Unknown Chinese APT Targets Russia with the PortDoor Malware
Advanced Persistent Threat (APT) actors continue with their attacks against high-profile targets. This time, the news headlines mention a new piece of malware identified as PortDoor. It is believed to be used and developed by a China-based APT actor and, so far, it has been used in attacks against several Russian sectors, the most notable of which is the defense sector. One of the targets was the Rubin Design Bureau – high-ranking employees were approached through spear-phishing emails that contained a maliciously crafted RTF document. Just like other China-based threat actors, these ones also rely on the RoyalRoad RTF builder utility.
The features of the PortDoor Malware are not very spectacular, but this malware shines with other things – it seems that its developers have emphasized a stealthy design, which allows the threat to try to conceal its presence and activity. The threat is able to identify popular virtual environments and cease its execution, therefore making it more difficult to dissect the malware.
The PortDoor Malware focuses on espionage. Its operators have access to the following features:
- List all running processes.
- Manage the file system.
- Read disk partition information.
- Search for files.
- Find, encrypt, and exfiltrate data.
So far, the PortDoor Malware attack against the Russian defense sector has not been attributed to a particular Chinese APT. However, experts note that the PortDoor Malware's properties and network infrastructure hint that high-profile threat actors like TA428 or Rancor could be associated with the attack.
