Root of the Problem: Examining the Latest Attack on Chinese Gamers

A New Wave of Sophisticated Rootkits Targeting Gaming Users in China

A recent campaign targeting gaming users in China has raised concerns among cybersecurity experts, highlighting the increasing use of sophisticated rootkits by threat actors. These rootkits are designed to hide malicious payloads, disable security tools, and maintain persistence on victim systems. What sets this particular campaign apart is the use of a rootkit with a valid Microsoft digital signature, allowing it to successfully load on systems running recent Windows versions without triggering any security alerts or getting blocked.

Malicious Kernel Driver and Persistence

Researchers at Trend Micro recently discovered a malicious kernel driver that specifically targets gaming users in China. This driver has the ability to download other unsigned kernel mode drivers directly into memory, including one that can shut down Windows Defender software on targeted systems. By disabling the security software, threat actors can deploy their choice of second-stage malware and maintain persistence on the compromised systems.

It is worth noting that this is not an isolated incident. Security researchers have discovered a growing number of Microsoft-signed kernel drivers over the past couple of years, with examples such as PoorTry, NetFilter for IP redirection, and FiveSys. These rootkits have been used for different purposes, including deploying ransomware, redirecting web traffic, and targeting the gaming sector for activities like credential theft and geolocation cheating.

Scope and Capabilities of the New Malware

The researchers at Trend Micro identified the new malware as a standalone kernel driver functioning as a universal rootkit loader. It communicates with command and control servers using the Windows Socket Kernel and uses a Domain Generating Algorithm (DGA) algorithm to generate different domains. If it fails to resolve an address, it connects to hardcoded fallback IPs within the driver. The malware is loaded directly into memory to bypass Windows native driver loaders.

This new malware shares significant similarities with the FiveSys rootkit, including the ability to redirect web browsing traffic to attacker-controlled servers and monitor web traffic. These similarities led researchers to tie the new malware to the FiveSys actor.

Rogue Developer Accounts and Exploited Loopholes

Microsoft has acknowledged the issue of Microsoft-signed malicious drivers and attributes it to rogue developer accounts within its partner program. According to Microsoft, several developer accounts engaged in submitting malicious drivers to obtain a Microsoft signature. In response, the company has suspended these accounts and released updates to detect and block these malicious drivers.

In another development, Cisco Talos reported that threat actors are using open source digital signature timestamp forging tools to alter the signing date on Microsoft drivers and deploy them in large quantities. This activity exploits a loophole in Microsoft’s Windows driver signing policy, which allows the loading of cross-signed kernel mode drivers with signature timestamps prior to July 29, 2015. Threat actors are abusing this exception by signing expired drivers, making them fall within the policy exemption and using them to deploy malware.

Analysis and Recommendation

The emergence of increasingly sophisticated rootkits with valid Microsoft digital signatures raises significant concerns regarding the ability of threat actors to bypass security measures and maintain persistence on compromised systems. The use of rootkits in the gaming sector in China is particularly concerning due to the potential for credential theft and cheating in games, but there is no reason to believe that threat actors won’t exploit these techniques in other regions and for various malicious purposes.

Addressing this issue requires a multi-pronged approach. Firstly, it is imperative that Microsoft takes further steps to enhance the security and vetting process for developers within its partner program. The discovery of rogue developer accounts contributing to the proliferation of malicious drivers is alarming and highlights the need for stricter controls.

Additionally, both users and organizations must prioritize internet security and remain vigilant. This includes keeping all software, including security tools, up to date, and regularly scanning systems for any signs of compromise. Implementing strong endpoint security solutions can provide an added layer of defense against rootkit attacks.

Furthermore, adopting a proactive cybersecurity mindset is crucial. Users should exercise caution when downloading software or files from untrusted sources, especially if they are related to gaming. Engaging in safe online practices, such as using unique passwords for gaming accounts, enabling two-factor authentication, and regularly monitoring account activity, can significantly reduce the risk of falling victim to cyberattacks.

The case of Microsoft-signed malware highlights the need for continuous research and innovation in the field of cybersecurity. As threat actors adapt and employ more sophisticated tactics, it is crucial for security researchers and organizations to stay one step ahead in order to effectively counter these evolving threats.

In conclusion, the prevalence of sophisticated rootkits utilizing valid Microsoft digital signatures is a cause for concern. This latest campaign targeting gaming users in China serves as a reminder of the evolving threat landscape and the need for robust security measures. Vigilance, regular software updates, and proactive cybersecurity practices are crucial to mitigating these risks and protecting both individuals and organizations from malicious attacks.