The Chinese Cicada hacking group, tracked as APT10, was observed abusing security software to install a new version of the LODEINFO malware against Japanese organizations.
The targeted entities are media groups, diplomatic agencies, government and public sector organizations, and think tanks in Japan, all high-interest targets for cyberespionage.
According to Kaspersky, whose analysts have been following APT10’s operations in Japan since 2019, the threat actors are constantly evolving their infection tactics and their custom backdoor, ‘LODEINFO,’ to make detections a lot harder.
The cybersecurity company has published two reports, one illustrating new APT10’s infection chain techniques and a second focusing on the evolution of LODEINFO.
