Cybercrime , Fraud Management & Cybercrime

Financially Motivated Hacks by Chinese-Speaking Actors Surge

These Hackers May Equal or Surpass Threat Posed by Russian Hackers, Researchers Say
Financially Motivated Hacks by Chinese-Speaking Actors Surge
Image: Shutterstock

Chinese-speaking hackers associated with criminal activity have redoubled efforts to target compatriots with malware to remotely control victim computers, pointing to a worrying surge in financially driven activity in the Sino cyber underworld.

See Also: OnDemand | 2024 Phishing Insights: What 11.9 Million User Behaviors Reveal About Your Risk

Researchers at Proofpoint said they've spotted a "minor resurgence" of the Sainbox remote access Trojan as well as a newly identified Trojan they dub "ValleyRAT" being delivered through emails usually written in Chinese. The lures typically relate to business themes such as invoices, payments and new products, and the malware is hidden in Excel documents and PDFs or malicious links. Sainbox, also known as FatalRAT, is a variant of the commodity malware Gh0st RAT, which researchers first identified in 2008.

The emergency of novel and older Chinese-themed malware suggests that financially motivated Chinese hackers may come to equal or surpass the threat posed by Russian hackers, Proofpoint said. Western nations routinely accuse Russia of permitting a criminal underground to fester inside its border (see: Western Capitals Riled by Russian Hacking).

The United States associates Chinese hacking more closely with cyberespionage and intellectual property theft, although some state-sponsored hackers have moonlighted by conducting financially motivated attacks on the side.

One reason for Proofpoint's warning over the mounting threat of Sino criminal hacking is that the Trojans showing up in the inboxes of Chinese speakers don't appear to come from a single entity but rather "a cluster of activity." It's possible that multiple threat actors are using the same infrastructure to deliver multiple malware families, Proofpoint said. Further, "these recently identified activity clusters have demonstrated flexible delivery methods, leveraging both simple and moderately complex techniques."

In all, Proofpoint observed more than 30 separate campaigns "leveraging malware typically associated with Chinese cybercrime activity." Besides Sainbox and the novel ValleyRAT, researchers also saw hackers deploying Purple Fox malware.

Hackers behind the activity also appear to have ambitions to branch out from Chinese-speaking victims. In one campaign, they targeted Japanese organizations.


About the Author

Prajeet Nair

Prajeet Nair

Assistant Editor, Global News Desk, ISMG

Nair previously worked at TechCircle, IDG, Times Group and other publications, where he reported on developments in enterprise technology, digital transformation and other issues.




Around the Network

Our website uses cookies. Cookies enable us to provide the best experience possible and help us understand how visitors use our website. By browsing govinfosecurity.com, you agree to our use of cookies.