Threat actors have launched a new malware campaign that uses a man-in-the-middle (MitM) attack to infect unsuspecting users with the Plead backdoor.

At the end of April 2019, ESET observed several attempts to distribute the Plead backdoor using what was most likely a MitM attack. Each of these attempts created and executed the malware through “AsusWSPanel.exe,” a legitimate process belonging to the Windows client of ASUS WebStorage. Researchers also confirmed that each of the discovered Plead samples used “Asus Webstorage Upate.exe” as their file name.

In its analysis of these infection attempts, ESET proposed that ASUS Cloud Corporation, the developer of ASUS WebStorage, could have suffered a supply chain attack. But the researchers admitted that some findings, including the fact that the same update mechanism delivered legitimate ASUS WebStorage binaries, likely ruled this scenario out.

They said it was far more likely that digital attackers used a MitM attack at the router level to modify the update check of the ASUS WebStorage software. ESET’s researchers observed this activity in the wild when threat actors inserted a new URL that pointed to a malicious file hosted at a compromised gov.tw domain.

Peering Into Plead’s History

The actors behind Plead are known to use a router scanner to search for vulnerable routers. Once they’ve compromised a router, they use its virtual private network (VPN) feature to register the device as a virtual server. They can then leverage this asset as a command-and-control (C&C) server for delivering malware.

Researchers have learned much about Plead since the threat first became active in 2012. In June 2017, for instance, Trend Micro uncovered common denominators between Plead and two other attack tools named Shrouded Crossbow and Waterbear. These commonalities led the security firm to conclude that all three utilities fit into the arsenal of the threat group BlackTech.

The malware has been involved in other attack campaigns since then, too. In July 2018, for example, ESET identified a campaign that abused code-signing certificates to spread the threat.

How to Defend Against a Malware-Laden MitM Attack

Security professionals can help defend their organizations against MitM attacks by using network monitoring tools to analyze network traffic in real time for risks and vulnerabilities. This solution should also help security teams prioritize risks and vulnerabilities based on where data is stored.

Organizations should also leverage unified endpoint management (UEM) to monitor their devices for suspicious activity, including what could be malicious behavior.