Stealthy Gelsemium cyberspies linked to NoxPlayer supply-chain attack

ESET researchers have linked a stealthy cyberespionage group known as Gelsemium to the NoxPlayer Android emulator supply-chain attack that targeted gamers earlier this year.

The hacking group's activity goes back to 2014 when some of their malicious tools were discovered by G DATA’s SecurityLabs while investigating a targeted cyber-espionage campaign (dubbed Operation TooHash) powered by spear-phishing.

Two years later, in 2016, new Gelsemium indicators of compromise showed up in a Verint Systems presentation at HITCON.

In 2018, VenusTech unveiled an unknown APT group's malware samples linked to the Operation TooHash, which ESET later discovered were early versions of Gelsemium malware.

The group is known for targeting governments, religious organizations, electronics manufacturers, and universities from East Asia and the Middle East but has mostly flown under the radar.

Malware deployed using several attack vectors

ESET researchers revealed today that they also found early versions of the group's Gelsevirine "complex and modular" backdoor while investigating several campaigns since mid-2020.

"Gelsemium uses three components and a plug-in system to give the operators a range of possibilities to gather information: the dropper Gelsemine, the loader Gelsenicine, and the main plugin Gelsevirine," ESET revealed.

According to reports from G DATA and Verint Systems, the cyberspies used spear-phishing emails with document attachments exploiting the CVE-2012-0158 Microsoft Office vulnerability to deliver the malware.

They've also been observed by VenusTech using watering holes set up on intranet servers in 2018, while ESET spotted them using a pre-authentication RCE exploit against vulnerable Exchange servers to deploy web shells.

Their list of tactics also includes the use of Dynamic DNS (DDNS) domain names for command-and-control servers to complicate infrastructure tracking since they do not come with a list of newly created domains.

"Gelsemium’s whole chain might appear simple at first sight, but the exhaustive number of configurations, implanted at each stage, can modify on-the-fly settings for the final payload, making it harder to understand," ESET researcher Thomas Dupuy added in a report published today.

Linked to a supply-chain attack targeting gamers

ESET researchers believe that Gelsemium is the APT group that coordinated the supply-chain attack that compromised and abused the updating of the NoxPlayer Android emulator for Windows and macOS (with more than 150 million users) to infect gamers' systems between September 2020 and January 2021.

Luckily, this supply-chain attack (dubbed Operation NightScout) only impacted a limited set of targets from Taiwan, Hong Kong, and Sri Lanka, hinting at the operation's highly targeted nature.

This, in itself, makes Gelsemium's attack on NoxPlayer stand out since not many threat actors target gaming community targets.

"The investigation uncovered some overlap between this supply-chain attack and the Gelsemium group. Victims originally compromised by that supply-chain attack were later being compromised by Gelsemine," ESET's white paper reads.

"Unfortunately, we did not observe links as strong as one campaign dropping or downloading a payload that belongs to the other campaign, but we conclude, with medium confidence, that Operation NightScout is related to the Gelsemium group."