{"id":47253,"date":"2022-06-24T14:51:23","date_gmt":"2022-06-24T14:51:23","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/33576\/Beijing-Backed-Attackers-Use-Ransomware-As-Decoy-While-They-Conduct-Espionage.html"},"modified":"2022-06-24T14:51:23","modified_gmt":"2022-06-24T14:51:23","slug":"beijing-backed-attackers-use-ransomware-as-decoy-while-they-conduct-espionage","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/beijing-backed-attackers-use-ransomware-as-decoy-while-they-conduct-espionage\/","title":{"rendered":"Beijing-Backed Attackers Use Ransomware As Decoy While They Conduct Espionage"},"content":{"rendered":"

A state-sponsored Chinese threat actor has used ransomware as a distraction to help it conduct electronic espionage, according to security software vendor Secureworks.<\/p>\n

The China-backed group, which Secureworks labels Bronze Starlight, has been active since mid-2021. It uses an HUI loader to install ransomware, such as LockFile, AtomSilo, Rook, Night Sky and Pandora. But cybersecurity firm Secureworks asserts<\/a> that ransomware is probably just a distraction from the true intent: cyber espionage.<\/p>\n

“The ransomware could distract incident responders from identifying the threat actors’ true intent and reduce the likelihood of attributing the malicious activity to a government-sponsored Chinese threat group,” the company argues.<\/p>\n

Secureworks offers its distraction theory after observing Bronze Starlight deploying different ransomware variants for short periods of time \u2013 unusual behaviour, as ransomware gangs generally don’t change their attacks unless it’s necessary to retain their potency. The company also feels that frequent changes to the gang’s ransomwares are a deterrent to researchers, who have little reason to analyze code that’s not in use.<\/p>\n

But the gang has changed its methods at least once, moving from “traditional ransomware” in which infections lead to a demand for payments, to a name-and-shame model in which the gang threatens to expose data if it is not paid.<\/p>\n