TinyNote Backdoor Employed by Chinese Threat Actor

Camaro Dragon, a Chinese nation-state group, has once again been connected to a new backdoor that serves its intelligence-gathering objectives.

According to Israeli cybersecurity company Check Point, which named the malware TinyNote, it operates as an initial payload capable of basic machine enumeration and command execution via PowerShell or Goroutines.

Although the malware may lack sophistication, it compensates by employing redundant techniques to maintain access to compromised hosts, including multiple persistency tasks and diverse communication methods with various servers.

Camaro Dragon overlaps with another Chinese state-sponsored group called Mustang Panda, which has been active since at least 2012.

Recently, this collective drew attention with a customized firmware implant known as Horse Shell, which transforms TP-Link routers into a mesh network, enabling the transmission of commands to and from command-and-control (C2) servers.

In essence, the objective is to obfuscate malicious activity by using compromised home routers as intermediary infrastructure, allowing communication with infected computers to appear to originate from a different node.

Chinese Threat Actors Diversify Their Toolkit

These latest findings demonstrate the increasing sophistication of evasion tactics and targeting employed by the attackers, as well as the wide range of custom tools used to breach the defenses of various targets.

The TinyNote backdoor is distributed using filenames related to foreign affairs, such as "PDF_Contacts List Of Invitated Deplomatic Members," and appears to target embassies in Southeast and East Asia. Notably, this is the first known instance of a Mustang Panda artifact written in Golang.

One notable aspect of this malware is its ability to bypass Smadav, an antivirus solution in Indonesia, indicating the attackers' high level of preparedness and deep understanding of their victims' environments.

According to Check Point, the backdoor is a display of Camaro Dragon's targeted approach and the considerable effort they put into infiltrating their intended targets. The use of the backdoor alongside additional tools with different levels of advancement suggests that the threat actors are broadening their attack arsenal.

In a separate discovery, ThreatMon found that APT41 (also known as Wicked Panda) employed living-off-the-land (LotL) techniques to deploy a PowerShell backdoor using a legitimate Windows executable called "forfiles."