Sidewalk Malware Tied to China-Linked Espionage Group
The Sidewalk backdoor has been connected to the Grayfly espionage group and seen in attacks in Asia and North America.
![](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc94608acf452fd67/655cf371ab171e040a838b2a/329050_DR23_Graphics_Website_V5_Default_Image_v1.png?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
Security researchers have linked the recently discovered Sidewalk malware to Grayfly, an espionage group connected to China. The backdoor has been used in recent Grayfly attacks targeting organizations in Taiwan, Vietnam, the United States, and Mexico.
The Sidewalk malware was recently documented by ESET researchers who attributed it to a group it calls SparklingGoblin. Symantec's Threat Hunter Team has now connected the malware to Grayfly, also known as GREF and Wicked Panda, a Chinese espionage group that had several members indicted in the US last year. While it's sometimes labeled APT41, Symantec considers Grayfly the espionage branch of APT41.
"The recent campaign involving Sidewalk suggests that Grayfly has been undeterred by the publicity surrounding the indictments," researchers wrote in a blog post on their findings.
Grayfly has been seen targeting several countries in Asia, Europe, and North America, affecting organizations in a range of industries, including food, financial, healthcare, hospitality, manufacturing, and telecommunications. Its more recent activity has continued a focus on telecom with additional victims in the media, finance, and IT service provider industries.
This group usually targets public-facing Web servers to install Web shells for its initial foothold before spreading further within a target network. Once inside, Grayfly may install custom backdoors onto additional systems so they can maintain remote access.
In its recent campaign, the group seemed interested in targeting exposed Microsoft Exchange or MySQL servers, suggesting its initial attack vector may include exploiting multiple flaws on public-facing servers. In at least one attack, the Exchange activity was followed by PowerShell commands used to then install an unidentified Web shell before executing the backdoor.
Read the full blog post for more details.
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024