New EagerBee Campaign Targeting Middle Eastern Organizations

Hackers are deploying an updated strain of EagerBee malware to target internet service providers and government organizations in the Middle East, warn security researchers.

See Also: The Healthcare CISO’s Guide to Medical IoT Security

EagerBee operates in memory and comes with advanced stealth and security evasion capabilities. The latest version uncovered by Kaspersky has plugins capable of exfiltrating a range of information, the report said.

Based on the malware infrastructure deployed in the campaign, Kaspersky researchers believe the new variant is linked to the CoughingDown threat group. Details of the group are sparse, with some researchers linking the variant to a Chinese threat group tracked as TA428.EagerBee was first spotted by security firm Elastic in 2023 as part of a campaign targeting organizations in Mongolia. The framework, estimated to have been active since 2022, has been previously linked to a Chinese threat group tracked as LuckyMouse, Emissary Panda and APT27.

Kaspersky could not verify the initial vector used by the hackers but said two of the victims were compromised through Microsft Exchange ProxyLogon flaw.

“The initial access vector used by the attackers remains unclear. However, we observed them executing commands to deploy the backdoor,” the researchers said.

The hackers deployed the malware using a remote desktop configuration called . Once activated, the variant collects system information and retrieves proxy host and port information.

“If proxy details are available, the backdoor connects through the proxy; otherwise it connects to the C2 server directly.

The malware then establishes a connection using a TCP socket to share exfiltrated system information. The malware server deploys a payload known as the plugin orchestrator to the system memory that checks if the plugin is loaded.

The plugin orchestrator installs additional file, process, remote access and network manager plugins for performing activities ranging from moving or copying files to terminating existing processes.

Patching the ProxyLogon flaw remains the immediate step to curb the latest EagerBee campaigns, Kaspersky said.