Skip to content

Malware University

Class is in Session

  • About
    • Privacy Policy
  • Contact
  • Resources

Tag: APT41

Chengdu 404

Posted on September 20, 2020 - September 20, 2020 by admin

US DOJ has listed several arrest warrants for Chinese nationals believed to be part of APT41 (Barium). This group is allegedly behind the ASUS hack that lead to hundreds of thousands of infections due to the group using ASUS’s own code signing certificate to push their malware via the company’s update servers.

Some of these infected hosts were targeted with ransomware and cryptojacking malware. The group has engaged in financially-motivated attacks since at least 2012 by targeting gaming companies for the procurement of game currency.

This group, who had a front company named Chengdu 404, likely was coerced by Chinese state officials to engage in traditional espionage activities while allowing the group to continue their financial pursuits.

The group is not known to produce their own 0day exploits but are very quick to deploy new releases once an exploit is dropped, as they did in March 2020 with the Zoho ManageEngine exploit.

Chinese APT groups have traditionally had a reputation of government and corporate espionage for largely information purposes. It appears the Chinese state authorities are turning a blind eye to financially-focused groups so long as they perform actions on behalf of the Party in between their activities.

Posted in Campaign Analysis, Current EventsTagged APT41, ASUS, Barium, Chengdu 404, US DOJLeave a comment

Recent Posts

  • Manual Scraping
  • Nitter Replacement
  • MFA Abuse in Splunk
  • Virtualbox Automation
  • Repository Poisoning

Recent Comments

    Archives

    • August 2024
    • July 2023
    • August 2022
    • March 2022
    • November 2021
    • October 2021
    • September 2021
    • August 2021
    • July 2021
    • June 2021
    • February 2021
    • December 2020
    • October 2020
    • September 2020
    • April 2020
    • March 2020
    • January 2020
    • July 2019
    • June 2019

    Categories

    • Campaign Analysis
    • Campaign Management
    • Code Analysis
    • Current Events
    • Malware Development
    • Techniques
    • Uncategorized
    • Utilities

    Meta

    • Log in
    • Entries feed
    • Comments feed
    • WordPress.org
    Proudly powered by WordPress | Theme: micro, developed by DevriX.