{"id":6422,"date":"2025-08-26T10:03:41","date_gmt":"2025-08-26T10:03:41","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/08\/26\/chinese-unc6384-hackers-leverages-valid-code-signing-certificates-to-evade-detection\/"},"modified":"2025-08-26T10:03:41","modified_gmt":"2025-08-26T10:03:41","slug":"chinese-unc6384-hackers-leverages-valid-code-signing-certificates-to-evade-detection","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/08\/26\/chinese-unc6384-hackers-leverages-valid-code-signing-certificates-to-evade-detection\/","title":{"rendered":"Chinese UNC6384 Hackers Leverages Valid Code Signing Certificates to Evade Detection"},"content":{"rendered":"

Chinese UNC6384 Hackers Leverages Valid Code Signing Certificates to Evade Detection
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A stealthy espionage campaign emerged in early 2025 targeting diplomats and government entities in Southeast Asia and beyond.<\/p>\n

At the heart of this operation lies STATICPLUGIN, a downloader meticulously disguised as a legitimate Adobe plugin update.<\/p>\n

Victims encountered a captive portal hijack that redirected browsers to malicious domains, where an HTTPS-secured landing page prompted users to \u201cInstall Missing Plugins\u2026\u201d\u2014a ruse to lower suspicion and bypass browser warnings.<\/p>\n

\n
\"\"
Malware landing page (Source -Google Cloud)<\/figcaption><\/figure>\n<\/div>\n

Once executed, the binary deployed a multi-stage chain<\/a> culminating in the in-memory launch of the SOGU.SEC backdoor.<\/p>\n

Following the initial compromise, STATICPLUGIN retrieves an MSI package masquerading as a BMP image. Inside this package resides CANONSTAGER, which is DLL side-loaded to execute the encrypted payload cnmplog.dat.<\/p>\n

This side-loading technique exploits trusted Windows components to evade host-based defenses. Google Cloud analysts identified this novel combination of captive portal hijacking and valid code signing as a sophisticated evolution in PRC-nexus tradecraft.<\/p>\n

Evidence indicates that Chengdu Nuoxin Times Technology Co., Ltd. issued the signing certificates used for STATICPLUGIN, lending the downloader false legitimacy.<\/p>\n

These certificates, issued by GlobalSign and Let\u2019s Encrypt, allowed the malware to bypass many endpoint security solutions<\/a> that trust digitally signed binaries.<\/p>\n

\n
\"\"
Downloader with valid digital signature (Source -Google Cloud)<\/figcaption><\/figure>\n<\/div>\n

Google Cloud researchers noted<\/a> that although the original certificate expired on July 14, 2025, UNC6384 likely re-signs subsequent build iterations to maintain uninterrupted stealth.<\/p>\n

Detailed analysis of CANONSTAGER reveals unconventional evasion tactics. The launcher resolves Windows API addresses using a custom hashing algorithm and stores them in Thread Local Storage (TLS), an atypical location that may go unnoticed by monitoring tools.<\/p>\n

\n
\"\"
Example of storing function addresses in TLS array (Source -Google Cloud)<\/figcaption><\/figure>\n<\/div>\n

By invoking these functions indirectly through a hidden window procedure and dispatching a WM_SHOWWINDOW message, CANONSTAGER conceals its true control flow within legitimate Windows message queues.<\/p>\n

\n
\"\"
Overview of CANONSTAGER execution using Windows message queue (Source -Google Cloud)<\/figcaption><\/figure>\n<\/div>\n

Detection Evasion through In-Memory Execution<\/strong><\/h2>\n

One of UNC6384\u2019s most remarkable innovations lies in its end-to-end in-memory execution. After establishing the hidden window and resolving APIs, CANONSTAGER creates a new thread to decrypt cnmplog.dat using a hardcoded 16-byte RC4 key.<\/p>\n

Rather than writing the decrypted SOGU.SEC payload<\/a> to disk, the launcher invokes EnumSystemGeoID as a callback function to execute the backdoor directly in memory.<\/p>\n

This technique denies defenders valuable forensic artifacts, as no malicious binary resides on disk.<\/p>\n

Moreover, communications with the C2 server at 166.88.2.90 occur over HTTPS, blending with normal web traffic and further complicating network-based detection.<\/p>\n

The initial JavaScript triggers the download of AdobePlugins.exe, setting the stage for in-memory execution. By avoiding disk writes and leveraging valid certificates, UNC6384 has raised the bar for malware stealth.<\/p>\n

As Google Cloud analysts continue to monitor<\/a> this campaign, defenders are urged to inspect memory artifacts, enforce strict code-signing policies, and enable Enhanced Safe Browsing to detect anomalous TLS certificates and captive portal hijacks.<\/p>\n

Boost\u00a0your\u00a0SOC and help your team protect your business with free top-notch threat intelligence:\u00a0Request TI Lookup Premium Trial<\/a>.<\/code><\/strong><\/p>\n

The post Chinese UNC6384 Hackers Leverages Valid Code Signing Certificates to Evade Detection<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

Chinese UNC6384 Hackers Leverages Valid Code Signing Certificates to Evade Detection A stealthy espionage campaign emerged in early 2025 targeting diplomats and government entities in Southeast Asia and beyond. At the heart of this operation lies STATICPLUGIN, a downloader meticulously disguised as a legitimate Adobe plugin update. Victims encountered a captive portal hijack that redirected […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,649],"tags":[130],"class_list":["post-6422","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/6422"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=6422"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/6422\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=6422"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=6422"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=6422"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}