A new malicious espionage campaign is targeting telecommunications organizations and governments across Central and Southeast Asia, CheckPoint Research has discovered.
The campaign, which CheckPoint tracks as ‘Stayin’ Alive’, has been active since at least 2021 and is tied to the Chinese cyber espionage group ToddyCat.
The campaign leverages spear-phishing emails to deliver archived files using DLL side-loading schemes, hijacking dal_keepalives[dot]dll in Audinate’s Dante Discovery software (CVE-2022-23748).
CheckPoint also found several loaders and downloaders, some were used as initial infection vectors against high-profile Asian organizations in Kazakhstan, Uzbekistan, Pakistan, and Vietnam.
One of them, CurKeep, is deployed by running the legitimate executable, signed by Zoom, which loads dal_keepalives[dot]dll. The DLL file then loads CurKeep.
No tags.
