LTS Secure Warning: FakeNarrator Malware Being Utilized by Chinese APT Hackers to Implant PcShare Backdoor

APT hackers from China are utilizing FakeNarrator malware to attack tech companies based in Southeast Asia, in order to implant a modified version of PcShare backdoor, which is designed to function when side-loaded by a legitimate “NVidia Smart Maximize Helper Host” application.   Technical Details The attackers are making use of a customized version of an open-source backdoor called PcShare. The backdoor is enhanced with special capabilities such as proxy bypass, C&C encryption, etc. It comes with a custom-made loader utilizing DLL sideloading technique.   Once the attackers gain access to the victim system, they utilize the custom-made Trojan, in order to abuse Microsoft Accessibility Features, thus gaining system-level access and maintain persistence.   Impact

• Can list, rename, create or delete files.
• Manipulating registry values and keys.
• Can list and manipulate services.
• List out the process running and kill them, if needed so.
• Execute binaries.
• Spawn command-line shells
• Upload & executing payloads on the infected machines.

  Recommended Actions

• Implement Principle of least privilege.
• Software restriction policies should be in place along with application whitelisting.
• Ensure that your devices are always up-to-date with the latest patches released.
• Always update your anti-virus software with the latest releases.
• Periodically run “full system scan” on your endpoints.
• Make proper security configuration for Firewall/IDS/IPS/Endpoint Protection systems so that no holes are left barred.
• Isolate all of the compromised computers ASAP to prevent threats from spreading further inside your infrastructure.