SysUpdate

SysUpdate is a malicious software (malware) predominantly utilized by the Budworm group, also known as APT27, Emissary Panda, LuckyMouse, among other names. This malware variant is designed to exploit and damage computer systems, often infiltrating through suspicious downloads, emails, or websites without user knowledge. Once inside, it can steal personal information, disrupt operations, or hold data for ransom. In December 2020, a sample of a new SysUpdate variant was discovered. The payload was a novel version of SysUpdate, which was sideloaded to run the SysUpdate tool in a previous campaign by Emissary Panda. The backdoor maintains persistence by setting the 'SysUpdate' key in the OS registry and storing the LNK file 'SystemUpdate.lnk' in the startup directory. This updated SysUpdate toolkit has been deployed by Budworm in new attacks against an Asian government and a Middle East-based telecommunications provider, as reported by The Hacker News. Budworm's use of a known malware like SysUpdate, along with favored techniques such as DLL side-loading using an application previously used for this purpose, indicates that the group is not overly concerned about having its activities associated with it if discovered. Budworm has also leveraged numerous living-off-the-land and public tools in addition to its enhanced SysUpdate backdoor, which features screenshot capturing, drive data retrieval, and file operation and command execution capabilities. The discovery of an updated SysUpdate tool underscores Budworm's continued development and ongoing activity as of August 2023. The group has used DLL sideloading with the legitimate INISafeWebSSO application to deploy its SysUpdate malware, serving as a multipurpose backdoor. The new variant of SysUpdate was found to be linked to a C&C server associated with LuckyMouse. This evolving threat landscape highlights the need for robust cybersecurity measures and vigilance against advanced persistent threats.