[SecListe]Winnti returns with PlugX

[igor51]

Winnti returns with PlugX

Continuing our investigation into Winnti, in this post we describe how the group tried to re-infect a certain gaming company and what malware they used.

After discovering that the company-s servers were infected, we began to clean them up in conjunction with the company-s system administrator, removing

malicious files from the corporate network. This took a while because it was not clear at first exactly how the cybercriminals had penetrated the corporate

network; we couldn-t find a way to completely stop attacks penetrating the network and malicious files kept appearing. An analysis performed by the gaming

company itself led us to the conclusion that the infection started after establishing working contacts with a South Korean gaming company. This was also

confirmed by our research: as we wrote before, the Winnti group is most active in East Asia and we identified 14 infected gaming companies in South Korea.

In the course of our efforts to remove the infection, the gaming company sent us suspicious files that were appearing on their computers. Many of these

files were samples of Winnti malware. As soon as information about the malicious files was added to our antivirus databases, our products were used to remove

Winnti malware from the gaming company-s corporate network. However, the attackers reacted very rapidly: new malware samples mysteriously appeared on

computers from which the infection had been completely removed the previous day. Eventually, though, our efforts proved successful and further access to the

gaming company-s computers was denied to the attackers.

However, just as we expected, it was too early to celebrate. Exactly one month after the gaming company-s network had been cleaned, the Winnti group

returned. The system administrator sent us suspicious files, which had been attached to messages sent to company employees. This was run-of-the-mill

spearphishing: the attackers introduced themselves as computer game developers and pretended to be looking for opportunities related to working with large

publishers.

Source: Winnti returns with PlugX