OceanLotus suspected of using PyPI to deliver ZiChatBot malware

The article from Securelist discusses a suspected campaign by the OceanLotus (also known as APT32) threat actor, which is believed to be distributing malware called ZiChatBot via Python Wheel packages on PyPI. Here are some key points:

1. Threat Actor: The article attributes this activity to OceanLotus, an advanced persistent threat group that has been active since at least 2014 and primarily targets Southeast Asian government entities.

2. Malware Distribution Method:

   • Malicious Python Wheel packages were uploaded to the Python Package Index (PyPI).
   • These packages contained droppers for ZiChatBot malware.

3. Dropper Functionality:

   • The droppers are designed to download and install additional components of the ZiChatBot malware on compromised systems.

4. ZiChatBot Malware:

   • ZiChatBot is a backdoor that communicates with command-and-control (C2) servers.
   • It uses HTTPS for communication, making detection more challenging.
   • The malware has been observed to exfiltrate data and execute commands from its C2 server.

5. Technical Details:

   • Droppers are named `Backward.dll

Read the full article at Malware Analysis, News and Indicators - Latest topics

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.