Skip to main content

Chinese hackers use VLC media player to launch cyberattacks

Researchers discovered that Chinese hackers have been using VLC Media Player to launch cybersecurity attacks.

The hacker group, allegedly affiliated with the Chinese government, uses the popular video player to deploy malware on the targeted computer.

A large monitor displaying a security hacking breach warning.
Stock Depot/Getty Images

These activities have been traced down to a hacker group called Cicada, which is also known by a long list of other names, such as menuPass, Stone Panda, APT10, Potassium, and Red Apollo. Cicada has been around for a long time — at least since 2006.

The malware deployed to the victims of the attack opens the door for hackers to obtain all kinds of information. It can grant knowledge on everything about the system, scour through running processes, and download files on command, only broadening the potential for misuse. Such stealth attacks are not uncommon, but this one seems to have taken place on a large scale.

This campaign, involving the popular VLC Media Player, appears to have been started for espionage purposes. According to a report by Bleeping Computer, the targets involve a wide range of entities involved in legal, governmental, or religious activities. Non-governmental organizations have also been targeted. What’s perhaps more staggering is that this activity has spread to entities across at least three continents.

Some of the targeted countries include the U.S., Hong Kong, India, Italy, and Canada. Surprisingly, only one of the victims was from Japan. Cicada group has previously targeted Japan for its cyberattacks many times in the past. Once the attackers gained access to the victim’s machine, they were able to maintain it for up to nine months.

VLC Media Player.

Although VLC was exploited to deploy malware, Bleeping Computer says that the file itself was clean. It appears that a safe version of VLC was combined with a malicious DLL file located in the place as the export functions of the media player. This is referred to as DLL side-loading, and Cicada is not alone in using this technique to upload malware into programs that are otherwise secure.

The custom loader used by Cicada has apparently been seen in previous attacks that were also connected to the hacker team. In order to first gain access to the networks that were breached, a Microsoft Exchange server was exploited. Additionally, a WinVNC server was deployed as a means of establishing remote control over the systems affected by the hidden malware.

There’s more to the VLC exploit than first meets the eye. On top of that, an exploit called Sodamaster was used, which runs stealthily in the system memory without requiring any files. It’s capable of avoiding detection and can delay execution at startup.

The information comes from Symantec and was reported by Bleeping Computer. Symantec’s researchers discovered that these cybersecurity attacks may have started in mid-2021 and continued taking place in February 2022. However, it’s entirely possible that this threat continues to this day.

Although these attacks are certainly dangerous, it’s probable that not every user of VLC needs to worry. Bleeping Computer has stated that the VLC file in question was clean and the hackers seem to have a very targeted approach, centered on certain entities. However, it’s always important to stay on top of security where PCs are concerned.

Update 04/11/2022: We have contacted VLC and asked for an official statement on the matter. According to the developers, the program is “very safe to use,” and it has has, so far, “not been hacked or in breach of security.”

In order to avoid running into security issues, VLC recommends that all users only download the program from the official website and no other sources. In addition, it’s recommended that the program is kept updated on a regular basis.

Editors' Recommendations

Monica J. White
Monica is a UK-based freelance writer and self-proclaimed geek. A firm believer in the "PC building is just like expensive…
You’ll never guess what hackers are using Microsoft Calculator for
A depiction of a hacker breaking into a system via the use of code.

Hackers have found an unusual and unconventional method to infect PCs with malware: distributing dangerous code with Windows Calculator.

The individuals behind the well-known QBot malware have managed to find a way to use the program to side-load malicious code on infected systems.

Read more
Hackers are using stolen Nvidia certificates to hide malware
Nvidia logo made out of microchips.

Nvidia code-signing certificates that were extracted from a recent hack of the chip maker are being used for malware purposes, according to security researchers.

Hacking group LAPSUS$ recently claimed to have stolen 1TB of data from Nvidia. Now, sensitive information has appeared online in the form of two code-signing certificates that are used by Nvidia developers to sign their drivers.

Read more
The rumors were true: Windows 11 is getting a beautiful new media player
windows 11 getting a new media player on screen

After a screenshot in a Windows Insider webcast suggested its existence in September, Microsoft has just officially announced a new media player for Windows 11.

Rolling out first to beta testers enrolled in the Dev Channel of the Windows Insider program, the new media player is designed to make watching your multimedia content more enjoyable on Windows 11. Compared to the old Groove media player in Windows 11, you should notice a cleaner user interface that's more in line with the other core Windows 11 experiences like the new Clock App, as well as Paint. As an example, the status bar on the bottom is now cleaner and more narrow.

Read more