Multiple government entities targeted by China-linked Daxin malware

For a detailed advisory, download the pdf file here

A technologically advanced and previously undocumented malware Daxin was used as the advanced persistent threat (APT) weapon by China-linked actor against government critical infrastructures across the globe. This malware can read and write arbitrary files, start and interact with arbitrary processes, and perform advanced lateral movement and stealth.

Daxin malware is a sophisticated rootkit backdoor with complicated, stealthy command and control (C2) features that allowed remote actors to communicate with secured devices that were not directly connected to the internet. This malware communicates with legitimate services through network tunneling and uses daisy-chain communication that provides it the ability to move internally via hops between several linked computers. The malware appears to be designed for the use against hardened targets, allowing actors to dig deeply into targeted networks and exfiltrate data without raising suspicions. Organizations can look for the Indicators of Compromise listed down below.

The Mitre TTPs used by Daxin malware in the current attack are:

TA0007: Discovery

TA0009: Collection

TA0006: Credential Access

T1056: Input Capture

T1049: System Network Connections Discovery

Indicators of Compromise (IoCs)

References