chinese espionage group deploys windows systems

#CHINESE ESPIONAGE GROUP DEPLOYS WINDOWS SYSTEMS KEYGEN#

This can help Daxin establish connectivity on networks with strict firewall rules, and may lower the risk of discovery. The malware can be both the initiator and the target of a key exchange.Ī successful key exchange opens an encrypted communication channel for receiving commands and sending responses. It can then perform a custom key exchange with the remote peer, where two sides follow complementary steps. When the patterns are detected, it disconnects the legitimate recipient and takes over the connection. It can hijack legitimate TCP/IP connections by monitoring all incoming TCP traffic for certain patterns. However, its real value, said the researchers, lies in its stealth and communications capabilities. What makes Daxin different to other malware?ĭaxin allows attackers to perform operations on infected computers like reading and writing arbitrary files, as well as starting arbitrary processes and interacting with them. It also features network tunnelling, allowing attackers to communicate with legitimate services on the victim’s network that can be reached from any infected computer.

#CHINESE ESPIONAGE GROUP DEPLOYS WINDOWS SYSTEMS KEYGEN#

Attackers can select an arbitrary path across infected computers and send a single command that instructs them to establish requested connectivity. The malware avoids starting its own network services but can abuse any legitimate services already running on the infected computers.ĭaxin can also relay its communications across a network of infected computers within the attacked organisation. Its capabilities led researchers to believe the attackers invested significant effort into developing communication techniques that can blend in unseen with normal network traffic on the target’s network. Symantec said these features are reminiscent of Regin, an advanced espionage tool it discovered in 2014 that has been linked to Western intelligence services. It implements advanced communications functionality, which gives it a high degree of stealth and allows attackers to communicate with infected computers on highly secured networks, where direct internet connectivity is not available.

Daxin comes in the form of a Windows kernel driver, which is a relatively rare format for malware nowadays.

Chinese espionage group deploys windows systems