Core under the gun: New GhostEmperor methods against EDR solutions

[Carding Forum]

Chinese hackers use their victims partners for spying.

2 years after the last appearance, the Chinese hacker group GhostEmperor has re-established itself. Known for its sophisticated supply chain attacks targeting telecommunications and government entities in Southeast Asia, GhostEmperor has significantly improved its stealth techniques. This was reported by Sygnia in a new report.

Sygnia discovered that GhostEmperor was behind an incident late last year in which an unnamed client's network was compromised and used as a springboard to access another victim's systems. GhostEmperor was first identified by Kaspersky Lab in 2021. Sygnia noted that the lack of public reports about GhostEmperor during this period remains a mystery.

GhostEmperor Infection Chain

GhostEmperor is known for using a kernel - level rootkit, which allows them to avoid detection by security systems, including EDR solutions. Such tools are usually developed by State-sponsored groups because of the resources required to do so. The rootkit provides access to a privileged part of the computer's operating system, the kernel, which makes it difficult to detect for standard security tools.

The Demodex rootkit is basically an updated version of the previous version, but of particular interest was caused by a different infection chain, which has become more complex and secretive. This indicates that GhostEmperor is continuing to develop its methods to ensure maximum stealth.

In 2021, Kaspersky Lab described GhostEmperor as highly skilled hackers who attacked major targets in Malaysia, Thailand, Vietnam, and Indonesia. Additional victims were identified in Egypt, Ethiopia and Afghanistan. Some organizations from these countries have close ties with Southeast Asian countries. It is likely that hackers could have used the infections to spy on the activities of countries of geopolitical interest to the group.

An important aspect of the attack – after breaking into the client's network, hackers attacked the networks of its business partners. Sygnia hopes that the information provided will help organizations better prepare for threats. It is necessary to minimize the time that the enemy is in the environment and speed up the detection process. Although 100% security is not possible, organizations must develop strategies to prevent and mitigate risks.

Source

 

[Carding Forum]

Sygnia warns about the return of the Chinese APT GhostEmperor, which was again lit up for the first time in the last two years.

Elusive and highly secretive, APT is known for its sophisticated supply chain attacks targeting telecom and government organizations in Southeast Asia. And now she's even more secretive.

Sygnia resellers managed to gain access to GhostEmperor during the investigation of a cyber incident at the end of last year, when the network of an unknown client was compromised and used to gain access to the systems of another victim.

GhostEmperor was originally documented by Kaspersky Lab in 2021, but since then, nothing has been known about the activity of APT, whether due to its absence or lack of visibility.

Back then, LK researchers described GhostEmperor hackers as highly skilled and experienced in their field.

Along with many well-known organizations targeted in Malaysia, Thailand, Vietnam, and Indonesia, similar victims were found in Egypt, Ethiopia, and Afghanistan.

At the same time, the last group of victims, who had close ties to Southeast Asian countries, could be used to spy on activities in countries of geopolitical interest to APT.

GhostEmperor is known for using a sophisticated network hacking tool known as a kernel-level rootkit, which not only provides access to the most privileged part of the OS, but also allows you to avoid detection by EDR and other security tools.

According to Sygnia, the tool itself, named by LK as Demodex, was largely an updated version of the previously studied one.

But what was of interest was a completely different infection chain, which shows that GhostEmperor now uses a more sophisticated set of tools and more stealthy methods to download Demodex.

Following the LC report, the group made significant progress in terms of a rather sophisticated way for the rootkit to bypass EDR protection, and stressed that the supply chain aspects of the attack on the Syngia client are of serious concern.

Technical details of the new infection chain with multiple upload schemes and different obfuscation methods, as well as MOK, can be found in the report: https://www.sygnia.co/blog/ghost-emperor-demodex-rootkit/