Rewterz Threat Alert – China’s Threat Actor Group BlackFly Targets Materials Sector – Active IOCs

Severity

High

Analysis Summary

The Blackfly espionage group, also known as APT41, Winnti Group, or Bronze Atlas, is a sophisticated threat actor group that has been active since at least 2010 and is one of the longest-known Chinese APT groups. The group has used a variety of malware families, including PlugX/Fast, Winnti/Pasteboy, and Shadowpad, to target a wide range of industries and sectors, including the computer gaming industry, semiconductor, telecoms, materials manufacturing, pharmaceutical, media, and advertising, hospitality, natural resources, fintech, and food sectors.

The recent targeting of two subsidiaries of an Asian conglomerate operating in the materials and composites sector suggests that the group may be attempting to steal intellectual property. Intellectual property theft is a common motivation for cyber espionage groups, as stolen IP can be used to gain a competitive advantage or to sell on the black market. 

“Although the group’s technological skill has remained consistent, there has been a frequent refreshing of its toolset, no doubt in an attempt to keep ahead of detection,” says Dick O’Brien, chief intelligence analyst at Symantec Threat Hunter.

To avoid penetration by Blackfly and other APTs aiming at stealing IP, Symantec recommends deploying an overall in-depth protection strategy and implementing multifactor authentication (MFA) throughout the company network. Implement strong security controls, such as firewalls, intrusion detection and prevention systems, and security information and event management (SIEM) solutions, as well as conducting regular security assessments and employee training. 

Impact

• Theft Of Intellectual property (IP).

Indicators of Compromise

MD5

• babd407c16b7dda93ef7044081845c8c
• 68215ef5e7f8650d4e9542acbd7719ab

SHA-256

• 100cad54c1f54126b9d37eb8c9e426cb609fc0eda0e9a241c2c9fd5a3a01ad6c
• bd739804e7a6e43a4338495603d96e230c48e020435c334354bb6676b5beeb46

SHA-1

• 1a11f2896f3ba7895404e62a7ca5797d59853e04
• 5587d2a33b69bf1f1107223a0cf752714f6e985e

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets
• Adopt multifactor authentication (MFA) across the enterprise network
• Along with network and system hardening, code hardening should be implemented within the organization so that their websites and software are secure. Use testing tools to detect any vulnerabilities in the deployed codes.