Malware hidden in Chinese inventory scanners targeted logistics, shipping firms

Researchers from TrapX discovered a sophisticated multistage cyberespionage attack that started in the supply chain

Financial and business information was stolen from several shipping and logistics firms by sophisticated malware hiding in inventory scanners manufactured by a Chinese company.

The supply chain attack, dubbed "Zombie Zero," was identified by security researchers from TrapX, a cybersecurity firm in San Mateo, California, who wrote about it in a report released Thursday.

TrapX hasn't named the Chinese manufacturer, but said that the malware was implanted in physical scanners shipped to customers, as well as in the Windows XP Embedded firmware available for download on the manufacturer's website.

The malware was designed to launch attacks using the SMB (Server Message Block) protocol and the Radmin remote control protocol when the infected inventory scanner was connected to a company's wireless network. It then looked for ERP (enterprise resource planning) servers with the word "finance" in their names and used known exploits to compromise them, said Carl Wright, executive vice president and general manager of TrapX.

Wright declined to name the targeted ERP software, but said that it's a very popular one that runs on Linux.

According to the TrapX researchers, once an ERP server is found and compromised, the malware installs a second-stage component that connects to command-and-control server at the Lanxiang Vocational School in China's Shandong province. The researchers noted in their report that the Lanxiang Vocational School has been linked in the past to cyberespionage attacks against Google and other companies as part of a campaign called Operation Aurora.

The second-stage component downloads a third and more sophisticated payload that establishes a separate connection to a facility in Beijing.

The malware's goal is to steal corporate financial and customer data from ERP servers, as well shipping manifest information, the TrapX researchers said.

Wright declined to speculate on whether the unnamed Chinese vendor intentionally inserted malware into its scanners or if it might have been a victim of an attack that led to its products and software being compromised. However, he pointed out that when contacted, the vendor initially denied the allegations, but then replaced the infected firmware on its website. He also noted that the company is based only a few blocks from the Lanxiang Vocational School.

Since the attack was originally detected, TrapX has identified seven victims in the shipping and logistics industry, as well as a robotics firm that was attacked with the same initial malware, but with different payloads, Wright said. In the case of the robotics firms, the attack didn't target ERP systems, he said.

Security researchers have warned about the possibility of malware attacks through the supply chain for years, but the number of confirmed incidents has been low. However, according to Wright, the world is changing and this type of attack could happen more often.

Recent media reports based on documents leaked by former U.S. National Security Agency contractor Edward Snowden said that the NSA routinely intercepted routers, servers and other network equipment shipped by U.S. manufacturers to international customers and installed surveillance tools in them.

Join the CSO newsletter!

Error: Please check your email address.

Tags securityTrapXExploits / vulnerabilitiesmalware

More about GoogleLinuxNational Security AgencyNSA

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Lucian Constantin

Latest Videos

  • 150x50

    CSO Webinar: Will your data protection strategy be enough when disaster strikes?

    Speakers: - Paul O’Connor, Engagement leader - Performance Audit Group, Victorian Auditor-General’s Office (VAGO) - Nigel Phair, Managing Director, Centre for Internet Safety - Joshua Stenhouse, Technical Evangelist, Zerto - Anthony Caruana, CSO MC & Moderator

    Play Video

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

More videos

Blog Posts

Market Place