Unknown Chinese APT Targets Russia with the PortDoor Malware

Advanced Persistent Threat (APT) actors continue with their attacks against high-profile targets. This time, the news headlines mention a new piece of malware identified as PortDoor. It is believed to be used and developed by a China-based APT actor and, so far, it has been used in attacks against several Russian sectors, the most notable of which is the defense sector. One of the targets was the Rubin Design Bureau – high-ranking employees were approached through spear-phishing emails that contained a maliciously crafted RTF document. Just like other China-based threat actors, these ones also rely on the RoyalRoad RTF builder utility.

The features of the PortDoor Malware are not very spectacular, but this malware shines with other things – it seems that its developers have emphasized a stealthy design, which allows the threat to try to conceal its presence and activity. The threat is able to identify popular virtual environments and cease its execution, therefore making it more difficult to dissect the malware.

The PortDoor Malware focuses on espionage. Its operators have access to the following features:

  • List all running processes.
  • Manage the file system.
  • Read disk partition information.
  • Search for files.
  • Find, encrypt, and exfiltrate data.

So far, the PortDoor Malware attack against the Russian defense sector has not been attributed to a particular Chinese APT. However, experts note that the PortDoor Malware's properties and network infrastructure hint that high-profile threat actors like TA428 or Rancor could be associated with the attack.

May 3, 2021
Loading...

Cyclonis Backup Details & Terms

The Free Basic Cyclonis Backup plan gives you 2 GB of cloud storage space with full functionality! No credit card required. Need more storage space? Purchase a larger Cyclonis Backup plan today! To learn more about our policies and pricing, see Terms of Service, Privacy Policy, Discount Terms and Purchase Page. If you wish to uninstall the app, please visit the Uninstallation Instructions page.

Cyclonis Password Manager Details & Terms

FREE Trial: 30-Day One-Time Offer! No credit card required for Free Trial. Full functionality for the length of the Free Trial. (Full functionality after Free Trial requires subscription purchase.) To learn more about our policies and pricing, see EULA, Privacy Policy, Discount Terms and Purchase Page. If you wish to uninstall the app, please visit the Uninstallation Instructions page.