- SUPPLY OUT THAT SILVER FOX CRIME GROUP ARE ALREADY TO HOSPITALS PATIENTS
- The group uses counterfeit medical software to install malware
- Legitimation information, sensitive data and crypto then stolen
A Chinese hacking group has been viewed that falsified legitimate medical software to infect patient computers with malware.
The attacks have been attributed by SUPPLY to a group traced as Silver Fox, Void Arachne and the large thief of Valley, using legitimate medical software such as Philips Dicom Medical Image Viewer to implement Valleyyrate Remote Access Tool.
Valleyrat is then used as a back door to implement infostealing malware targeting sensitive data, credentials and cryptocurrency.
Expansion of horizons
As a China-based group, Silver Fox typically has targeted Chinese speakers in previous attacks, but SUPPLY NOTES NOTES MALWARE SAMPLES they have collected show “File names that mimic health applications, English-language executable substances and file posts from the US and Canada suggest, suggest, suggests[ing] That the group may be expanding its targeting against new regions and sectors. “
How Silver Fox gets their malware on the victims’ devices has not yet been determined, but SUPPLY NOTES that previous attacks have seen the group use phishing and SEO poisoning techniques to send their malware.
Once installed, Malware will establish a connection with striker Command and Control (C2) -server using ping.exe, find.exe, cmd.exe and ipconfig.exe. Malware will also run Powershell commands to hide its communication paths from Windows Defender scans.
Malware then retrieves additional payload from the C2 server, such as a security tool that sniffs malware searching the system for antivirus and end point protection software that can detect it and disables them wherever possible. Valleyrat is then implemented, stealing information and extracting them to the C2 server.
Foreskout also notes that although it is not directly targeted at a hospital, but rather the victim’s device, malware still pose a significant risk of patients taking infected devices in medical facilities where malware could spread through unsecured networks and in hospital systems.
Via Thereists
