Carderbee

Carderbee, a previously unknown Advanced Persistent Threat (APT) group, has been identified as the perpetrator behind a series of supply chain attacks against organizations in Hong Kong and other regions in Asia. The Symantec Threat Hunter Team reported that Carderbee used a malware-infused version of Cobra DocGuard, a legitimate software produced by Chinese firm EsafeNet, to gain access to victims' networks. This sophisticated attack strategy involved compromising the Cobra DocGuard software update file with the intent of deploying the widely-used Korplug backdoor malware. The Carderbee group was found to be using a legitimate Microsoft certificate to sign malware, further complicating the detection and mitigation process. This activity aligns with an ongoing trend of high-profile supply chain attacks targeting various sectors over the past year, including the MOVEit, X_Trader, and 3CX attacks. Despite the similarities between Carderbee's actions and those of other known China-backed adversaries, there is not enough evidence to definitively link this group to any known actors or nation-states. Several critical questions regarding Carderbee's activities remain unanswered, including the specific sectors targeted by the group and potential links between Carderbee and other threat actors like Budworm. While Carderbee's tactics resemble those typically employed by Chinese state-sponsored threat actors—especially the use of PlugX malware and the focus on Hong Kong targets—Symantec has yet to officially attribute Carderbee's operations to any particular country.