Chinese State-Sponsored Cyber Espionage Activity Targeting Semiconductor Industry in East Asia

MITRE Techniques

• [T1574.002] DLL Side-Loading – DLL side-loading attacks use the DLL search order mechanism in Windows to plant and invoke a legitimate application that executes a malicious DLL payload. Quote: “…DLL side-loading attacks use the DLL search order mechanism in Windows to plant and invoke a legitimate application that executes a malicious DLL payload…”
• [T1105] Ingress Tool Transfer – The BitsTransfer module in PowerShell is used to fetch malicious binaries from a Cobra DocGuard server. Quote: “This downloader utilizes the BitsTransfer module in PowerShell to fetch malicious binaries from a very likely compromised Cobra DocGuard server.”
• [T1059.001] PowerShell – PowerShell-based download and execution workflow observed, including the Start-BitsTransfer usage. Quote: “The PowerShell command line execution after the successful infection of the Cobalt Strike downloader: Start-BitsTransfer -Source …”
• [T1071.001] Web Protocols – The Cobalt Strike beacon uses a C2 profile and disguises traffic (Malleable C2) to resemble normal web traffic. Quote: “A Malleable C2 profile specifies how the beacon will transform and store data in a transaction to its C2 server. This technique is used for evasion of traditional firewall defenses.”
• [T1140] Deobfuscate/Decode Files or Information – The XOR-encrypted payload is decrypted with a one-byte length key (0x01). Quote: “The shellcode decryption routine uses a one-byte length key (0x01) to decrypt the XOR-encrypted Cobalt Strike payload.”
• [T1036.005] Masquerading – The threat actor masquerades components as legitimate binaries (e.g., securityhealthservice.exe, vfhost.exe). Quote: “Masqueraded names included securityhealthservice.exe, secu.exe, vfhost.exe, vxhost.exe, vx.exe, and v.exe.”
• [T1047] Windows Management Instrumentation – WMI-based execution is used for lateral movement or execution. Quote: “Windows Management Instrumentation (WMI) execution.”
• [T1566.001] Phishing: Spearphishing Attachment – A decoy PDF themed around Taiwan Semiconductor Manufacturing is used to lure victims. Quote: “The threat actor used a TSMC-themed PDF as a decoy, displayed after the execution of the HyperBro loader.”
• [T1036.005] Masquerading – Reiterated for the tactic of disguising as legitimate software in distributed components. Quote: “Masquerading: Match Legitimate Name or Location – T1036.005”
• [T1140] Deobfuscate/Decode Files or Information – Reiterated in the appendix for the XOR-based decryption of shellcode. Quote: “The decryption routine uses a one-byte length key (0x01) to decrypt the XOR-encrypted Cobalt Strike payload.”