Tibet Trojan attacks connected to Chinese programmer
Security firm AlienVault thinks it has identified a key Chinese programmer with connections to the Chinese Government who could be behind a long-running malware assault on pro-Tibet campaigners, including with the recent PlugX RAT Trojan.
It’s extremely rare that security companies are able to put a name and a face to specific pieces of malware so the connection it stumbled upon when researching PlugX could attract some attention.
While researching PlugX’s binaries, the company started noticing similarities in some of the software’s debug paths. Searching for similar debug paths in the User folder, the firm noticed the same ‘whg’ subfolder in a program called SockMon distributed from a named domain connected to a company, Chinansl.com Technology Ltd that had published security vulnerabilities in the past.
