- Security researchers see new piece of malware called J-Magic
- It listens to traffic in the expectation of a “magic package”
- When J-Magic, once it is discovered
Hackers have been shown to target companies in semiconductors, energy, manufacture and the sectors, with a unique piece of malware called J-Magic, experts have warned.
A new report from the Black Lotus team at Lumen Technologies did not reveal named threat actors recycled CD00R-a stealth.
The repurposed Trojan, called “J-Magic”, was inserted into enterprise quality Juniper routers who served as VPN gateways. The researchers do not know how the final points were infected, but in any case the Trojan sat silently until the attackers sent it a “magical” TCP package.
Seaspy2 and CD00R
“If any of these parameters or” magic packages “are received, the agent will return a secondary challenge. When this challenge is completed, J-Magic establishes a reverse must be on the local file system so that operators can control the device, steal data or implement malicious software, ”the researchers explained.
The campaign was first discovered in September 2023 and lasted about until mid -2024. Black Lotus couldn’t say who the threat actors were, but said elements of the activity “share some technical indicators” with a subgroup of prior reporting about a malware family named Seaspy2.
“However, we do not have enough data points to connect these two campaigns with great confidence,” they said.
In any case, SEASPY2 is also built on CD00R and works similarly – scanning for magic packages. This sustained, passive back door, masked as a legitimate Barracuda service called “Barracudamailservice”, allows threat actors to perform arbitrary commands on compromised Barracuda Email Security Gateway (ESG) appliances.
Seaspy was apparently built by UNC4841, a Chinese threat actor.
Via Bleeping computer
