BPO Beware: Airstalk Malware Airs Your Dirty Laundry in Supply Chain Attacks!
A suspected Chinese state-sponsored threat actor, CL-STA-1009, is making headlines with its AirWatch API-abusing malware, Airstalk. Targeting business process outsourcing entities, this covert operation uses sneaky tactics and stolen certificates. It’s like cybercriminals went to hacking comedy school and graduated with honors—minus the diploma and cap and gown.
Hot Take:
Who knew that the secret to a successful supply chain attack could be found in the fine print of mobile device management APIs? Move over, James Bond – the real espionage action is happening in your smartphone’s settings!
Key Points:
- Suspected Chinese threat actor, tracked as CL-STA-1009, targets BPO entities.
- Two malware variants dubbed Airstalk, written in PowerShell and .NET, are used.
- Malware exploits AirWatch API for covert communication with C&C servers.
- Targets Chrome, Microsoft Edge, and Island Browser to steal browser data.
- Employs defense techniques like revoked certificates and altered timestamps.
Already a member? Log in here