Campaign of the APT Group UNC5174

A Threat Research Team (TRT) has uncovered an ongoing campaign of the Chinese APT group UNC5174 aimed at Linux-based systems in western countries and Asia-Pacific. The attackers combine the already known SNOWLIGHT malware with the remote access Trojan (RAT) VShell, an open source tool that is considered particularly difficult to detect. The initial infection occurs via a Bash script, which reloads two malicious binary files: dnsloger (connection…