Kaspersky researchers have recently published two (2) reports on their observations of APT10, the Chinese Cicada hacking group abusing antivirus software to target Japanese organizations with a new version of the “LODEINFO” malware. LODEINFO is a sophisticated and fileless backdoor that is regularly updated to target “think tanks” as well as media, governmental, diplomatic, and public sector organizations in Japan. Researchers first discussed their observations from March and June of 2022, where APT10 attacks in Japan used a Microsoft Word file as the initial infection vector and later used an SFX file that utilized a decoy file with the name of a famous Japanese politician in the filename. During this time, a new downloader shellcode called “DOWNNIISSA” was observed being used to deploy the LODEINFO backdoor. From March to June of 2022, various improvements were made to the backdoor shellcode and multiple versions were produced. Some of the improvements include adding encryption for command-and-control (C2) communication with an “ancient crypto algorithm,” 2-byte obfuscation for backdoor command identifiers, and a hashing algorithm to gain API functionality. Other improvements include adding evasion capabilities for US environments, generation of user agents for C2 communications, the injection of the 64-bit shellcode in memory command, and reducing backdoor commands to improve the efficiency of the backdoor. Kaspersky researchers also noted that versions v0.6.6 and v0.6.7 have been observed in September 2022 utilizing new tactics, techniques, and procedures (TTPs), which are detailed at a high level in the conclusion of the second report. Technical details as well as indicators of compromise (IOCs) can be viewed in Kaspersky’s two (2) reports linked below.