German intelligence agency warns of China-linked APT27 targeting commercial organizations

The BfV German domestic intelligence services warn of ongoing attacks carried out by the China-linked APT27 cyberespionage group.

The Bun­des­amt für Ver­fas­sungs­schutz (BfV) federal domestic intelligence agency warns of ongoing attacks coordinated by the China-linked APT27 group.

“The Federal Office for the Protection of the Constitution ( BfV ) has information about an ongoing cyber espionage campaign by the cyber attack group APT27 using the malware variant HYPERBRO against German commercial companies.” reads the advisory published by the German intelligence.

The APT27 group (aka Emissary Panda, TG-3390, Bronze Union, and Lucky Mouse) has been active since 2010, it targeted organizations worldwide, including U.S. defense contractors, financial services firms, and a national data center in Central Asia.

The group was involved in cyber espionage campaigns aimed at new generation weapons and in surveillance activities on dissidents and other civilian groups. APT27 has been exploiting vulnerabilities in Microsoft Exchange and in the Zoho AdSelf Service Plus1 software since March 2021.

The cyber espionage group leverage both readily available tools and custom malware in their operations, many tools are available for years, but in recent attacks, their code was updated.

German intelligence warns of Chinese nation-state actors targeting commercial organizations with HyperBro remote access trojans (RAT). The attacks aim at stealing sensitive data from the victims and attempt to launch supply chain attacks targeting their customers.

HyperBro is a custom in-memory backdoor used by the APT27 group to maintain persistence on the victims’ networks.

Below is the HyperBro infection chain detailed in the report published by BfV:

“It cannot be ruled out that the actors, in addition to stealing business secrets and intellectual property, also try to infiltrate the networks of (corporate) customers or service providers ( supply chain attack).” continues the advisory.

The German intelligence experts believe that the threat actors will continue to target the German economy, for this reason, they shared Indicators of Compromise and Yara rules to help defenders in protecting their networks from this threat.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, APT27)