China Chopper

China Chopper is a well-known malware that has been used extensively by Chinese-speaking actors, including the BRONZE UNION group. The malware is designed to exploit and damage computer systems, often without the knowledge of the user. It can infiltrate systems through suspicious downloads, emails, or websites, and once inside, it can steal personal information, disrupt operations, or even hold data hostage for ransom. In June 2024, a new variant of China Chopper was detected on a public web server. This discovery was made by researchers at Kaspersky when they noticed recurring alerts in their telemetry for this new variant. The infection was found within the code of several web shells on SharePoint servers, including stylecs.aspx, test.aspx, and stylecss.aspx. The functionality of the new China Chopper variant was similar to previous versions, providing remote access and control over compromised web servers. The malware was likely associated with a VPN used by BRONZE UNION to connect to the China Chopper web shell. Additionally, the Unit 42 researchers noted that the attacks generally paralleled Chinese office hours and employed tools typically used by Chinese APT groups, such as customized versions of Gh0st RAT, PlugX, Htran, and China Chopper itself. Furthermore, the malware contained Mandarin language code comments and debug strings, and multiple C2 servers used Chinese Virtual Service providers, including Cloudie Limited and Zenlayer. The involvement of notorious Chinese malware families like PlugX and China Chopper suggests a connection to China, although direct governmental involvement remains unconfirmed. Diplomatic Specter is another group known to utilize these malware families. Despite the lack of confirmed governmental involvement, the tactics and tools used point towards Chinese actors. The detection of the new China Chopper variant prompted further investigation into other potential threats, such as Tropic Trooper. As China Chopper continues to evolve, organizations need to remain vigilant to protect against this persistent threat.