Researchers discovered that the Winnti Group used a new backdoor called PortReuse to target the gaming industry in Asia.
ESET came across the backdoor while investigating a series of supply chain attacks launched by the Winnti Group against Asia’s gaming industry. Over the course of that analysis, researchers found a unique packer and tried to determine whether it had been used in other attacks. This led them to discover that the packer actually functioned as a component of PortReuse.
Seeking to understand how PortReuse makes its way onto compromised hosts and communicates with its handlers, the researchers uncovered a VMProtected packer that decrypts position-independent code using RC5. They also observed that PortReuse doesn’t use a command-and-control (C&C) server. Instead, it injects itself into an existing process for the purpose of reusing that port so it can wait for incoming messages and send a “magic” packet.
A Closer Look at Recent Winnti Group Threat Activity
This is just the latest attempt by security researchers to better understand how Winnti Group operates. Many of these efforts have proven fruitful.
In March 2019, for instance, ESET first came across the payload that ultimately led it to PortReuse after spotting supply chain attacks that targeted two games and one gaming platform application. About a month later, Kaspersky Lab detected a supply chain attack against an Asian manufacturer; this campaign used a backdoor that was actually an updated version of ShadowPad, Winnti’s flagship backdoor. Then, in May, Chronicle identified a cluster of Winnti malware samples that specifically targeted Linux machines.
How to Defend Against a Backdoor Like PortReuse
Security researchers can help protect their organizations against a Winnti implant like PortReuse by using a unified endpoint management (UEM) tool to monitor how all assets interact with the IT environment and remediate any suspicious activity. Organizations should also seek to shield their data from the prying eyes of malware by obfuscating and encrypting the organization’s sensitive information.