{"id":5788,"date":"2025-02-18T21:56:02","date_gmt":"2025-02-18T21:56:02","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/china-linked-group-hits-japan-servers\/"},"modified":"2025-02-18T21:56:02","modified_gmt":"2025-02-18T21:56:02","slug":"china-linked-group-hits-japan-servers","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/china-linked-group-hits-japan-servers\/","title":{"rendered":"China-Linked Group Hits Japan Servers"},"content":{"rendered":"\n<\/p>\n
\n

\n
\nNEWS BRIEF<\/span>
\n<\/span>\n<\/p>\n

\n
\nWinnti<\/a>
\n<\/span>
\n, a cyber threat group affiliated with China, has been identified as the perpetrator of a new campaign known as RevivalStone. This campaign has been observed targeting companies in Japan, primarily those operating in the manufacturing, materials, and energy sectors.<\/span>\n<\/p>\n

\nWinnti has been actively engaging in cyber activities since at least 2012. However, it was only in recent years that the group began focusing on organizations within the manufacturing and materials sectors in Asia.<\/span>\n<\/p>\n

\nResearchers at LAC have observed that Winnti’s activities overlap with those of another group known as <\/span>
\n
\nEarth Freybug<\/a>
\n<\/span>
\n, which is a subset of the well-known cyber espionage group <\/span>
\n
\nAPT41<\/a>
\n<\/span>
\n.<\/span>\n<\/p>\n

\nIn its efforts to target organizations in the Asia-Pacific region, Winnti exploits vulnerabilities found in applications such as IBM Lotus Domino. This allows the group to deploy various types of malicious malware, including DEATHLOTUS, UNAPIMON, PRIVATELOG, CUNNINGPIGEON, WINDJAMMER, and SHADOWGAZE.<\/span>\n<\/p>\n

\n
\nLAC researchers<\/a>
\n<\/span>
\n have also found that Winnti exploits an SQL injection vulnerability in an enterprise resource planning system. This allows the group to drop Web shells on an infected server, after which they collect credentials, conduct reconnaissance, and deliver the Winnti malware.<\/span>\n<\/p>\n

\nThis updated version of the malware has enhanced capabilities, enabling it to expand its reach and breach a managed service provider.<\/span>\n<\/p>\n

\nAccording to <\/span>
\n
\na statement by LAC researchers<\/a>
\n<\/span>
\n, the new Winnti malware features advanced techniques such as obfuscation, updated encryption algorithms, and evasion by security products. It is likely that this attacker group will continue to update the functions of the Winnti malware and use it in future attacks.<\/span>\n<\/p>\n<\/div>\n\n
Source Link<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

NEWS BRIEF Winnti , a cyber threat group affiliated with China, has been identified as the perpetrator of a new campaign known as RevivalStone. This campaign has been observed targeting…<\/p>\n","protected":false},"author":19,"featured_media":5050,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[22],"tags":[],"class_list":["post-5788","post","type-post","status-publish","format-standard","has-post-thumbnail","category-cybersecurity"],"jetpack_featured_media_url":"https:\/\/fusionmindlabs.com\/blogs\/wp-content\/uploads\/sites\/9\/2025\/02\/kb_photodesign-china-cyber-flag-shutterstock.jpg","_links":{"self":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/5788","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/comments?post=5788"}],"version-history":[{"count":0,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/5788\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media\/5050"}],"wp:attachment":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media?parent=5788"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/categories?post=5788"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/tags?post=5788"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}