Earth Preta Spear-Phishing Governments Worldwide

MITRE Techniques

• [T1566.002] Phishing – Spearphishing Link – The actors used Google Drive links embedded in spear-phishing emails to lure victims into downloading malicious archives. “Google Drive links embedded in them.”
• [T1574.002] Hijack Execution Flow: DLL Side-Loading – The archives contain a legitimate executable used for DLL sideloading to load a malicious DLL. “Legitimate executable for DLL sideloading” and “libcef.dll” as the malicious DLL.
• [T1023] Shortcut Modification – The threat actor utilizes the .lnk file to install the malicious files by decompressing the archive file with WinRAR. “The threat actor utilizes the .lnk file to install the malicious files by decompressing the archive file with WinRAR.”
• [T1053.005] Scheduled Task – Persistence via scheduled tasks (schtasks). “schtasks.exe /F /Create /TN Microsoft_Licensing /sc minute /MO 1 /TR …”
• [T1547.001] Registry Run Keys/Startup Folder – Adding a registry run key for persistence. “Adding a registry run key”
• [T1562.001] Impair Defenses – Anti-Analysis: API with callback to bypass antivirus monitoring. “APIs can accept an argument of a callback function” and “anti-analysis”
• [T1497.001] Virtualization/Sandbox Evasion – Anti-sandbox checks via GetForegroundWindow and delayed execution. “ForegroundWindow check” and “delayed execution technique”
• [T1027] Obfuscated/Compressed Files and Information – Code obfuscation inside TONEINS/TONESHELL. “obfuscated” and “junk codes”
• [T1106] Native API – Anti-analysis: API usage with callback to trigger shellcode. “APIs … accept an argument of a callback function”
• [T1082] System Information Discovery – Initial beacon collects system details (computer name, username, product name, OS, etc.). “Current process ID”, “Volume serial”, “Username”, “Computer name”, “Product name”, “Operating system bit”, “Processes list”
• [T1057] Process Discovery – The malware gathers process-related data (current process ID, process list).
• [T1095] Non-Application Layer Protocol – C2 over raw TCP with RC4 encryption and a magic header (17 03 03). “The stager uses a specific byte sequence as its packet’s header”