Winnti (APT41): The cyber-security firm QuoIntelligence (QuoInt) outlined new malware strains which they linked to APT41, a Chinese threat group that has been known to target gaming companies in the past. The malware that researchers analyzed included the string “Ox1A0: Gravity,” where Gravity is the name of the parent company of the Massively Multiplayer Online Role-playing Game (MMORPG) Ragnarok, which enabled researchers to know who the victim was. The malware is known as the “Winnti Dropper,” which is used in initial attacks against companies to gain access. QuoInt initially discovered the malware from a German virus scanner and assessed that the malware was used to target a German chemical company, according to a different string in a variant of Winnti Dropper. The analysis showed an unreported Command and Control (C2) technique that was not attributed to Winnti before: tunneling communication through DNS using a custom implementation of the iodine source code. Iodine is open-source software that enables the tunneling of IPv4 data through a DNS server.
Using Microsoft Sentinel to Detect Confluence CVE-2022-26134 Exploitation
Binary Defense
July 27, 2022
By Akshay Rohatgi and Randy Pargman About this Student Research Project Binary Defense’s mission is
