This newly discovered malware campaign is attributed to a Chinese hacking group called Tropic Trooper.
Cybersecurity researchers at Check Point have shared details of a new malware campaign suspected to be launched by a Chinese hacking group Tropic Trooper.
The malware operators are using a unique loader Nimbda, written in Nim language, and a new variant of Yahoyah trojan.
Researchers state that the hackers possess extensive cryptographic knowledge as they have extended the AES specification in a customized implementation.
Info-Stealing Trojan Embedded in SMS Bomber Tool
According to Check Point’s analysis, the info stealing trojan is hidden inside a Chinese language greyware tool called SMS Bomber. This tool is used for targeting cellphones with Denial of Service attacks (DoS attacks).
SMS Bomber tool allows users to enter any phone number to flood their phones with a message, rendering the devices unusable. Novice hackers typically use such tools to compromise websites.
When the infected version of SMS Bomber (equipped with standard functionalities and the tool’s binary) is downloaded to the device, the attack sequence is immediately initiated. The downloaded tool also contains additional coding injected into a notepad.exe process.
In a blog post, researchers explained that This executable is