{"id":6806,"date":"2025-01-06T13:42:30","date_gmt":"2025-01-06T19:42:30","guid":{"rendered":"https:\/\/www.darkreading.com\/cyberattacks-data-breaches\/eagerbee-backdoor-middle-east-isps-government-targets"},"modified":"2025-01-06T13:42:30","modified_gmt":"2025-01-06T19:42:30","slug":"eagerbee-backdoor-takes-flight-against-mideast-isps-government-targets","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2025\/01\/06\/eagerbee-backdoor-takes-flight-against-mideast-isps-government-targets\/","title":{"rendered":"EagerBee Backdoor Takes Flight Against Mideast ISPs, Government Targets"},"content":{"rendered":"
<\/a><\/div>\n
<\/div>\n

An unknown attacker is wielding an updated version of a <\/span>backdoor<\/a><\/span> malware that was previously deployed against high-profile Southeast Asian organizations in targeted attacks, this time against ISPs and governmental entities in the Middle East.<\/span><\/p>\n

Researchers at Kaspersky have detected a new variant of the EagerBee backdoor outfitted with various new components in attacks that demonstrate a significant evolution of the malware framework, <\/span>they revealed<\/a><\/span> in a blog post published today.<\/span><\/p>\n

EagerBee is primarily designed to operate in memory to enhance its stealth capabilities and help it evade detection by traditional endpoint security solutions, according to Kaspersky. It’s also unique in that it obscures its command shell activities by injecting malicious code into legitimate processes that are executed within the context of explorer.exe or the targeted user’s session.<\/span><\/p>\n

“These tactics allow the malware to seamlessly integrate with normal system operations, making it significantly more challenging to identify and analyze,” Kaspersky senior security researcher Saurabh Sharma wrote in the post.<\/span><\/p>\n

A previous variant of the malware was seen in attacks by a a trio of Chinese state-aligned threat clusters, which previously collaborated in <\/span>Operation Crimson Palace<\/a><\/span> to steal sensitive military and political secrets from a high-profile government organization in Southeast Asia.<\/span><\/p>\n

Related:<\/span>US Soldier Arrested in Verizon, AT&T Hacks<\/a><\/p>\n

The latest version of EagerBee that was used in the Middle East attacks features several new advanced features, including a novel service injector designed to inject the backdoor into a running service, and a slew of previously undocumented plug-ins that can be deployed after the backdoor’s installation.<\/span><\/p>\n

“These enabled a range of malicious activities such as deploying additional payloads, exploring file systems, executing command shells, and more,” Sharma wrote.<\/span><\/p>\n

Who Are the Cyberattackers Behind EagerBee?<\/h2>\n

Previous researchers had attributed EagerBee to Chinese threat group <\/span>Iron Tiger<\/a><\/span> (aka Emissary Panda or APT27), one of numerous groups that <\/span>often collaborate<\/a><\/span> with other China-backed state-sponsored actors; that tends to make specific attribution of both attacks and malware murky.<\/span><\/p>\n

Case in point: Kaspersky’s latest analysis of the backdoor deployed in the Middle East attributes EagerBee to a different Chinese actor, CoughingDown. That’s because there was a creation of services on the same day via the same Web shell to execute EagerBee and the CoughingDown Core Module in one of the attacks researchers analyzed, according to Sharma. Moreover, the researchers observed overlap in the command-and-control (C2) domain used both by EagerBee and the CoughingDown Core Module in the attack.<\/span><\/p>\n

Related:<\/span>Volkswagen Breach Exposes Data of 800K EV Customers<\/a><\/p>\n

Further evidence discovered in the Middle East attacks linking EagerBee to CoughingDown includes code overlap in a malicious DLL file used in the attack with a multiplug-in malware developed by CoughingDown in late September 2020, according to Sharma. “We assess with medium confidence that the EagerBee backdoor is related to the CoughingDown threat group,” he wrote.<\/span><\/p>\n

EagerBee Backdoor Malware’s Advanced Features<\/h2>\n

The Kaspersky team identified key new plug-in features of EagerBee that are all run by a plug-in orchestrator module to execute commands that perform various malicious activities.<\/span><\/p>\n

The orchestrator exports a single method responsible for injecting the module into memory and subsequently calling its entry point. In addition to victim-specific data collected by the malware, this plug-in gathers and reports various other information \u2014 such as current usage of physical and virtual memory, system locale and time-zone settings, and Windows character encoding \u2014 about the infected system to the C2 server.<\/span><\/p>\n

After transmitting this information, the plug-in orchestrator also reports whether the current process has elevated privileges and then collects details about all running processes on the system. Once the information is sent, the plug-in orchestrator waits for commands to execute, which are carried out by the various backdoor plug-ins.<\/span><\/p>\n

Related:<\/span>‘Bad Likert Judge’ Jailbreak Bypasses Guardrails of OpenAI, Other Top LLMs<\/a><\/p>\n

These include a file manager plug-in that is responsible for, among other things, renaming, moving, copying, and deleting files; reading and writing files to and from the system; and injecting additional payloads into memory. Another process manager plug-in lists running processes in the system; launches new modules and executes command lines; and terminates existing processes.<\/span><\/p>\n

Two other plug-ins found in the novel variant include a remote access manager that facilitates and maintains remote connections while also providing command shell access, and a service manager that manages system services, including installing, starting, stopping, deleting, and listing them.<\/span><\/p>\n

Malware Sophistication Demands Cyber Defender Vigilance<\/h2>\n

Despite links to CoughingDown, Kaspersky researchers could not determine the initial infection vector for the deployment of EagerBee.<\/span><\/p>\n

In the previous attacks using the backdoor in Asia, attackers leveraged the now infamous <\/span>Exchange ProxyLogon flaw<\/a><\/span> as the initial entry point; however, there is no evidence of this in the attacks here, according to Kaspersky. However, the researchers still recommend that defenders promptly patch ProxyLogon to secure their network perimeter, as it “remains a popular exploit method among attackers to gain unauthorized access to Exchange servers,” Sharma noted.<\/span><\/p>\n

Overall, the emergence of a fortified variant of EagerBee in attacks in the Middle East demonstrates how attackers continue to advance malware frameworks in terms of both ability to evade detection and the sheer breadth of malicious functionality they can achieve, demanding that organizations also up their security game, he said.<\/span><\/p>\n

Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

An unknown attacker is wielding an updated version of a<\/p>\n","protected":false},"author":12,"featured_media":6807,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1],"tags":[809],"class_list":["post-6806","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-dark-reading"],"featured_image_urls":{"full":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/eagerbee-backdoor-takes-flight-against-mideast-isps-government-targets.png?fit=1440%2C810&ssl=1",1440,810,false],"thumbnail":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/eagerbee-backdoor-takes-flight-against-mideast-isps-government-targets.png?resize=150%2C150&ssl=1",150,150,true],"medium":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/eagerbee-backdoor-takes-flight-against-mideast-isps-government-targets.png?fit=300%2C169&ssl=1",300,169,true],"medium_large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/eagerbee-backdoor-takes-flight-against-mideast-isps-government-targets.png?fit=640%2C360&ssl=1",640,360,true],"large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/eagerbee-backdoor-takes-flight-against-mideast-isps-government-targets.png?fit=640%2C360&ssl=1",640,360,true],"1536x1536":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/eagerbee-backdoor-takes-flight-against-mideast-isps-government-targets.png?fit=1440%2C810&ssl=1",1440,810,true],"2048x2048":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/eagerbee-backdoor-takes-flight-against-mideast-isps-government-targets.png?fit=1440%2C810&ssl=1",1440,810,true],"chromenews-featured":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/eagerbee-backdoor-takes-flight-against-mideast-isps-government-targets.png?fit=1024%2C576&ssl=1",1024,576,true],"chromenews-large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/eagerbee-backdoor-takes-flight-against-mideast-isps-government-targets.png?resize=825%2C575&ssl=1",825,575,true],"chromenews-medium":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/eagerbee-backdoor-takes-flight-against-mideast-isps-government-targets.png?resize=590%2C410&ssl=1",590,410,true]},"author_info":{"display_name":"Dark Reading","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/darkreading\/"},"category_info":"Uncategorized<\/a>","tag_info":"Uncategorized","comment_count":"0","jetpack_featured_media_url":"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/eagerbee-backdoor-takes-flight-against-mideast-isps-government-targets.png?fit=1440%2C810&ssl=1","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/6806","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=6806"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/6806\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media\/6807"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=6806"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=6806"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=6806"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}