Tick APT Group Targets East Asia

Researchers have discovered a new malware campaign targeting an East Asian company that develops data-loss prevention (DLP) software for government and military entities has been attributed to the APT group known as Tick.

Threat actor has breached the internal update servers to deliver malware within its network. It then trojanized legitimate tool installers used by the firm, leading to malware being executed on two of its customers’ computers.

During the intrusion, the attackers deployed downloader named ShadowPy, and they also deployed the Netboy backdoor and Ghostdown downloader.

Advertisements

Active since 2006, Tick employing a unique custom malware toolset created for persistent access in compromised machines, as well as reconnaissance, data exfiltration and additional tool download.

In the latest report, Tick activity found it exploiting the Proxy Logon vulnerability to compromise a South Korean IT company, as one of the groups with access to that remote code execution exploit before the vulnerability was publicly disclosed.

Attack duration.

The attack was spotted in March 2021. The hackers would have deployed malware that month, and weeks later began introducing trojanized copies of the Q-Dir installers.
The APT group then compromised the targeted company’s network in June and September 2021, transferring the trojanized Q-dir installers to customers of the compromised company in February and June 2022.