Connect with us

Tech

Stealth Gelsemium cyberspies linked to NoxPlayer supply chain attack

Published

on

Stealth Gelsemium cyberspies linked to NoxPlayer supply chain attack

ESET researchers have linked a sneaky cyber espionage group known as Gelsemium to the attack on the supply chain of the Android emulator NoxPlayer that targeted gamers earlier this year.

The hacking group’s activity dates back to 2014 when some of its malicious tools were discovered by G DATA SecurityLabs while investigating a targeted cyber espionage campaign (called Operation TooHash) with spear-phishing technology.

Two years later, in 2016, new Gelsemium indicators of compromise appeared on a Verint Systems presentation at HITCON.

In 2018, VenusTech sleepless Malware samples from an unknown APT group linked to Operation TooHash, which ESET later discovered to be early versions of Gelsemium malware.

The group is known for targeting governments, faith-based organizations, electronics manufacturers and universities in East Asia and the Middle East, but has largely gone unnoticed.

Orientation to gelsemium
Gelsemium Orientation (ESET)

Malware deployed using multiple attack vectors

ESET researchers today revealed that they also found early versions of the group’s “complex and modular” Gelsevirine backdoor while investigating various campaigns since mid-2020.

“Gelsemium uses three components and a plug-in system to provide operators with a range of information gathering capabilities: the Gelsemine dropper, the Gelsenicine charger, and the Gelsevirine core plug-in,” ESET revealed.

According to reports from G DATA and Verint Systems, cyber spies used phishing emails with attached documents that exploited the Microsoft Office vulnerability CVE-2012-0158 to deliver the malware.

VenusTech also observed them using troughs configured on intranet servers in 2018, while ESET detected them using a RCE exploit for pre-authentication against vulnerable Exchange servers to implement web shells.

Their list of tactics also includes the use of dynamic DNS (DDNS) domain names for command and control servers to make it difficult to track the infrastructure since they don’t come with a list of newly created domains.

“The entire Gelsemium chain may seem simple at first glance, but the exhaustive number of configurations, implemented at each stage, can modify the configuration of the final payload on the fly, making it more difficult to understand,” he said. ESET researcher Thomas Dupuy. added in a report released today.

Gelsemium attack flow
Gelsemium Attack Flow (ESET)

Linked to a supply chain attack targeting gamers

ESET researchers believe Gelsemium is the APT group that coordinated the supply chain attack that compromised and abused the Android emulator update NoxPlayer for Windows and macOS (with over 150 million users) to infect computer systems. players between September 2020 and January 2021..

Fortunately, this attack on the supply chain (dubbed Operation NightScout) only affected a limited set of targets from Taiwan, Hong Kong and Sri Lanka, indicating the highly specific nature of the operation.

This, in itself, makes Gelsemium’s attack on NoxPlayer stand out, as not many threat actors are targeting gamer community targets.

“The investigation uncovered some overlap between this supply chain attack and the Gelsemium group. The victims originally compromised by that supply chain attack were later compromised by Gelsemine.” The ESET white paper reads.

“Unfortunately, we did not see links as strong as that of one campaign dropping or unloading a payload that belongs to the other campaign, but we conclude, with medium confidence, that Operation NightScout is related to the Gelsemium group.”

Continue Reading
Advertisement
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Advertisement
Advertisement

Lifestyle

A 5-Step Breathing Exercise to Fall Asleep A 5-Step Breathing Exercise to Fall Asleep
LifeStyle8 hours ago

A 5-Step Breathing Exercise to Fall Asleep

Simple breathing to soften Once you’ve settled into bed, try a simple breathing exercise to relax. The four-seven-eight breathing technique...

How to know when to throw something away How to know when to throw something away
LifeStyle9 hours ago

How to know when to throw something away

Healer and counselor Peggy Fitzsimmons, who has been helping people eliminate garbage from their lives for fifteen years, suggests that...

Why Crystal Therapy Serums and Mats Are Fun Why Crystal Therapy Serums and Mats Are Fun
LifeStyle9 hours ago

Why Crystal Therapy Serums and Mats Are Fun

Goop beauty editors Jean Godfrey-June and Megan O’Neill love asking and answering questions. On their podcast, The Beauty Closet, they...

What are therapeutic repairs?  |  Goop What are therapeutic repairs?  |  Goop
LifeStyle9 hours ago

What are therapeutic repairs? | Goop

Therapeutic reparations are about providing therapy to black, brown and indigenous people, since racial trauma is inherent in the black,...

The 7 best vegetables and how to cook them The 7 best vegetables and how to cook them
LifeStyle10 hours ago

The 7 best vegetables and how to cook them

In association with our friends from Willo Green leafy vegetables are dietary powerhouses. They can provide vitamins, minerals, antioxidants and...

Music therapy and aging |  Goop Music therapy and aging |  Goop
LifeStyle10 hours ago

Music therapy and aging | Goop

Most of us have experienced the power of music to connect people, be it at a concert or karaoke night....

Riley Reed’s Sunday night routine will inspire yours Riley Reed’s Sunday night routine will inspire yours
LifeStyle11 hours ago

Riley Reed’s Sunday night routine will inspire yours

“I didn’t always know what I wanted to do with my voice, I just knew I had to do something.”...

25 simple ways to cheer up your partner when he’s upset 25 simple ways to cheer up your partner when he’s upset
LifeStyle12 hours ago

25 simple ways to cheer up your partner when he’s upset

We’ve all been through it: you have a bad day at work, or you feel a little bad, maybe you...

20 ideas on how to celebrate the summer solstice and sunbathe 20 ideas on how to celebrate the summer solstice and sunbathe
LifeStyle12 hours ago

20 ideas on how to celebrate the summer solstice and sunbathe

I’ve always been a summer girl. It’s not cozy like fall, alive like winter, or hopeful like spring. Summer stands...

32 cute summer date ideas for every type of couple 32 cute summer date ideas for every type of couple
LifeStyle1 day ago

32 cute summer date ideas for every type of couple

A big date is always in style, but there is something about the summer that makes planning a meeting even...

Advertisement

Sport

Nets’ Kevin Durant Joins Team USA for Tokyo Olympics After Game 7 Loss Against Bucks, Report Says Nets’ Kevin Durant Joins Team USA for Tokyo Olympics After Game 7 Loss Against Bucks, Report Says
Sports5 mins ago

Nets’ Kevin Durant Joins Team USA for Tokyo Olympics After Game 7 Loss Against Bucks, Report Says

Kevin Durant won’t be taking much time off this summer. In fact, he appears ready for more action despite playing...

Yankees seal victory with triple play to tie MLB record Yankees seal victory with triple play to tie MLB record
Sports6 mins ago

Yankees seal victory with triple play to tie MLB record

The New York Yankees set a major league record during their win over the Oakland Athletics on Sunday, and they...

Watch Live: Game 4 of Golden Knights vs.  Canadiens with Steve Dangle Watch Live: Game 4 of Golden Knights vs.  Canadiens with Steve Dangle
Sports20 mins ago

Watch Live: Game 4 of Golden Knights vs. Canadiens with Steve Dangle

We have sent an email with instructions to create a new password. Your current password has not been changed. We...

Reds’ Joey Votto brightens fan day with signed baseball after first inning ejection Reds’ Joey Votto brightens fan day with signed baseball after first inning ejection
Sports26 mins ago

Reds’ Joey Votto brightens fan day with signed baseball after first inning ejection

And now for a healthy baseball story. Reds fans have a very special connection to their team. Several times this...

Saints RB Alvin Kamara has a new job with NASCAR Saints RB Alvin Kamara has a new job with NASCAR
Sports27 mins ago

Saints RB Alvin Kamara has a new job with NASCAR

New Orleans Saints running back Alvin Kamara has turned his NASCAR fandom into a job. On Sunday, Kamara announced that...

McGuire has a four-hit game as the Blue Jays beat the Orioles McGuire has a four-hit game as the Blue Jays beat the Orioles
Sports43 mins ago

McGuire has a four-hit game as the Blue Jays beat the Orioles

Toronto Blue Jays catcher Reese McGuire had four hits, including three doubles, when the Blue Jays defeated the Baltimore Orioles...

When is Halo Infinite coming out?  Release Date, Xbox Exclusive Multiplayer Overview When is Halo Infinite coming out?  Release Date, Xbox Exclusive Multiplayer Overview
Sports50 mins ago

When is Halo Infinite coming out? Release Date, Xbox Exclusive Multiplayer Overview

The seemingly endless wait for the next Halo game is almost over. With E3 in early June, the final details...

Nets’ Kevin Durant is expected to commit to Team USA for the Tokyo Olympics Nets’ Kevin Durant is expected to commit to Team USA for the Tokyo Olympics
Sports51 mins ago

Nets’ Kevin Durant is expected to commit to Team USA for the Tokyo Olympics

The USA Basketball roster is starting to come together. According to The Athletic’s Shams Charania and Anthony Slater, Brooklyn Nets...

Inoue knocks out Dasmariñas;  Donaire-Casimero crash game Inoue knocks out Dasmariñas;  Donaire-Casimero crash game
Sports1 hour ago

Inoue knocks out Dasmariñas; Donaire-Casimero crash game

LAS VEGAS, NEVADA – JUNE 19: Referee Russell Mora cancels the fight between WBA / IBF bantamweight champion Naoya Inoue...

Did Al Horford ‘never really want to leave’ the Celtics in 2019? Did Al Horford ‘never really want to leave’ the Celtics in 2019?
Sports1 hour ago

Did Al Horford ‘never really want to leave’ the Celtics in 2019?

Al Horford is back with the Celtics after being traded by the Oklahoma City Thunder for Kemba Walker, and it...

Advertisement

Entertainment

Will Smith presents the cover and publication date of the first memoir ‘Will’ – News Block Will Smith presents the cover and publication date of the first memoir ‘Will’ – News Block
Entertainment1 min ago

Will Smith presents the cover and publication date of the first memoir ‘Will’ – News Block

Will Smith, who revealed the title and cover of his upcoming autobiography. Want, thanked fans today for the love: The...

Brendan Fraser makes a rare appearance at a new movie premiere Brendan Fraser makes a rare appearance at a new movie premiere
Entertainment9 mins ago

Brendan Fraser makes a rare appearance at a new movie premiere

Actor Brendan Fraser has made a rare appearance in New York at the premiere of his new movie. No sudden...

Is Rea Drummond struggling with “family stress” by hitting the break point? Is Rea Drummond struggling with “family stress” by hitting the break point?
Entertainment19 mins ago

Is Rea Drummond struggling with “family stress” by hitting the break point?

Are Rea Drummond and her husband Ladd in trouble in their marriage? This is the story of one tabloid this...

What is Sony Date Change Wise?  – term What is Sony Date Change Wise?  – term
Entertainment22 mins ago

What is Sony Date Change Wise? – term

As the film industry looks to get back on track at the box office and avoid being the laughing stock...

Kate Chastain overshadows Jean-Luc amid Dani Soares baby daddy rumors Kate Chastain overshadows Jean-Luc amid Dani Soares baby daddy rumors
Entertainment31 mins ago

Kate Chastain overshadows Jean-Luc amid Dani Soares baby daddy rumors

Calling him as she sees him. Below deck alum Kate chastain posted a sarcastic Father’s Day tweet to Sailing yacht...

Soulja Boy flirts with Kim Kardashian after sexy tennis photos Soulja Boy flirts with Kim Kardashian after sexy tennis photos
Entertainment42 mins ago

Soulja Boy flirts with Kim Kardashian after sexy tennis photos

Shooting his shot … again! Soulja boy (real name: DeAndre Cortez Way) shows interest in new single Kim Kardashian against...

Actress, drama coach was 81 years old – News Block Actress, drama coach was 81 years old – News Block
Entertainment45 mins ago

Actress, drama coach was 81 years old – News Block

Ann Willis Ratray, who appeared on Broadway and television before becoming a youth theater coach, including her son, Home aloneDevin...

Usain Bolt welcomes twins with girlfriend Kasi Bennett, reveals their unique names Usain Bolt welcomes twins with girlfriend Kasi Bennett, reveals their unique names
Entertainment54 mins ago

Usain Bolt welcomes twins with girlfriend Kasi Bennett, reveals their unique names

Olympic gold medalist Usain Bolt is now the father of three! The retired Jamaican sprinter, 34, and his partner Kasi...

Bindi Irwin praises Chandler Powell as his best friend Bindi Irwin praises Chandler Powell as his best friend
Entertainment1 hour ago

Bindi Irwin praises Chandler Powell as his best friend

June 19, 2021 Bindi Irwin praised her husband Chandler Powell as her “best friend.” Chandler Powell and Bindi Irwin The...

Vivendi Sells 10% Stake in Universal Music Group to Pershing Square – News Block Vivendi Sells 10% Stake in Universal Music Group to Pershing Square – News Block
Entertainment1 hour ago

Vivendi Sells 10% Stake in Universal Music Group to Pershing Square – News Block

French media giant Vivendi struck a deal to sell a 10% stake in Universal Music Group to billionaire Bill Ackman’s...

Advertisement

Tech

Amazon Prime Day 2021 Echo Speaker Deals: Echo Dot Drops to $ 25, Echo Show 5 Stays at $ 45 Amazon Prime Day 2021 Echo Speaker Deals: Echo Dot Drops to $ 25, Echo Show 5 Stays at $ 45
Tech4 mins ago

Amazon Prime Day 2021 Echo Speaker Deals: Echo Dot Drops to $ 25, Echo Show 5 Stays at $ 45

This story is part of Amazon Prime Day 2021, CNET’s guide to everything you need to know and how to...

Best Prime Day Fire Tablet Deals – Get Record Prices on Fire HD 10 and HD 8 Best Prime Day Fire Tablet Deals – Get Record Prices on Fire HD 10 and HD 8
Tech25 mins ago

Best Prime Day Fire Tablet Deals – Get Record Prices on Fire HD 10 and HD 8

This story is part of Amazon Prime Day 2021, CNET’s guide to everything you need to know and how to...

Best Remotes for Apple TV 2021 Best Remotes for Apple TV 2021
Tech29 mins ago

Best Remotes for Apple TV 2021

Best remote controls for Apple TV Me more 2021 While all Apple TVs come with the Siri Remote, some people...

Act NOW to get an Apple TV 4K for under $ 100 before Prime Day begins Act NOW to get an Apple TV 4K for under $ 100 before Prime Day begins
Tech52 mins ago

Act NOW to get an Apple TV 4K for under $ 100 before Prime Day begins

While we’re all looking forward to some stellar Prime Day Apple TV deals in the days ahead, nothing is certain...

How to move your Mac’s mouse by following your head with a webcam How to move your Mac’s mouse by following your head with a webcam
Tech1 hour ago

How to move your Mac’s mouse by following your head with a webcam

Reduce your dependence on the mouse by using your head, by enabling Head Pointer in macOS to move the cursor...

Best Buy Sunday Flash Sale: Apple Watch Reduced Price, $ 380 60-Inch TV and More Deals Best Buy Sunday Flash Sale: Apple Watch Reduced Price, $ 380 60-Inch TV and More Deals
Tech1 hour ago

Best Buy Sunday Flash Sale: Apple Watch Reduced Price, $ 380 60-Inch TV and More Deals

This story is part of Amazon Prime Day 2021, CNET’s guide to everything you need to know and how to...

Don’t wait for Prime Day!  This iPad mini deal won’t last. Don’t wait for Prime Day!  This iPad mini deal won’t last.
Tech1 hour ago

Don’t wait for Prime Day! This iPad mini deal won’t last.

Apple has a lot of options for you these days when it comes to iPad models, but the price of...

Best Prime Day Laptop Deals: Save $ 500 on the Dell XPS 13, $ 270 on a Gateway Laptop and More Best Prime Day Laptop Deals: Save $ 500 on the Dell XPS 13, $ 270 on a Gateway Laptop and More
Tech2 hours ago

Best Prime Day Laptop Deals: Save $ 500 on the Dell XPS 13, $ 270 on a Gateway Laptop and More

This story is part of Amazon Prime Day 2021, CNET’s guide to everything you need to know and how to...

Act fast to get the badass Beats Solo Pro headphones for half off at Walmart Act fast to get the badass Beats Solo Pro headphones for half off at Walmart
Tech2 hours ago

Act fast to get the badass Beats Solo Pro headphones for half off at Walmart

If you want to listen to Apple Music with Dolby Atmos and high-quality lossless audio, then you will want to...

Sweet Tooth on Netflix: that ending explained and all your questions answered Sweet Tooth on Netflix: that ending explained and all your questions answered
Tech2 hours ago

Sweet Tooth on Netflix: that ending explained and all your questions answered

Christian Convery plays Gus, the 10-year-old half-human, half-deer boy. Netflix If you just finished the heartfelt Netflix fairy tale Greedy,...

Advertisement
Advertisement