Spyware Campaign Targets Sino Minority Groups via WeChat

A possible Chinese-state threat group is targeting vulnerabilities in messaging apps to deliver spyware in cross-platform devices used by members of ethnic minorities targeted for repression by Beijing.

See Also: 5 Ways Exabeam Helps Eliminate Compromised Credential Blindspots

Trend Micro researchers uncovered a threat group it dubbed “Earth Minotaur” using the Moonshine exploit kit alongside a previously unreported backdoor that enables bad actors to to carry out long-term surveillance operations. The threat actors mainly targets individuals in the Tibetans and Uyghur communities. The United States in 2022 accused the Chinese government of committing genocide and crimes against humanity against Uyghurs.

Trend Micro researchers first observed Moonshine deployment in 2019 and on Thursday reported an upgraded version with enhanced capabilities and stronger protections against security analysis.

Earth Minotaur utilizes the exploit kit to deploy a backdoor, dubbed “DarkNimbus” on Android and Windows devices. The kit targets the popular Chinese language WeChat messaging app. Moonshine also exploits multiple vulnerabilities in Chromium-based browsers and applications.

The exploit kit uses Chrome browser vulnerabilities to deploy payloads designed to steal sensitive data from compromised devices. It targets applications such as Google Chrome, Naver, and messaging apps like Line, QQ, and Zalo, focusing on those that incorporate in-app browsers.

The University of Toronto’s Citizen Lab first traced the Moonshine kit’s operator to a threat actor it tracks Poison Carp, which is linked to other threat groups tracked as Evil Eye and Earth Empusa.

The attacks start with curated messages designed to entice victims into clicking a malicious link, often disguised as government announcements or news topics related to China. The attackers impersonate different characters in chat conversations to enhance the effectiveness of their social engineering tactics.

The malicious links direct victims to one of at least 55 Moonshine exploit kit servers, which install the DarkNimbus backdoor on the devices. These deceptive URLs appear harmless, pretending to be related to China-based announcements or videos showcasing Tibetan or Uyghur music and dance. After the exploit is executed, the server redirects the victim to the legitimate link, masking any unusual activity to avoid detection by the user.

Moonshine targets vulnerabilities in Chromium-based browsers, including Tencent Browser Server used within applications like WeChat. If the Tencent browser based on Chromium isn’t vulnerable to any of the exploits used by Moonshine, the kit’s server will display a phishing page. This page tricks WeChat users by claiming their in-app browser is outdated, prompting them to update it by clicking a malicious download link.

The DarkNimbus payload acts as a surveillance tool for Android devices and collects basic information about the device, installed apps, geolocation and then steals personal data such as contacts, call logs, SMS, clipboard content, browser bookmarks and messaging app conversations. DarkNimbus can record calls, take photos and screenshots, perform file operations and execute commands.

The updated version of the Moonshine exploit kit includes the CVE-2020-6418 exploit, a type confusion vulnerability in the V8 JavaScript engine, which was weaponized as a zero-day and patched by Google in February 2020.