New Chinese Nexus APT Hackers Attacking Organizations to Deliver NET-STAR Malware Suite
In recent weeks, security teams have identified increased activity from an advanced persistent threat (APT) group referred to as the "Chinese Nexus." This group has launched targeted operations against the finance, telecommunications, and manufacturing…
In recent weeks, security teams have identified increased activity from an advanced persistent threat (APT) group referred to as the "Chinese Nexus." This group has launched targeted operations against the finance, telecommunications, and manufacturing sectors. Initial access is frequently gained through spear-phishing emails and compromised VPN credentials.
Victims have received industry whitepapers containing macros that, when enabled, deploy the NET-STAR malware suite. Initial telemetry suggests a 30% success rate against high-value targets.
Post-intrusion, the attackers utilize living-off-the-land techniques, employing Windows PowerShell to execute obfuscated scripts in memory. According to Palo Alto Networks researchers, the initial PowerShell stager decodes a Base64 string to reconstruct a .NET binary, which is then injected into legitimate processes like explorer.exe or svchost.exe to evade detection.
This sequence occurs rapidly after macro activation, leaving minimal forensic evidence on disk. The loader's stealth complicates triage, allowing the adversary to conduct reconnaissance and lateral movement undetected.
NET-STAR consists of three main components: a loader, a backdoor, and a command-and-control (C2) communication module. The loader decrypts and loads the backdoor payload into memory. The backdoor provides capabilities such as file transfer, process manipulation, and registry modification.
Initial access is frequently gained through spear-phishing emails and compromised VPN credentials.
The C2 module establishes an encrypted HTTPS tunnel to compromised web servers. Each session uses a custom framing protocol with 256-bit AES encryption, complicating detection by network-based intrusion detection systems.
NET-STAR has been linked to data exfiltration activities, including financial records and intellectual property. Impact assessments indicate the possibility of future sabotage or secondary payload deployment.
The infection process begins with a malicious Word document containing a VBA macro. The macro decodes a Base64-encoded .NET assembly and executes it entirely in memory, leaving no executable on disk.
$enc = "U3lzdGVtLkNvbnZlcnQuQ29tcHJlc3Npb24=" $bytes = [Convert]::FromBase64String($enc) $asm = [Reflection.Assembly]::Load($bytes) $method = $asm.GetType("Loader.Main").GetMethod("Execute") $method.Invoke($null,$null)
Palo Alto Networks analysts report that the loader uses Control Flow Flattening to obfuscate the assembly's intermediate language, resisting decompilation and preventing detection through signature-based mechanisms. Once loaded, the backdoor retrieves a second stage payload from the C2, solidifying persistence.
Incident responders have noted credential harvesting through in-memory Mimikatz execution, followed by lateral movement via SMB and RDP channels. Affected organizations report operational disruptions and data loss, highlighting the need for rapid detection and containment.
Based on reporting by Cyber Security News.