HyperBro

Malware updated a month ago (2024-10-15T10:01:36.603Z)
Download STIX
Preview STIX
HyperBro is a sophisticated piece of malware that has been utilized in cyber espionage campaigns targeting semiconductor industries in regions like Taiwan, Hong Kong, and Singapore. The malware was discovered being used in conjunction with a variant of the HyperBro loader and a lure related to the Taiwan Semiconductor Manufacturing Company (TSMC). The payload of this malware operation includes the deployment of a Cobalt Strike beacon through DLL side-loading, which is executed in-memory using a digitally signed CyberArk binary. This scheme also involved the use of files associated with the HyperBro tool uploaded to a webshell on a SharePoint server, and later in March, Advanced Persistent Threat (APT) actors installed HyperBro on the Exchange Server and two other systems. The Dutch cybersecurity firm EclecticIQ attributed this campaign to China due to the use of the HyperBro loader, which is associated with a state-backed group known as Budworm or APT27. The hackers likely leveraged spear-phishing emails to deliver the HyperBro loader, which displays a file purportedly from TSMC while deploying the Cobalt Strike beacon. The researchers stated, "EclecticIQ analysts assess with high confidence that the analyzed HyperBro Loader, the malware downloader, and the GO backdoor are very likely operated and developed by a PRC backed nation-state threat actor, due to victimology, infrastructure observed, malware code and resemblance with previously reported activity clusters." Technical analysis revealed that the HyperBro loader variant uses the same Cobalt Strike Command and Control (C2) server linked with the HyperBro loader variant. Additionally, certain indicators of compromise were identified, including specific IP addresses and hashes associated with the malware and its components. To protect against such vulnerabilities, it is recommended to use tools like Patch Manager Plus, which can quickly patch over 850 third-party applications. Further analysis of the HyperBro tool will be provided in an upcoming section.
Description last updated: 2024-10-15T09:15:11.751Z
What's your take? (Question 1 of 5)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Aliases We are not currently tracking any aliases
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Malware
Apt
Trojan
Backdoor
Webshell
Payload
Analyst Notes & Discussion
Be the first to leave your mark here! Log in to share your views and vote.
Source Document References
Information about the HyperBro Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
PreviewSource LinkCreatedAtTitle
CERT-EU
a year ago
CERT-EU
a year ago
CERT-EU
a year ago
CERT-EU
a year ago
CERT-EU
a year ago
CERT-EU
a year ago
CERT-EU
a year ago
MITRE
2 years ago
MITRE
2 years ago
MITRE
2 years ago
MITRE
2 years ago
CISA
2 years ago
CISA
2 years ago
CISA
2 years ago
Trend Micro
2 years ago
CERT-EU
a year ago