US Government Warns of a New Strain of Chinese ‘Taidoor’ Virus

Named “Taidoor,” the malware has done an ‘excellent’ job
of compromising systems as early as
2008^[1], with the actors
deploying it on victim networks for stealthy remote access.

“[The] FBI has high confidence that Chinese government actors
are using malware variants in conjunction with proxy servers to
maintain a presence on victim networks and to further network
exploitation,” the US Cybersecurity and Infrastructure Security
Agency (CISA), the Federal Bureau of Investigation (FBI), and the
Department of Defense (DoD) said in a joint advisory.
^[2]

However, the malware itself is not new. In an analysis^[4] by Trend Micro
researchers in 2012, the actors behind Taidoor were found to
leverage socially engineered emails with malicious PDF attachments
to target the Taiwanese government.

Calling it a “constantly evolving, persistent threat,” FireEye^[5] noted significant
changes in its tactics in 2013, wherein “the malicious email
attachments did not drop the Taidoor malware directly, but instead
dropped a ‘downloader’ that then grabbed the traditional Taidoor
malware from the Internet.”

Then last year, NTT Security uncovered
evidence^[6] of the backdoor being
used against Japanese organizations via Microsoft Word documents.
When opened, it executes the malware to establish communication
with an attacker-controlled server and run arbitrary commands.

According to the latest advisory, this technique of using decoy
documents containing malicious content attached to spear-phishing
emails hasn’t changed.

“Taidoor is installed on a target’s system as a service dynamic
link library (DLL) and is comprised of two files,” the agencies
said. “The first file is a loader, which is started as a service.
The loader (ml.dll) decrypts the second file (svchost.dll), and
executes it in memory, which is the main Remote Access Trojan
(RAT).”

In addition to executing remote commands, Taidoor comes with
features that allow it to collect file system data, capture
screenshots, and carry out file operations necessary to exfiltrate
the gathered information.

CISA recommends that users and administrators keep their
operating system patches up-to-date, disable File and Printer
sharing services, enforce a strong password policy, and exercise
caution when opening email attachments.

You can find the full list of best practices
here^[7].

^[3]