View all newsletters
Receive our newsletter - data, insights and analysis delivered to you

Chinese state-backed hackers Iron Tiger target Linux devices with new malware

The gang has updated its trademark malware, and it could spell trouble for businesses running the popular operating system.

By Claudia Glover

Chinese state-backed hackers APT27, also known as Iron Tiger, have developed a malware toolkit called SysUpdate that targets devices running on the Linux operating system. The criminals, who specialise in cyber espionage, are part of a Chinese cybercrime syndicate called TiltedTemple that has been going after targets across Europe.

Chinese APT gang Iron Tiger releases new malware targeting devices operating Linux. (Photo by Telly/Shutterstock)

Earlier versions of the malware toolkit SysUpdate are designed to evade security software and resist reverse engineering, and this latest version could be more dangerous than ever, new research suggests.

Chinese APT cyber espionage gang releases malware tool

The Chinese cyber espionage gang is also tracked as Bronze Union, Emissary Panda and Lucky Mouse, and is known to use another Linux malware called rshell, as well as SysUpdate. 

The new malware variant now uses five files in its infection routine instead of the usual three. A report by security company Trend Micro details that some of the other rootkits APT27 uses are also new.

SysUpdate has fallen out of favour among hackers in recent years, the report says, but has now been uncovered once more with new and improved Linux capabilities. This could be in part due to the current resurgence in popularity of malware targeting Linux, which can be found on the majority of the world’s mobile devices as well as PCs.

APT27: ‘Iron Tiger’ back in the spotlight

Iron Tiger is known for carrying out cyber espionage on behalf of the Chinese government. It was first spotted in 2009 and typically targets governments, defence companies and critical national infrastructure in Asia, America and the Middle East.

It operates as part of a larger syndicate of Chinese cyber espionage gangs called TiltedTemple, another member of which has recently been uncovered in a spear phishing attack on Belgian MP Samuel Cogolati. 

Content from our partners
Scan and deliver
GenAI cybersecurity: "A super-human analyst, with a brain the size of a planet."
Cloud, AI, and cyber security – highlights from DTX Manchester

The MP was reportedly targeted in January 2021 while writing a resolution to warn of “crimes against humanity” against Uyghur Muslims in China. The Belgian Centre for Cyber Security Belgium (CCB) wrote that the MP had probably been infected by the specific Chinese cybercriminal, a move that was seen uncharacteristically bold as it called out the Chinese hackers directly.

The European Union Agency for Cybersecurity (ENISA) echoed this last month by publishing a warning against all of the members of the syndicate, stating that China allowed its cybercrime gangs to target the European Union. 

The warning says Belgium urged Chinese authorities to take action against malicious cyber activities undertaken by Chinese cybercriminals. These activities can be “linked to the hacker groups known as APT27, APT30, APT31 and GALLIUM,” all of which are members of TiltedTemple, the report adds.

“These threat actors present important and ongoing threats to the European Union,” it says. “Recent operations pursued by these actors focused mainly on information theft, primarily via establishing persistent footholds within the network infrastructure of organisations of strategic relevance.”

Read more: What is the NSA actually doing in China?

Websites in our network
Select and enter your corporate email address Tech Monitor's research, insight and analysis examines the frontiers of digital transformation to help tech leaders navigate the future. Our Changelog newsletter delivers our best work to your inbox every week.
  • CIO
  • CTO
  • CISO
  • CSO
  • CFO
  • CDO
  • CEO
  • Architect Founder
  • MD
  • Director
  • Manager
  • Other
Visit our privacy policy for more information about our services, how Progressive Media Investments may use, process and share your personal data, including information on your rights in respect of your personal data and how you can unsubscribe from future marketing communications. Our services are intended for corporate subscribers and you warrant that the email address submitted is your corporate email address.