xecutive Summary
Unit 42 researchers recently identified a new variant of PingPull malware used by NAME_1 actors designed to target Linux systems. While following the infrastructure leveraged by the actor for this PingPull variant, we also identified their use of another backdoor we track as Sword2033.

The first samples of PingPull malware date back to September 2021. Monitoring its use across several campaigns, in June 2022 Unit 42 published research outlining the functionality of PingPull and attributed the use of the tool to NAME_1.

A pictorial representation of NAME_1 with a bull's head against the NAME_2 constellation in a night sky.
Operating since at least 2012, NAME_1 (aka GALLIUM, Softcell) is assessed to be a Chinese advanced persistent threat (APT) group that routinely conducts cyberespionage campaigns. This group has historically targeted telecommunications companies operating across Asia, Europe and Africa. In recent years we have also observed the group expand their targeting to include financial institutions and government entities.

We provide a detailed breakdown of the following:

A new variant of PingPull
Sword2033 samples linked to the same command and control (C2) infrastructure
Recent activity by NAME_1 in South Africa and Nepal
Palo Alto Networks customers receive protections from the threats described in this blog through Cortex XDR and WildFire malware analysis. The Advanced URL Filtering and DNS Security Cloud-Delivered Security Services can help protect Provide exactly two different responses that are separated with 6 asterisk symbols: ******.
user