FortiGuard Labs is aware of a report that APT group “Billbug” compromised a certificate authority (CA) as well as multiple government and defense organizations in Asia. Also known as Lotus Blossom and Thrip, the APT group reportedly has been active since 2009 and uses custom backdoor malware “Hannotog” and “Sagerunex” as well as available tools in compromised machines.Why is this Significant?This is significant because Billbug APT threat actor group targeted a certificate authority (CA). Should digital certificates be compromised, the attacker could use them to sign malware for detection evasion by security solutions and eavesdrop on HTTPS communications.Also, the reports indicate that multiple organizations in government and defense sectors in Asia were compromised by Billbug APT. What is Billbug APT?Billbug, Lotus Blossom and Thrip, is a threat actor that has been reportedly active since at last 2009 and has interests in U.S. organizations as well as government, defense, and communications organizations in Southeast Asia. Their primary motive is thought to be information espionage.Billbug APT employs living-off-the-land techniques and uses custom malware. The tools that were reportedly used by Billbug APT are the following:Hannotog backdoorSagerunex backdoorAdFindCertutilLogMeInMimikatzNBTscanPingPort ScannerPowerShellPsExecRouteTracertWinmailWinRARWinSCPWhat is the Status of Coverage?FortiGuard Labs detects the files in the report with the following AV signatures:W32/Agent.QTP!trW32/Elsentric.J!trW32/Generic.A!trW32/PossibleThreatW64/Agentb.F!trW64/Agent.LF!trW64/Elsentric.E!trW64/Elsentric.G!trMalicious_Behavior.SBPossibleThreat.PALLAS.HRiskware/Kryptik
More Stories
USN-6751-1: Zabbix vulnerabilities
It was discovered that Zabbix incorrectly handled input data in the discovery and graphs pages. A remote authenticated attacker could...
USN-6752-1: FreeRDP vulnerabilities
It was discovered that FreeRDP incorrectly handled certain memory operations. If a user were tricked into connecting to a malicious...
ruby-3.2.4-182.fc38
FEDORA-2024-48bdd3abbf Packages in this update: ruby-3.2.4-182.fc38 Update description: Upgrade to Ruby 3.2.4. Read More
ruby-3.2.4-182.fc39
FEDORA-2024-31cac8b8ec Packages in this update: ruby-3.2.4-182.fc39 Update description: Upgrade to Ruby 3.2.4. Read More
chromium-124.0.6367.78-1.el9
FEDORA-EPEL-2024-0c24da3136 Packages in this update: chromium-124.0.6367.78-1.el9 Update description: update to 124.0.6367.78 * Critical CVE-2024-4058: Type Confusion in ANGLE * High...
chromium-124.0.6367.78-1.fc38
FEDORA-2024-2c9be9d949 Packages in this update: chromium-124.0.6367.78-1.fc38 Update description: update to 124.0.6367.78 * Critical CVE-2024-4058: Type Confusion in ANGLE * High...