Chinese APT15 hackers use new Graphican backdoor

The Chinese hackers which are tracked as APT15 are involved in a new campaign that uses a backdoor with the name “Graphican“. The campaign was active from late 2022 to early 2023.

Graphican backdoor

The team of researchers suggests that the Graphican backdoor represents an evolved version of an older malware previously utilized by the hackers, rather than a fresh creation. Its noteworthy attributes include the use of Microsoft Graph API and OneDrive to subtly retrieve its command and control (C2) infrastructure addresses in an encrypted format, thereby ensuring versatility and resilience against potential disruptions.

The full suite of commands that the C2 can dispatch for execution by Graphican encompasses:

‘C’ — Establish an interactive command line controlled by the C&C server
‘U’ — Generate a file on the remote computer
‘D’ — Transfer a file from the remote computer to the C&C server
‘N’ — Initiate a new process with a concealed window
‘P’ — Launch a new PowerShell process with a hidden window, store the results in a temporary file in the TEMP folder, and transfer the results to the C&C server

Different instruments Symantec’s researchers noticed in APT15’s newest marketing campaign are:

• EWSTEW – Customized APT15 backdoor extracting emails from contaminated Microsoft Trade servers.
• Mimikatz, Pypykatz, Safetykatz – Publicly out there credential-dumping instruments that exploit Home windows single sign-on to extract secrets and techniques from reminiscence.
• Lazagne – An open-source device capable of retrieve passwords from a number of functions.
• Quarks PwDump – Dumps several types of Home windows credentials. Documented since 2013.
• SharpSecDump – A .Web port of Impacket’s secretsdump.py, used for dumping distant SAM and LSA secrets and techniques.
• K8Tools – A toolset that includes privilege escalation, password cracking, scanning, vulnerability utilization, and varied system exploits.
• EHole – Weak methods identification.
• Net shells – AntSword, Behinder, China Chopper, Godzilla, giving the hackers backdoor entry to the breached methods.
• CVE-2020-1472 exploit – Elevation of privilege vulnerability affecting the Netlogon Distant Protocol.

In conclusion, the latest exercise of APT15 and the refresh of its customized backdoor reveals that the Chinese language hacking group stays a menace to organizations worldwide, bettering its instruments and dealing on making its operations stealthier.

Indicators of Compromise

IOCS captured by symantec blog :

‍Follow Us on: Twitter, Instagram, Facebook to get the latest security news!