Elastic Security Labs share details about the SADBRIDGE loader and GOSAR backdoor, malware used in campaigns targeting Chinese-speaking victims.
Introduction
Elastic Security Labs recently observed a new intrusion set targeting Chinese-speaking regions, tracked as REF3864. These organized campaigns target victims by masquerading as legitimate software such as web browsers or social media messaging services. The threat group behind these campaigns shows a moderate degree of versatility in delivering malware across multiple platforms such as Linux, Windows, and Android. During this investigation, our team discovered a unique Windows infection chain with a custom loader we call SADBRIDGE. This loader deploys a Golang-based reimplementation of QUASAR, which we refer to as GOSAR. This is our team’s first time observing a rewrite of QUASAR in the Golang programming language.
Key takeaways
- Ongoing campaigns targeting Chinese language speakers with malicious installers masquerading as legitimate software like Telegram and the Opera web browser
- Infection chains employ injection and DLL side-loading using a custom loader (SADBRIDGE)
- SADBRIDGE deploys a newly-discovered variant of the QUASAR backdoor written in Golang (GOSAR)
- GOSAR is a multi-functional backdoor under active development with incomplete features and iterations of improved features observed over time
- Elastic Security provides comprehensive prevention and detection capabilities against this attack chain