Chinese Groups Use Ransomware As Lure For Cyber Espionage

Share post:

Threat analysts from Secureworks have uncovered the activities of two Chinese hacking groups that use ransomware as a decoy for cyber espionage. Ransomware as a decoy allows attackers to cover their tracks, complicate attribution, and distract defenders.

The two cluster of hacker activities are “Bronze Riverside” (APT41), and “Bronze Starlight” (APT10). Both use the HUI Loader to deploy remote access trojans, PlugX, Cobalt Strike and QuasarRAT.

It is unclear whether these ransomware families were developed as decoys to hide other malicious activities. Nothing is certain, because all the discussed ransomware strains are based on publicly available leaked codes.

According to the researchers, “Bronze Starlight” may be creating short-lived ransomware strains just to disguise its cyber espionage operations as a ransomware attack. This is because the five ransomware strains (LockFile, AtomSilo, Rook, Night Sky and Pandora0 used during attacks never posed a significant threat.

The cyber activities therefore serve as a reminder of the need to set up robust ransomware detection and protection mechanisms. Systems should also be thoroughly inspected post-cleanup.

The sources for this piece include an article in BleepingComputer.

Featured Tech Jobs


Related articles

Cyber Security Today, Week in Review for week ending Friday, Feb. 23, 2024

This episode features discussion on the takedown of the LockBit ransomware gang

Breaking news: RCMP facing ‘alarming’ cyber attack

The RCMP is facing a serious cyber attack from an unspecified threat actor. The Mounties told CBC News today that a “breach of this magnitude is alarming.” “The situation is evolving quickly but at this time, there is no impact on RCMP operations and no known threat to the safety and security of Canadians,” a spokesperson

Leaked documents may show the inside of China’s hacking strategy

Documents apparently stolen by disgruntled employees to embarrass their firm may give insight into China's cyber

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways