Tencent

A sophisticated exploit kit named MOONSHINE targets Android messaging applications to implant backdoors into users' devices. The entity behind these attacks, Earth Minotaur, focuses on the Tibetan and Uyghur communities by distributing crafted messages through instant messaging platforms, encouraging victims to click on malicious links, redirecting them to servers hosting the MOONSHINE exploit kit, and installing a cross-platform backdoor called DarkNimbus. The upgraded MOONSHINE kit uses pre-configured attack links, browser version verification, multiple Chromium exploits, and phishing for downgrade techniques. It can target various Android applications, including WeChat, Facebook, Line, and QQ. The DarkNimbus backdoor has both Android and Windows versions, with features for gathering device information, extracting personal data, and facilitating surveillance. MOONSHINE has been linked to other Chinese operations, including POISON CARP and UNC5221, indicating a shared ecosystem among Chinese threat actors. Users are advised to be cautious with suspicious links and keep applications updated to mitigate vulnerabilities.