously
identified Chinese espionage activity known as Wicked Panda
(APT41), Mustang Panda, Dagger Panda (RedFoxtrot^[6]), Colorful Panda
(TA428), and Night Dragon owing to the shared usage of
post-exploitation modular RATs^[7]
such as PlugX^[8]
and ShadowPad^[9].

Other tools in its malware arsenal include Zupdax, Deed RAT, a
modified version of Gh0st RAT known as BH_A006, and
MyKLoadClient.

Webworm, active since 2017, has a track record of striking
government agencies and enterprises involved in IT services,
aerospace, and electric power industries located in Russia,
Georgia, Mongolia, and several other Asian nations.

Attack chains involve the use of dropper malware that harbors a
loader designed to launch modified versions of Trochilus, Gh0st,
and 9002 remote access trojans. Most of the changes are intended to
evade detection, the cybersecurity firm said.

“Webworm’s use of customized versions of older, and in some
cases open-source, malware, as well as code overlaps with the group
known as Space Pirates, suggest that they may be the same threat
group,” the researchers said.

“However, the common use of these types of tools and the
exchange of tools between groups in this region can obscure the
traces of distinct threat groups, which is likely one of the
reasons why this approach is adopted, another being cost, as
developing sophisticated malware can be expensive in terms of both
money and time.”