CarderBee APT Group into limelight

Researchers have discovered an unknown APT group attacking organizations in Asia, particularly Hong Kong, using commercial software to deploy backdoor malware.

The group dubbed as CarderBee uses Cobra DocGuard Client, a software package designed to allow users to access and manage their Consolidated Omnibus Budget Reconciliation Act documents to gain access to victim’s machines.

The Cobra DocGuard Client is said to have been designed by Chinese company EsafeNet. That’s where the story gets interesting. CarderBee uses PlugX, a malware family used by Chinese state-backed threat groups.

Advertisements

In this campaign, the APT is targeting the DocGuard software updater to deploy malware, including PlugX. The update arrives as a ZIP file from AWS. which, when decompressed, executes a file named “content.dll,” which downloads the malware.

The downloader used in the attacks includes a Microsoft Windows Hardware Compatibility Publisher digitally signed certificate, making it somewhat more difficult for antivirus and other security software to detect.

Researchers first spotted signs of Carderbee in April. This isn’t the first time Cobra DocGuard Client has been targeted. An ESET report in 2022 detailed that attack to Budworm, also known as LuckyMouse or APT 27, an allegedly Chinese-sponsored state actor.

The timing of the attack may not have been coincidental and has been suggested by some to be part of broader geopolitical tensions.

This research was documented by researchers from Symantec

Indicators of Compromise