Chinese Hackers Using New Stealthy Infection Chain to Deploy LODEINFO Malware

Share:

The Chinese state-sponsored threat actor known as Stone Panda has been observed employing a new stealthy infection chain in its attacks aimed at Japanese entities.

Targets include media, diplomatic, governmental and public sector organizations and think-tanks in Japan, according to twin reports published by Kaspersky.

Stone Panda, also called APT10, Bronze Riverside, Cicada, and Potassium, is a cyber espionage group known for its intrusions against organizations identified as strategically significant to China. The threat actor is believed to have been active since at least 2009.

The group has also been linked to attacks using malware families like SigLoader, SodaMaster, and a web shell called Jackpot against multiple Japanese domestic organizations since April 2021, per cybersecurity firm Trend Micro, which is tracking the group under the name Earth Tengshe.

The latest set of attacks, observed between March and June 2022, involve the use of a bogus Microsoft Word file and a self-extracting archive (SFX) file in RAR format propagated via spear-phishing emails, leading to the execution of a backdoor called LODEINFO.

While the maldoc requires users to enable macros to activate the killchain, the June 2022 campaign was found to drop this method in favor of an SFX file that, when executed, displays a harmless decoy Word document to conceal the malicious activities.

The macro, once enabled, drops a ZIP archive containing two files, one of which (“NRTOLF.exe”) is a legitimate executable from the K7Security Suite software that’s subsequently used to load a rogue DLL (“K7SysMn1.dll”) via DLL side-loading.

The abuse of the security application aside, Kaspersky said it also discovered in June 2022 another initial infection method wherein a password-protected Microsoft Word file acted as a conduit to deliver a fileless downloader dubbed DOWNIISSA upon enabling macros.

coding blue green 1

“The embedded macro generates the DOWNIISSA shellcode and injects it in the current process (WINWORD.exe),” the Russian cybersecurity company said.

DOWNIISSA is configured to communicate with a hard-coded remote server, using it to retrieve an encrypted BLOB payload of LODEINFO, a backdoor capable of executing arbitrary shellcode, take screenshots, and exfiltrate files back to the server.

The malware, first seen in 2019, has undergone numerous improvements, with Kaspersky identified six different versions in March, April, June, and September 2022.

The changes include enhanced evasion techniques to fly under the radar, halting execution on machines with the locale “en_US,” revising the list of supported commands, and extending support for Intel 64-bit architecture.

“LODEINFO malware is updated very frequently and continues to actively target Japanese organizations,” the researchers concluded.

“The updated TTPs and improvements in LODEINFO and related malware […] indicate that the attacker is particularly focused on making detection, analysis and investigation harder for security researchers.”

https://thehackernews.com/2022/11/chinese-hackers-using-new-stealthy.html

Leave a Comment

Your email address will not be published. Required fields are marked *

loader-image
London, GB
5:50 pm, Jul 7, 2025
weather icon 21°C
L: 20° | H: 23°
broken clouds
Humidity: 47 %
Pressure: 1013 mb
Wind: 9 mph NW
Wind Gust: 0 mph
UV Index: 0
Precipitation: 0 mm
Clouds: 62%
Rain Chance: 0%
Visibility: 10 km
Sunrise: 4:52 am
Sunset: 9:18 pm
DailyHourly
Daily ForecastHourly Forecast
Today 10:00 pm
weather icon
20° | 23°°C 0 mm 0% 10 mph 48 % 1013 mb 0 mm/h
Tomorrow 10:00 pm
weather icon
12° | 24°°C 0 mm 0% 12 mph 76 % 1019 mb 0 mm/h
Wed Jul 09 10:00 pm
weather icon
15° | 25°°C 0.2 mm 20% 5 mph 68 % 1023 mb 0 mm/h
Thu Jul 10 10:00 pm
weather icon
19° | 29°°C 0 mm 0% 6 mph 74 % 1024 mb 0 mm/h
Fri Jul 11 10:00 pm
weather icon
19° | 30°°C 0 mm 0% 11 mph 60 % 1023 mb 0 mm/h
Today 7:00 pm
weather icon
21° | 21°°C 0 mm 0% 10 mph 47 % 1013 mb 0 mm/h
Today 10:00 pm
weather icon
18° | 20°°C 0 mm 0% 10 mph 48 % 1013 mb 0 mm/h
Tomorrow 1:00 am
weather icon
15° | 17°°C 0 mm 0% 11 mph 59 % 1014 mb 0 mm/h
Tomorrow 4:00 am
weather icon
12° | 12°°C 0 mm 0% 12 mph 76 % 1015 mb 0 mm/h
Tomorrow 7:00 am
weather icon
15° | 15°°C 0 mm 0% 10 mph 72 % 1016 mb 0 mm/h
Tomorrow 10:00 am
weather icon
18° | 18°°C 0 mm 0% 10 mph 46 % 1017 mb 0 mm/h
Tomorrow 1:00 pm
weather icon
22° | 22°°C 0 mm 0% 8 mph 35 % 1018 mb 0 mm/h
Tomorrow 4:00 pm
weather icon
24° | 24°°C 0 mm 0% 7 mph 29 % 1018 mb 0 mm/h
Name Price24H (%)
Bitcoin(BTC)
€92,244.95
-0.53%
Ethereum(ETH)
€2,159.54
-0.53%
Tether(USDT)
€0.85
-0.02%
XRP(XRP)
€1.99
2.55%
Solana(SOL)
€128.43
-0.84%
USDC(USDC)
€0.85
-0.01%
Dogecoin(DOGE)
€0.143204
-1.48%
Shiba Inu(SHIB)
€0.000010
-2.07%
Pepe(PEPE)
€0.000009
-0.97%
Scroll to Top