South East Asian government Targeting by Chinese APT Group

 

 

South East Asian government Targeting by Chinese APT Group
 

A sophisticated advanced persistent threat (APT) group believed to be operating out of China has been stealthily targeting Southeast Asian governments. The FunnyDream campaign has been previously linked to high-profile government entities in Malaysia, Taiwan, and the Philippines, with a majority of victims located in Vietnam.          
In this campaign, the group was using numerous malware families, a complex and complete arsenal of droppers, including the Chinoxy backdoor, PCShare RAT, and the FunnyDream backdoor.
According to the available information, not only around 200 machines exhibited attack indicators associated with the campaign, evidence points to the fact the threat actor may have compromised domain controllers on the victim's network, allowing them to move laterally and potentially gain control of other systems. There are no clues as to how the infection happened, although it's suspected that the attackers employed social engineering lures to trick unwitting users into opening malicious files.

Indicators of Compromise


File Hash


1cd8b6f1e2d49e6605f5ae695ea126eee8c82264a9644758126a4c30662ce9d5
91dfbee660be3d11f8a631b4bbf552d0ee60ec908f4d0817643d591726d53bfd
69c1f791402e36a360a901e3e42c177b02281a84c275a228b00b86596636fa95
8ff4979b40ffcef7eedcfeb6fb4fecb42aceb53bc816dc4d36428e12ad67d051
e5365d81ee31e9b86ea14e1ee7abf0809337f3bc9e7b00d7492c2caed4ca5f36
c01110788b9345b5564c1b5b0876a27e1b2501b19b90280054026e89f68a4f48
2d20fc0fd6ef07c367761abe97762f044e90e428addd9a9af7b6cf88087d455b
6f7f142089b1d2e48880f59362c7c50e5d193166bdd5e4b27318133e8fe27b2c
f3b16798054a4510650682e17ae5bc12d27b460eac8314318eeda5e0488869dc
9670563876caa2587d4001d3cbda11a4ca4601fd9f0555ec9468f4796fce7ae6
26afbe3cab4967cb48ada596959ef77367da9cb194c71db77ebe1fcbe7aabf6f
0a2a047c2b670f7da11a7d72e2ab3b867eebb6ccbe3ccad92817a6e74ac343a2
70891a33bcd94e40cdbb0660b983dd7dc439005b2cae614c7b7504fd24eb8696
942e810563d142c949215dbe38562f1ffb31d4b9afc8a98047d97ed2e7ece478
f976a52f2d82e608f95e95d41e2eacad58e19a9e9cb92f061090d72fd2703413
f262662bd9c78137837e5943f891da3b520095668c0592bc11c0dc742db0640a
9a3829bd0a4dd7b72c54d1aed972f91aede57357d7a9dcd3d9f8b8d192189a03
e61649ac70198e223c123ad29c7d02ebe4fe6da7f35282d26bd93d466e85176d
f6f9d0620db35c1f6a3fad9c9bc6d7aaf6594355b606bce2b9513aa721679d95
139d4c31f1dfd17b74506931622d12c537d597c85e52a58065cf3a917b469aea
a224ab4d8ca5ed62755b1b7f36ce6c80e89a684d1e792400d8fa889b1860fcc6
311f3011172618c95fcf339ac3ddce10c415c95215eb6cea60d5eb9b00a5de51
0f5cac319750d37eb6a7d38c1deec7d5839c642287b48b0fb8a1921185b521f1
f76847bed642a92d3a5fac4782d0ae2a140203579f43f7b3c8db4090853986ad
7b524c3bdd5d5474b6e050084e3f32d2bf7f5c4539b44221e4bc2987b2deb56d
8d3b5825690d4f893cc577b22cbe3c12232b9895c9a0417b750ba722e8851d6d
4caab78b44c288406b3d66feab853a399c72b237e244993434dd6206013cc371
8c49d7f83af949f4145d5da32c308ef98ebfc5fce030a405bf2b6855a8a0575e
85bd4f36c20222d1e0a1908bb2befd9a19d9e476ef8fdffa8c7b2f14ec22ce01
7ecba3270ff06c5d618a78c4e471f457e8672211bb8cdd4aa58b6516ea5fe603
f7356689c3c4caca57d7edd4a45ac3a2cfa672ccf444e80a69fd271210d320f3
631c62e067667a02da63a97aeeb556bece8394deee59e62b48f63baecf4cf613
2e6dfca6b2b8a11d6eb8933bd7ed7f17ca46499a3ee548bbb086406eb57b2204
28570122e952f25c92dfb83707c502a5036b9f99770127435cbb8c7e6796cce4
25ce8296bc4da119093d847afc18ee030a4c94a39066732227a73f8908c40292
a276a0e01b5024f46ef1a05a5e9810c39b8757a0cea665519bf619bf35604008
a78dace0fd8c043016406f99f0103cd7ebee67e21261c0097efe6072bfc680b0
58f88767a4599a95f29048852f92afe52a32b646ffdd50291cd1be5a97ebe7ea
2fdc7963612be26b8c13ed59572bd2785c1d11da15494c34a0f1632530fddf64
409e95e0824c4e80450196dbde2e64a2424d3e724760e471c1e68d3fb67dec24
915af21d627f5bec059800bb9740a228e93fae8dd4fd574bd4d2812c7d6adf8d
32cabf2952f88283251c36751e04a45bfa78cdb0835460619d4812b882795c03
63e8488de30c9b615c76d4e568f0a1b738fcad665e58571c299d8e9d7752a637
aaf9ce055918b0092bba7db26816237170870601614155defe143986b5dac8fe
05f9a809a6800112fa1e02975489974d003d55810a4cfb11a0705e8a427ea734
2bf0b8453c5f5a3f616894d72acb61868bb6c75403891411a123eceb6d0f9f9b
46e1381c0228502276f1eb3b755f9f34f6a6d4ffbbecc95bde852ddf40e09ad8
74b8030c67320030998e8f58da4a6215dd4cc4c0aef7863c5fc8a1985cbf22a4
9a63d810f69eb35ee8ee3797bd1574e08b67f31c0e368bf9cf01202f5f73c664
1aa170383d473b6adb16032942b34eb136dd013ea8e2f5cc8fec7356a92191b3
7d92c7bc22dc95526a0c8713211b9bcfe85cac2c4a760067e69992afa19efbe5
455d890479f1137797bfb32e6f5f1a4634a69c11654bb5ec0b6710a25418a12e
ba3d8ff9b3f6b6223dd33dee15321e267cc28627723e68cd632e59d85c529330
780739a25d90fd850e82792d59de4c04530337e79cd4b7a3149f229b75a7d5ce
682df3d96cf40a24637905d9ab7a62e3dd0777a1320b078bc89951076f842744
47519ef2e613fd17b18e885bb09cfa1e047feaa86d6d16d3916d14c3b244c533
5e90afbdfb63110fa3c9cdd79ef474852996a895a6bad66a663e2ccc51dd339b
145ec6dac68fe28857220db70575c5f97540c901509e1b009ecb7857047d0bfd
5648ba8ba4d1dd623f82fb9adebcf87085a8a619147e7979ea08f763ab69b0cb
c41fa483bd7e186d754d592405d4649adcb78192b3a66586e526ecb6be0f17b5
aefe49a247322d3bbefc9e29d30c809499518b947a88d0c2ac9e11cf735b1544
80a1fd088d0153a0c33fd606660f9d8e82349cdb6fade850cc06e07fe6732d4b
e97ac9089fa80dc38e8fe920008c117d93203e45a1516d24b59f17f7055b8ced

Comments

Post a Comment

Popular posts from this blog

Revil Ransomware Targeted Kaseya

Image
  Revil Ransomware Targeted Kaseya   REvil is a ransomware-as-a-service (RaaS), delivered by “affiliate” actor groups who are paid by the ransomware’s developers. The REvil actors launched a malicious update package that targeted customers of managed service providers and enterprise users of the on-site version of Kaseya’s VSA remote monitoring and management platform.   Indicators of Compromise URLs/Domains: architekturbuero-wagner.net mindpackstudios.com vitavia.lt bouncingbonanza.com lukeshepley.wordpress.com igfap.com bockamp.com levihotelspa.fi exenberger.at tinyagency.com familypark40.com alfa-stroy72.com boompinoy.com mdacares.com architecturalfiberglass.org slupetzky.at sinal.org qualitus.com deepsouthclothingcompany.com groupe-frayssinet.fr synlab.lt kamienny-dywan24.pl ilcdover.com humancondition.co...
Read more

Buer Loader provides malware-as-a-service

Image
  Buer Loader provides malware-as-a-service       Buer is a malware-as-a-service offering that is used to deliver whatever package the service customer desires, providing initial compromise of targets’ Windows PCs and allowing them to establish a digital beachhead for further malicious activity. Buer has previously been tied to banking trojan attacks and other malware deployments—and now, apparently, has been embraced by ransomware operators. In many ways, Buer is positioned as an alternative to Emotet and Trickbot’s emerging Bazar loader. “A new modular bot…written in pure C” with command and control (C&C) server code written in .NET Core MVC (which can be run on Linux servers). Indicators of Compromise File Hashes 10943b90969722bf359e4b039d2953e02072e03e0a7f1bdb1dea09d9197288b1 32616f41a71fc7a4286736a6fc77da2a555dbc8301a8bd5fbdbab231955a42c5 5b607f001ba62e042344d30b65cad2774df2deb50e0b92c33da85e9338c123c4   6c7f43434e5db8703c0a47dedeeab976159d8704bfb...
Read more

BANDOOK(RAT)

Image
    BANDOOK(RAT)-Malware   The payload in this attack is a variant of an old full-featured RAT named Bandook. Written in both Delphi and C++, Bandook has a long history, starting in 2007 as a commercially available RAT that was developed by a Lebanese individual nicknamed PrinceAli.Bandook’s execution flow starts with a loader, written in Delphi, that uses the Process Hollowing technique to create a new instance of an Internet Explorer process and inject a malicious payload into it. The payload contacts the C&C server sends basic information about the infected machine and waits for additional commands from the server. Indicators of Compromise File Hash MD5 27f8d8bbbeeda5fc439ee18d9d4da343 44584c8d010242fddb44afe5ce860872 a6501c62b3a6ffa8d028a88138fe509f 7c15ee5b9a12dacaace8fb62271f12f1 4e9e12c98cfbc5f3aa3c1345bd063fa0 7ef261c151519e66ec369c63e4b1aed4 6effed1b1bb5e9ed6aafacb075c1d4e2 0475771b8bc3efc28b1834f3add608f3 045ce6679ed4086e2ded58470e24c15a 28ad9ace11919b57bf54...
Read more