APT-C-60 Group Targets China! Deploying SpyGlace Backdoor Utilizing WPS Office Vulnerability

▌WPS Vulnerability Exploited, SpyGlace Backdoor Infiltrates

According to the latest observations by Lexfo Security Labs (塞讯安全实验室), an attack campaign associated with a South Korean-backed threat group exploited a previously existing critical remote code execution vulnerability (now patched) in Kingsoft WPS Office, namely CVE-2024-7262 (CVSS score of 9.3), to deploy a custom backdoor program named SpyGlace. The orchestrator of this campaign is the well-known threat group APT-C-60. These highly-orchestrated attack campaigns have successfully infected devices of users in China and East Asia, quietly implanting malware. The core issue of the CVE-2024-7262 vulnerability lies in WPS Office's improper handling of user-provided file paths and the lack of necessary validation measures, thereby opening a door for attackers to upload arbitrary Windows library files and leverage them to achieve remote code execution, posing a serious threat to user data security and system stability.

▌Disguised Spreadsheets Distributing the SpyGlace Trojan

The vulnerability allows attackers to execute malicious code by hijacking the control flow of its plugin component promecefpluginhost.exe. In addition, there is another way to achieve the same attack effect; this vulnerability is designated as CVE-2024-7263, with a severity rating of CVSS 9.3. The APT-C-60 threat group leveraged this vulnerability to craft a trap document disguised as a regular spreadsheet, which appeared on the VirusTotal platform in February 2024. The document features an embedded malicious link that, once triggered by the user, initiates a chain of infection steps, ultimately deploying a Trojan named SpyGlace. Its core is a TaskControler.dll dynamic link library capable of file theft, plugin loading, and command execution. To enhance deception, the attackers embedded seemingly harmless images of rows and columns in the spreadsheet, leading users to believe the document was safe. In reality, these images are associated with malicious hyperlinks; when users click on specific cells within the images, they inadvertently trigger the exploitation mechanism. APT-C-60 has been active in the cyber world since 2021, while the SpyGlace Trojan appeared in the wild even before June 2022. Whether APT-C-60 independently developed the exploit tool for CVE-2024-7262 or obtained it through other channels, it demonstrates their deep understanding of the internal working mechanism of WPS Office and the Windows system loading process. The sophistication of this exploitation lies in its stealthiness and efficiency, sufficient to mislead most users, and through the MHTML file format, it transforms a code execution vulnerability originally confined to local systems into a remote attack method, further exacerbating the scope and severity of the threat.

▌New Delivery Pathway for DarkGate Malware

A third-party plugin named ScreenShareOTR (or ss-otr) in the Pidgin messaging application has been confirmed to contain malicious code. This code can download and execute subsequent malicious binaries from a command-and-control (C&C) server, ultimately leading to the deployment of the DarkGate malware. The plugin originally claimed to support the secure Off-the-Record (OTR) messaging protocol for screen sharing, but in reality, it concealed a trap. Specifically, certain versions of the pidgin-screenshare.dll file can connect to a C&C server, download and execute PowerShell scripts, a behaviour completely contrary to its advertised original intent. In addition, the plugin also features keylogging and screenshot capabilities, further exacerbating its harm. Currently, this plugin has been removed from the third-party plugin list, and all users who have installed it are advised to uninstall it immediately. Following this, malicious backdoor code similar to ScreenShareOTR was also discovered in Cradle's application. Cradle claims to be an open-source fork of a well-known messaging app and has been circulating on the internet since September 2023. Its malicious behaviour pattern is identical to ScreenShareOTR, triggering the download and execution of AutoIt scripts via PowerShell scripts to install DarkGate. For Linux users, Cradle executes shell commands by delivering ELF executables and transmits the results back to the remote server. Notably, both the installer for the ScreenShareOTR plugin and the Cradle application were signed using valid digital certificates. This phenomenon indicates that attackers are increasingly adopting more covert and complex techniques to distribute malware, increasing the difficulty of user identification and prevention. Therefore, users must remain highly vigilant, stay tuned to security updates, and take necessary protective measures.

▌Lexfo Validation Rules

In response to the attack methods employed by this threat group, the Lexfo Security Metrics Validation Platform (塞讯安全度量验证平台) has incorporated corresponding attack simulation rules. You can search for the keyword "APT-C-60" on the platform to obtain attack simulation validation actions related to this threat group. Through these simulated attacks, you can verify whether your security defence system can effectively counter the attacks from this threat group. The Lexfo Security Metrics Validation Platform employs an industry-exclusive method to ensure your validation process is safe and harmless.

Lexfo Validation provides real attack samples. For more information, please call the official hotline at 400-860-6366 or email us at mkt@validations.cn. You can also scan the QR code below to add our official customer service, and we will be dedicated to serving you.