LuoYu employs Man-on-the-side attack to plant backdoor

A sophisticated Chinese APT actor dubbed LuoYu has been observed using a malicious Windows tool called WinDealer that allows the actor to modify network traffic in-transit to insert malicious payloads

LuoYu primarily targets foreign diplomatic organizations established in China and members of the academic community as well as financial, defense, logistics, and telecommunications companies.

Advertisements

The attack campaigns have used the malware to target Japanese entities, with isolated infections reported in Austria, Germany, India, Russia, and the U.S.

PlugX and its successor ShadowPad, are the tools present in the arsenal both of which have been used by a variety of Chinese threat actors to enable their strategic objectives.

WinDealer, has been delivered in the past via websites that act as watering holes and in the form of trojanized applications masquerading as instant messaging and video hosting services like Tencent QQ and Youku.

WinDealer, a modular malware platform at its core, associated with a backdoor, allowing it to hoover sensitive information, take screenshots, and execute arbitrary commands. It uses IP generation algorithm for selecting a C2 server from a random group of 48000 IP addresses

The improper network behaviors can be predicted by assuming the existence of a man-on-the-side attacker who is able to intercept all network traffic and even modify it.

A man-on-the-side attack, is as same as man-in-the-middle attack, that allows a rogue attacker to read and inject arbitrary messages into a communications channel, but not modify or delete messages sent by other parties.

Researchers raised an eyebrow, that threat actor is able to control such a massive range of IP addresses could show us the sophistication in hijacking of the update mechanism associated with genuine apps to deliver the WinDealer payload.