Cobra Docguard

Cobra DocGuard, a software produced by Chinese firm EsafeNet for protecting, encrypting, and decrypting software, has been exploited in a series of malware attacks. The attackers compromised the software's update files to deliver malicious updates that infected targeted systems. The first known instance of this strategy occurred in September 2022 when a Hong Kong-based gambling company was targeted by a Chinese-linked hacking effort known as LuckyMouse (also tracked as APT27, Emissary Panda, and Bronze Union). Additionally, Cobra DocGuard was used in combination with another malware called PlugX, or Korplug, in some of these attacks. The malware campaign saw the installation of a compromised version of Cobra DocGuard on approximately 2,000 computers, but active malicious activity was only observed on around 100 machines within impacted organizations. This suggests that the attackers were selectively targeting specific victims. The attack chain involved the delivery of the malicious Cobra DocGuard version to a specific location on the infected computers. While most victims were based in Hong Kong, others were scattered across Asia. Despite knowing that Cobra DocGuard was exploited, researchers are still uncertain how the attackers gained access to the client software to use it in this manner. The unknown actors behind this campaign have been dubbed "Carderbee" by the Symantec Threat Hunter Team, part of Broadcom. They noted that Carderbee compromised a Cobra DocGuard software update file with the aim of deploying the Korplug backdoor. In a related development, EclecticIQ reported that the compromised Cobra DocGuard web server hosted a GO-based backdoor known as "ChargeWeapon". It is not the first time that threat actors have used Cobra DocGuard in a supply chain campaign, raising concerns about the security of the software and the potential for its continued exploitation.