Phishing Campaign Targets Chinese Nuclear Energy Industry

MITRE Techniques

• [T1589.002] Email Addresses – Reconnaissance – The actor gathers target email addresses to target with spearphishing emails. Quote: ‘The name and email address used to send the phishing emails is crafted to look like it is coming from an “Embassy in Beijing.”’
• [T1566.001] Spearphishing Attachment – Initial Access – Phishing emails deliver RAR attachments containing CHM or Excel payloads. Quote: ‘We identified seven emails pretending to be from the Embassy of Kyrgyzstan, being sent to recipients in the nuclear energy industry in China.’
• [T1059.001] PowerShell – Execution – Encoded PowerShell is used by CHM payload; CHM version 2 uses an encoded PowerShell command stage. Quote: ‘The second version of the CHM payload abstracts the same activity through an encoded PowerShell command stage.’
• [T1203] Exploitation for Client Execution – Execution – Microsoft Office exploits (Excel Equation Editor) are used to execute code. Quote: ‘The Excel payloads simply contain an Equation Editor exploit that creates two different scheduled tasks.’
• [T1053.005] Scheduled Task – Persistence – CHM and Excel payloads create scheduled tasks for persistence and execution. Quote: ‘This activity appears to be a continuation of the tactics and campaign that Bitter APT have been using since at least 2021.’
• [T1218.007] Msiexec – Defense Evasion – Msiexec is used to launch the next stage payloads. Quote: ‘The first version of the CHM file will create a scheduled task that will use the living off the land binary msiexec to execute a remote MSI payload from the C2.’
• [T1218.001] Compiled HTML File – Defense Evasion – CHM files are used to deliver payloads. Quote: ‘CHM files are used to deliver payloads.’
• [T1036] Masquerading – Defense Evasion – Files are masqueraded as legitimate files and scheduled tasks are named after common tasks (e.g., Adobe Updater). Quote: ‘masquerading as legitimate files and scheduled tasks are named after common tasks (eg. Adobe Updater)’
• [T1082] System Information Discovery – Discovery – First-stage payloads fetch computer and user names. Quote: ‘System Information Discovery’ and ‘fetch Computer and User names.’
• [T1071.001] Web Protocols – Command and Control – HTTPS is used for C2 communication. Quote: ‘HTTPS is used for C2 communication.’
• [T1041] Exfiltration Over C2 Channel – Command and Control – Data can be exfiltrated. Quote: ‘Data can be exfiltrated.’