SysUpdate

SysUpdate is a malicious software variant that has been exclusively used by Budworm, also known as APT27, Emissary Panda, Bronze Union, Lucky Mouse, Iron Tiger, and Red Phoenix. In December 2020, a sample of the SysUpdate malware variant was found, with its payload being a new version of SysUpdate. The backdoor maintains persistence in infected systems by setting the 'SysUpdate' key in the OS registry and storing the LNK file 'SystemUpdate.lnk' in the startup directory. Notably, Budworm has used DLL sideloading with the legitimate INISafeWebSSO application to deploy its SysUpdate malware, serving as a multipurpose backdoor. The group has targeted various entities including an Asian government and a Middle East-based telecommunications provider, as reported by The Hacker News in September 2023. Budworm has been deploying new attacks with the updated SysUpdate toolkit against these targets. Furthermore, the group has shown a continued willingness to use known malware like SysUpdate and previously employed techniques such as DLL sideloading, indicating a degree of indifference to detection. This is evident from their continued use of SysUpdate, despite it being associated with them upon discovery. Budworm has also leveraged numerous living-off-the-land and public tools in addition to its enhanced SysUpdate backdoor. The latter features capabilities such as screenshot capturing, drive data retrieval, and file operation and command execution, according to a report from the Symantec Threat Hunter Team. The discovery of an updated SysUpdate tool in August 2023 highlights Budworm's ongoing activity and continued development of its toolset.