Cross-posted from: https://lemmy.sdf.org/post/43105573 > Archived > > Telecommunications and manufacturing sectors in Central and South Asian countries have emerged as the target of an ongoing campaign distributing a new variant of a known malware called PlugX (aka Korplug or SOGU). > > “The new variant’s features overlap with both the RainyDay and Turian backdoors, including abuse of the same legitimate applications for DLL side-loading, the XOR-RC4-RtlDecompressBuffer algorithm used to encrypt/decrypt payloads and the RC4 keys used,” Cisco Talos researchers Joey Chen and Takahiro Takeda said in an analysis published this week. > > The cybersecurity company noted that the configuration associated with the PlugX variant diverges significantly from the usual PlugX configuration format, instead adopting the same structure used in RainyDay, a backdoor associated with a China-linked threat actor known as Lotus Panda (aka Naikon APT). It’s also likely tracked by Kaspersky as FoundCore and attributed to a Chinese-speaking threat group it calls Cycldek. > > […]