Cyber espionage group APT (Advanced Persistent Threat) Blackwell has targeted Japanese companies with a new type of malware that researchers are calling “Flag pro.” Second-level malware and run it.
Breaking corporate networks
The infection chain begins with a phishing email that was developed for the target organization and is intended to be a message from a trusted partner.
The email contains a password protected ZIP or RAR attachment with a Microsoft Excel file [.XLSM] linked to a malicious macro. Running this code creates an executable file in the Flag pro home directory.
When first run, Flagpro connects to the C2 server over HTTP and sends the system identification details obtained by executing hard-coded operating system commands.
In response, the C2 can send additional commands or a second-level payload that Flag pro can execute.
An example of a command sent Source: NTT Security
Communication between the two is base64 encoded and there is also a configurable delay between connections to avoid creating an identifiable operating model.
Communication between Flagpro and the C2 Source: NTT Security
Flagpro has been used against Japanese companies for more than a year, no later than October 2020, according to a report by NTT Security.
The most recent samples the researchers were able to obtain are from July 2021. The target companies belong to a variety of industries, including defense technology, media and communications.
At some point in their analysis, NTT researchers noticed a new version of Flag pro that can automatically close the relevant dialog boxes to make external connections that could reveal its presence to the victim.
“In the Flag pro v1.0 implementation, if a dialog box titled ‘Windows セ キ ュ リ テ ィ’ appears when Flagpro accesses an external site, Flagpro will automatically click the OK button to close the dialog” explains NTT’s security report. “This handling also works if the dialogue is written in Chinese or in English indicates that the destinations are in Japan, Taiwan and English-speaking countries.
Embedded code serving as obfuscation in Flagpro v2.0 Source: NTT Security
Blackwell APT is a lesser-known player discovered by Trendier researchers in the summer of 2017 and has partnered with China. His typical targets are in Taiwan, although he has occasionally targeted companies in Japan and Hong Kong to steal technology.
In February 2021, a report from Unit 42 linked Blackwell to Waterbear Flag pro, another cyber espionage group believed to have the backing of the Chinese government such as Apt, Black tech, Knowledge and Refinement to adapt its tools to new reports such as this, Flag. pro is likely to be modified for more stealth use.
As NTT’s report concludes, “Recently they (Blackwell) started using another new malware called Selfsame Loader and Spider RAT. “That means they are actively developing new malware. Defenders should be aware of the new indicators of exposure to new malware and follow all security best practices to maintain a strong defense against sophisticated threats like Blackwell.
Fountain: Computer ringing