Researchers uncovers malware toolset used by APT group Earth Aughisky

Share post:

Trend Micro researchers have uncovered the malware toolset of the Chinese cyber espionage group Earth Aughisky, known for compromising legitimate accounts, software, applications and other weaknesses in network design and infrastructure.

The gang uses spear phishing as an entry-level method, using several tools, including a remote access trojan named Taidoor (aka Roudan) to deploy next-stage backdoors.

Some other backdoors that Earth Aughisky has used over the years are: SiyBot, a basic backdoor that uses public services like Gubb and 30 Boxes for command-and-control (C2); TWTRAT, which abuses Twitter’s direct messaging feature for C2; and DropNetClient (aka Buxzop), which uses the Dropbox API for C2.

The gang has been linked to several families of malware, including GrubbyRAT, K4RAT, LuckDLL, Serkdes, Taikite and Taleret, as part of their efforts to evade detection.

The ransomware gang primarily targets organizations in Taiwan, but the investigation confirmed an expansion into Japan. Among the most frequently attacked industries are government, telecommunications, manufacturing, heavy industry, technology, transportation and healthcare.

The sources for this piece include an article in TheHackerNews.


Related articles

London hospitals cancel over 800 operations after ransomware attack

NHS England disclosed today that a recent ransomware attack on Synnovis has led to the cancellation of hundreds...

Microsoft cancels universal Recall release in favor of Windows Insider preview

Microsoft has decided to cancel the wide release of Recall, the controversial tool for Copilot+ PCs, and instead...

Cyber Security Today, Week in Review for week ending Friday, June 14, 2024

Welcome to Cyber Security Today. This is the Week in Review for the week ending Friday, June 14th,...

Cyber Security Today, June 14, 2024 – Employee downloaded a file that led to hospital chain’s ransomware attack

An employee downloaded a file that led to hospital chain's ransomware attack Welcome to Cyber Security Today. It's Friday...

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways