BLOODALCHEMY Backdoor Deployed Against Asian Countries
Security experts have detected a covert entry point employed in assaults against governments and institutions within the Association of Southeast Asian Nations (ASEAN).
Termed "BLOODALCHEMY" by researchers from Elastic Security Labs, this backdoor specifically targets x86 systems and is linked to the REF5961 intrusion set, which has recently been adopted by a group with connections to China.
An intrusion set is a term that categorizes established strategies, methods, and tools associated with an attack and the campaigns in which these attacks are deployed. Typically, these intrusion sets are used by a single unidentified attacker, and the toolset of REF5961 has been witnessed in a separate espionage-focused attack on the Mongolian government.
BLOODALCHEMY is the novel backdoor used by the operators of REF5961. Nevertheless, despite the belief that skilled malware developers have worked on this program, it is still considered a work in progress.
Although it functions as a strain of malware, and is part of the three recently discovered malware families within REF5961, its capabilities are still quite limited.
Elastic stated in a blog post that while it is not completely certain, the malware could be a part of a bigger toolkit still in development.
Researchers have only been able to identify a few impactful commands, such as the ability to write or overwrite the malware toolkit, launch the malware program, uninstall and terminate it, and collect host information.
The uninstall command reveals the various methods BLOODALCHEMY employs to maintain a presence on the targeted system. The backdoor duplicates itself into its persistence folder by creating a new directory called "Test," within which resides "test.exe" - the malware binary. The choice of the persistence folder depends on the level of privileges granted to BLOODALCHEMY and could be one of four possible folders: ProgramFiles, ProgramFiles(x86), Appdata, or LocalAppData\Programs.
Furthermore, BLOODALCHEMY has demonstrated its ability to establish persistence through various means. Notable capabilities include a "classic" method for concealing data through string encryption along with additional obfuscation techniques, as well as multiple operational modes.
Depending on the configuration of the malware, it can function within the primary thread or a separate one, operate as a service, or introduce shellcode after initiating a Windows process.
BLOODALCHEMY Part of REF5961 Intrusion Set
BLOODALCHEMY is part of the REF5961 intrusion set, which encompasses three new malware families used in ongoing attacks. These malware families have been associated with earlier attacks due to shared victim profiles, toolsets, and execution patterns noted in multiple campaigns against ASEAN members. Researchers strongly suspect that the operators of REF5961 are aligned with China.
Malware samples within REF5961 have also been identified in a previous intrusion set, REF2924, which is believed to have been employed in attacks against ASEAN members, including the Mongolian Ministry of Foreign Affairs.
