{"id":35749,"date":"2020-06-25T13:00:00","date_gmt":"2020-06-25T13:00:00","guid":{"rendered":"https:\/\/www.darkreading.com\/threat-intelligence\/goldenspy-malware-hidden-in-tax-software-spies-on-companies-doing-business-in-china\/d\/d-id\/1338174"},"modified":"2020-06-25T13:00:00","modified_gmt":"2020-06-25T13:00:00","slug":"goldenspy-malware-hidden-in-tax-software-spies-on-companies-doing-business-in-china","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/goldenspy-malware-hidden-in-tax-software-spies-on-companies-doing-business-in-china\/","title":{"rendered":"‘GoldenSpy’ Malware Hidden in Tax Software Spies on Companies Doing Business in China"},"content":{"rendered":"
\n<\/header>\n

Advanced persistent threat (APT) campaign aims to steal intelligence secrets from foreign companies operating in China.<\/span> <\/p>\n

A newly discovered attack campaign infiltrated a UK-based technology company via tax payment software required by a Chinese bank in order to conduct business in China.<\/p>\n

Researchers at Trustwave found the so-called GoldenSpy malware during a threat-hunting operation on behalf of the victim UK company in mid-April. The UK company, which Trustwave did not disclose in its newly published research, has strong ties to the defense industry and does significant business in the US, Australia, and the UK; it recently opened operations in China.<\/p>\n

Brian Hussey, Trustwave’s vice president of cyber threat detection and response, says the attackers used a backdoor to take control of the UK company’s network. To date, Trustwave has confirmed other such incidents at a software\/technology company as well as at a major global financial institution.<\/p>\n

“They [the attackers] could run Windows commands, create new users, move laterally and upload code to execute malware,” Hussey says. “They could also potentially use the network access to exfiltrate data.”<\/p>\n

Hussey would not confirm the attackers were agents of the Chinese government, but did say they were motivated more by intelligence than financial gain. <\/p>\n

“Companies need to understand that there are risks to doing business in China and these kinds of attacks are possible,” he says. “Once the attack was discovered, we segmented the network so the UK company could use the tax payment software to pay its local taxes, but the attackers no longer had access to the full network.”<\/p>\n

The Trustwave report<\/a> goes on to lay out a pattern of suspicious behavior by GoldenSpy:<\/p>\n