The Federal Bureau of Investigations (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) have issued a joint Flash Alert to U.S. based businesses doing business in China about a remote targeting campaign whereby the tax software that Chinese domestic banks require foreign companies to install is loaded with malware.

Trustwave researchers warned in June 2020 that they had discovered a backdoor in the required tax software used by the Chinese domestic banks dubbed GoldenSpy. The backdoor reportedly could not be removed and allowed remote installation of additional malware.

Not only did the required tax software install malware into U.S. companies’ systems, but when Trustwave researchers detected the malware, several days later, the Trustwave researchers found that the GoldenSpy authors attempted to secretly load uninstaller software on the affected systems to remove the backdoor because they got caught!

The FBI and CISA is warning companies that security teams should be utilized to remove the malware as the attackers are attempting to evade industry standard network security rules.

“The FBI assesses that the cyber-actors’ persistent attempts to silently remove the malware is not a sign of resignation. Rather, it is an effort to hide their capabilities. Organizations conducting business in China continue to be at risk from system vulnerabilities exploited by the tax software and similar supply chains.”