Budworm

Budworm, also known as LuckyMouse or APT 27, is a threat actor that has been associated with various high-profile cyber attacks. This group has been found to utilize tools such as the Korplug backdoor, which is commonly used by multiple Advanced Persistent Threats (APTs) including Budworm and APT41, typically in cyber espionage attacks. The group's activities have raised concerns in the cybersecurity industry due to their involvement in software supply chain attacks, posing significant threats to organizations across sectors. Notably, Budworm was implicated in the 2022 attack on a gambling company, using the same technique they had previously employed in September 2021. Budworm's operations are not confined to one sector or region; they have targeted a Middle Eastern telecom organization, an Asian government, and even a U.S. state legislature. Their toolset continues to evolve, as demonstrated by the deployment of a previously unseen variant of its SysUpdate backdoor (SysUpdate DLL inicore_v2.3.30.dll). Additionally, they have been linked to the use of HyperBro loader, a tool associated with state-backed groups, leading Dutch cybersecurity firm EclecticIQ to attribute their campaign to China. There remain unanswered questions about Budworm's activities, particularly concerning their potential links to other actors such as Carderbee. The motives behind their attacks are also unclear, although the use of tools like PlugX/Korplug suggests a focus on cyber espionage. In recent times, Symantec's Threat Hunter Team discovered Budworm targeting a Middle Eastern telecommunications organization and an Asian government using an updated version of one of its key tools. Given these developments, it is evident that Budworm continues to be an active and evolving threat in the realm of cybersecurity.