Winnti's new UNAPIMON tool hides malware from security software

The Chinese 'Winnti' hacking group was found using a previously undocumented malware called UNAPIMON to let malicous processes run without being detected. Winnti, also known as APT41, is one of the oldest (active since 2012) and most sophisticated and prolific cyberespionage threat groups, believed to be a Chinese state-sponsored actor. Previously, they have targeted a broad spectrum of organizations, including governments, hardware vendors, software developers, think tanks, telecommunication service providers, and educational institutes. A new report by Trend Micro delves into a previously unseen custom malware used in an operation they have been monitoring closely, attributing the cyberespionage attack to a cluster they named 'Earth Freybug.' The attack begins with a malicious process injected into the legitimate VMware Tools vmtoolsd.exe process, which executes a remote scheduled task to run a batch file that collects system information, including network configurations and user details. Next, a second batch file (cc.bat) leverages DLL side-loading (TSMSISrv.dll) involving the SessionEnv service to load UNAPIMON in memory, injecting it into a cmd.exe process. UNAPIMON is a C++ malware delivered in DLL form (_{random}.dll), which uses Microsoft Detours for hooking the CreateProcessW API function, allowing it to unhook critical API functions in child processes. Because many security tools employ API hooking to track malicious activity, UNAPIMON's mechanism allows it to unho...