Mongolia
MNG
MonPass CA compromised; installer backdoored and multiple webshells found
Avast reported that Mongolian CA MonPass’ public web server was repeatedly breached and its official certificate client installer was backdoored with a Cobalt Strike-based RAT. The trojanized installer was available from February 8 to March 3, 2021, and investigators found eight webshells/backdoors on the compromised server.
60
Estimated severity
60 / 100
90
Source reliability
90 / 100
Approximate Date
03/03/2021
Targeted Company
MONPASS
Targeted Company Supply Chain Impact
Distribution & Fulfillment
Procurement & Sourcing
Production & Manufacturing
Sales (Retail & Ecommerce)
Warehousing
Service Delivery
Unrecognized Impact
Supply Chain Relations
No information
Geographic Impact
Country Targeted Company
Other Affected Countries
No other affected countries reported
Target country
Mongolia
Affected countries
Mongolia
Impacted regions
Asia · Mongolia
Operational Impact
Duration
24 days
Financial impact (USD M)
No information
Impact types
No information
Affected sectors
Technology & IT Services
Affected departments
Information Technology
Attack Profile
Attack types
Software supply chain compromiseMalwareBackdoorRemote access trojan
Attributed threat actors
No information
Sources
Incident Sources
therecord.mediahttps://therecord.media/mongolian-certificate-authority-hacked-eight-times-compromised-with-malwaregendigital.comhttps://www.gendigital.com/blog/insights/research/backdoored-client-from-mongolian-ca-monpassthehackernews.comhttps://thehackernews.com/2021/07/mongolian-certificate-authority-hacked.htmlbankinfosecurity.comhttps://www.bankinfosecurity.com/mongolian-certification-authority-monpass-breached-a-16990securityaffairs.comhttps://securityaffairs.com/119677/malware/mongolian-ca-monpass-hack.htmlheimdalsecurity.comhttps://heimdalsecurity.com/blog/cybercriminals-compromise-mongolian-certificate-authority-monpass-to-distribute-malware