• bunee
• October 6, 2023
• No Comments

Semiconductor Companies in East Asia Targeted by Doppelgänger

• Threat actors are presently baiting semiconductor companies in East Asia using decoys pretending to be Taiwan Semiconductor Manufacturing Company (TSMC).
• This tactic, called Cobalt Strike beacons, is designed to lure their targets in.
• The scheme has been observed and analyzed by EclecticIQ, who reveals that it employs a backdoor software called HyperBro.
• The threat actors use HyperBro as a passageway to deploy commercial attack simulation software and a post-exploitation tool kit.

Dangerous Imitators: Threat Actors Pose as TSMC

You remember the old saying, “imitation is the sincerest form of flattery?” Well, these threat actors took it too far! Recent reports indicate that threat actors are targeting semiconductor companies in East Asia by pretending to be someone they’re not – specifically, the Taiwan Semiconductor Manufacturing Company (TSMC). It’s as sneaky as swapping out chocolate chip cookies for raisin ones when your back is turned!

Cobalt Strike Beacons: Not a Friendly Signal

The threatening theatrics don’t stop with the mask of TSMC; they even have a bait-and-trap strategy. These threat actors use something called Cobalt Strike beacons. It sounds like a sci-fi video game power-up, but it’s actually a ploy to draw in unsuspecting victims. Kind of like when you “accidentally” let your kid win that game of chess to boost their morale, these actors are playing you for the fool.

The Secret Passageway: HyperBro Backdoor

Now, here’s where the plot thickens. The tricksters leverage another trick called the HyperBro backdoor. It’s kind of like a hidden tunnel in those spy movies that leads to an arsenal of high-tech gear. Only in this case, the arsenal is a load of tools designed to exploit you, not equip you. And this is no James Bond helping you save the day – it’s more like a villain trying to steal it from you.

Dreaded Deployment: Attack Simulation Software and Post-Exploitation Toolkit

Last but not least, with their backdoor ajar, the threat actors deploy commercial attack simulation software and a post-exploitation toolkit. It’s a bit like the kid who sneaks into their dad’s tool shed to build a “secret project”, only this time the “project” is your company’s downfall!

Summarizing the Situation

Tricky threat actors are targeting East Asian semiconductor firms, posing as the TSMC. Using a tactic called Cobalt Strike beacons to lure unsuspecting victims, they then hack into systems using a cloaked backdoor called HyperBro. This open gate allows them to unleash commercial attack simulation software and a post-exploitation toolkit, much like the world’s sneakiest child breaking into their dad’s tool shed. Stay alert, folks – it seems imitation isn’t always flattery after all!

Original Article: https://thehackernews.com/2023/10/chinese-hackers-target-semiconductor.html