👴🏾 👩🏾‍🔧 👴🏻 Higaisa or Winnti? How We Defined Backdoor Ownership 👋🏾 🧑🏾 🎮

While monitoring information security threats in May 2020, Positive Technologies experts discovered several new samples of malware (malware). At first glance, they should have been attributed to the Higaisa group, but detailed analysis showed that they should be associated with the Winnti group (also known as APT41, according to FireEye).

Detailed monitoring also revealed many other instances of the APT41 group malware, including backdoors, droppers, loaders, and injectors. We also found samples of a previously unknown backdoor (we called it FunnySwitch) with atypical peer-to-peer messaging functionality. A detailed report is presented here , and in this article we will tell you about how our research began.

Introduction

The first attack that attracted the attention of experts was dated May 12, 2020.

The malicious file used in it is an archive named Project link and New copyright policy.rar (c3a45aaf6ba9f2a53d26a96406b6c34a56f364abe1dd54d55461b9cc5b9d9a04). The archive contains a decoy document in PDF format (Zeplin Copyright Policy.pdf), as well as a folder All tort's projects - Web lnks with two shortcuts: