The Kaspersky Lab Global Research and Analysis Team (GReAT) has discovered several infections from a previously unknown Trojan, which is most likely related to the infamous Chinese-speaking threat actor \u2013 LuckyMouse.<\/p>\n
The most peculiar trait of this malware is its hand-picked driver, signed with a legitimate digital certificate, which has been issued by a company developing information security-related software.<\/p>\n
The LuckyMouse group is known for highly targeted cyberattacks on large entities around the world. The group\u2019s activity is posing a danger to whole regions, including South-Eastern and Central Asia, as their attacks seem to have a political agenda.<\/p>\n
Judging by victim profiles and the group\u2019s previous attack vectors, Kaspersky Lab researchers think that the Trojan they\u2019ve detected might have been used for nation-state backed cyber-espionage.<\/p>\n
The Trojan discovered by Kaspersky Lab experts infected a target computer via a driver built by the threat actors. This allowed the attackers to execute all common tasks such as command execution, downloading and uploading files, and to intercept network traffic.<\/p>\n
The driver turned out to be the most interesting part of this campaign. To make it trustworthy, the group apparently stole a digital certificate, which belongs to an information security-related software developer and used this to sign malware samples. This was done in an attempt to avoid being detected by security solutions, as a legitimate signature makes the malware look like legal software.<\/p>\n
Another noteworthy feature of the driver is that despite Luckymouse\u2019s ability to create its own malicious software, the software used in the attack appeared to be a combination of publicly available code samples from the public repositories and custom malware.<\/p>\n
Such simple adoption of a ready-to-use third-party code, instead of writing original code, saves developers time and makes attribution more difficult.<\/p>\n
\u201cWhen a new LuckyMouse campaign appears, it\u2019s almost always around the same time as the leadup to a high-profile political event, and the timing of an attack usually precedes world leader summits. The actor isn\u2019t too worried about attribution \u2013 because they are now implementing third-party code samples into their programs, it\u2019s not time-consuming for them to add another layer to their droppers, or to develop a modification for the malware and still remain untraced,\u201d notes Denis Legezo, security researcher at Kaspersky Lab.<\/p>\n