The cyber espionage group APT (Advanced Persistent Threat) Blackwell has been targeting Japanese companies with a new type of malware that researchers call “Flag pro”. Second level malware and run it.
Breaching corporate networks
The chain of infection begins with a phishing e-mail that was developed for the target organization and pretends to be a message from a trusted partner.
The e-mail contains a password-protected ZIP or RAR attachment with a Microsoft Excel file [.XLSM] linked to a malicious macro. Running this code creates an executable file in the Flag pro home directory.
When it first runs, Flagpro connects to the C2 server over HTTP and sends the system identification details obtained by executing hard-coded operating system commands.
In response, the C2 can send additional commands or a second-level payload that Flag pro can execute.
An example of a sent command Source: NTT Security
Communication between the two is base64 encoded, and there is also a configurable delay between connections to avoid creating an identifiable operating model.
Communication between Flagpro and the C2 Source: NTT Security
Flagpro has been used against Japanese companies for more than a year, at the latest since October 2020, according to a report by NTT Security.
atOptions = { ‘key’ : ‘302372165fcdeb117a0acc3571473224’, ‘format’ : ‘iframe’, ‘height’ : 250, ‘width’ : 300, ‘params’ : {} }; document.write(”);
The most recent samples the researchers were able to obtain are from July 2021. The target companies are from a variety of industries, including defense, media and communications technology.
Flagpro v2.0
At some point in their analysis, NTT researchers noticed a new version of Flag pro that can automatically close relevant dialog boxes to make external connections that could reveal their presence to the victim.
“In the Flag pro v1.0 implementation, if a dialog box titled ‘Windows セ キ ュ リ テ ィ’ appears when Flagpro is accessing an external site, Flagpro will automatically click the OK button to close the dialog box” explains NTT Security report. “This handling also works if the dialog is written in Chinese or English indicates destinations are in Japan, Taiwan, and English-speaking countries.
Inserted code serving as obfuscation in Flagpro v2.0 Source: NTT Security
Blackwell APT is a lesser known player discovered by Trendier researchers in the summer of 2017 and has partnered with China. His typical targets are in Taiwan, although he has occasionally targeted companies in Japan and Hong Kong to steal technology.
atOptions = { ‘key’ : ‘2da69df5e5a1c7f1621066a1f7e69b57’, ‘format’ : ‘iframe’, ‘height’ : 90, ‘width’ : 728, ‘params’ : {} }; document.write(”);
In February 2021, a report from Unit 42 linked Blackwell to Waterbear Flag pro, another cyber espionage group believed to have the backing of the Chinese government like Apt, Black tech, Knowledge and Refinement to adapt their tools to new reports like this one, Flag pro is likely to be modified for more stealth use.
atOptions = { ‘key’ : ‘504b591a28719b1270e09aa4045e24ab’, ‘format’ : ‘iframe’, ‘height’ : 250, ‘width’ : 300, ‘params’ : {} }; document.write(”);
As the NTT report concludes, “Recently they (Blackwell) started using another new malware called Selfsame Loader and Spider RAT. “That means they are actively developing new malware. Defenders should be aware of the new indicators of exposure to new malware and follow all security best practices to maintain a strong defense against sophisticated threats like Blackwell.
Source: Bleeping Computer