Hackers Exploiting Remote Desktop Software Flaws to Deploy PlugX Malware

Mar 09, 2023Ravie LakshmananThreat Intelligence / Malware

Security vulnerabilities in distant desktop applications equivalent to Sunlogin and AweSun are being exploited by risk actors to deploy the PlugX malware.

AhnLab Security Emergency Response Center (ASEC), in a new evaluation, stated it marks the continued abuse of the issues to ship quite a lot of payloads on compromised methods.

This contains the Sliver post-exploitation framework, XMRig cryptocurrency miner, Gh0st RAT, and Paradise ransomware. PlugX is the most recent addition to this record.

The modular malware has been extensively put to make use of by risk actors primarily based in China, with new options repeatedly added to assist carry out system management and knowledge theft.

In the assaults noticed by ASEC, profitable exploitation of the issues is adopted by the execution of a PowerShell command that retrieves an executable and a DLL file from a distant server.

This executable is a respectable HTTP Server Service from cybersecurity firm ESET, which is used to load the DLL file by the use of a way referred to as DLL side-loading and finally run the PlugX payload in reminiscence.

“PlugX operators use a excessive number of trusted binaries that are weak to DLL Side-Loading, together with quite a few anti-virus executables,” Security Joes famous in a September 2022 report. “This has been confirmed to be efficient whereas infecting victims.”

The backdoor can be notable for its potential to start out arbitrary companies, obtain and execute recordsdata from an exterior supply, and drop plugins that may harvest information and propagate utilizing Remote Desktop Protocol (RDP).

“New options are being added to [PlugX] even to this present day because it continues to see regular use in assaults,” ASEC stated. “When the backdoor, PlugX, is put in, risk actors can acquire management over the contaminated system with out the data of the consumer.”