Ankura CTIX FLASH Update - September 22, 2023

Malware Activity

Latest Earth Lusca Activity Involves New Linux Backdoor "SprySOCKS"

"SprySOCKS", a new Linux backdoor, has been observed in Earth Lusca's latest activity, involving the targeting of government agencies in various countries. Earth Lusca is a Chinese espionage-focused threat group that has been active in the first half of 2023, typically targeting "key government entities focused on foreign affairs, technology, and telecommunications in Southeast Asia, Central Asia, the Balkans, and worldwide." Researchers noted that Earth Lusca has been recently targeting victim organizations' public-facing servers by exploiting known n-day vulnerabilities, including Fortinet flaws (CVE-2022-40684 and CVE-2022-39952), Microsoft Exchange ProxyShell flaws (CVE-2021-34473, CVE-2021-34523v, and CVE-2021-31207), and more. Once the threat group infiltrates the victim's networks through the server vulnerabilities, a web shell is deployed, and Cobalt Strike is installed