A known cyber espionage group believed to be operating out of China was last year spotted using new malware in an attack aimed at an organization that provides services to the U.K. government.
Details about the attack were presented last week at Kaspersky’s Security Analyst Summit (SAS) in Cancun by Ahmed Zaki, senior malware researcher at NCC Group.
The attack has been attributed to a threat actor known as APT15, Ke3chang, Mirage, Vixen Panda and Playful Dragon. NCC Group started analyzing the group’s recent activities after it targeted one of its customers, a global company that provides a wide range of services to the United Kingdom government.
Researchers believe the attackers had been targeting various U.K. government departments and military technology through its customer. NCC has not made any statements regarding attribution, but Zaki did mention during his presentation at SAS that APT15 was particularly active during hours that correspond to working hours in East Asia.
organizations all around the world using its own malware and Word, Adobe Reader and Java exploits. The group has improved its tools and techniques over the years, and NCC recently spotted two new backdoors it created.
One of the backdoors has been dubbed RoyalCLI and is considered a successor of BS2005, a piece of malware that is often used by the group. RoyalCLI leverages similar encryption and encoding routines, and they both communicate with command and control (C&C) servers via Internet Explorer using the IWebBrowser2 interface.
The malware uses the Windows command prompt (cmd.exe) to execute a majority of its commands. It’s designed to copy the cmd.exe file and modify it, which allows it to bypass policies that might prevent the command prompt from running on the targeted device.
The second backdoor, named RoyalDNS, uses DNS, specifically TXT records, to communicate with the C&C server. This piece of malware receives commands, executes them, and returns output through DNS.
In the case of the attack
Tags: 
SOCIAL SHARE CARD GENERATOR