Threat researchers observed a new attack campaign named STIFF#BIZON targeting high-value targets in the Czech Republic, Poland, and other countries, with artifacts possibly linked to North Korea’s APT37 (Konni). The campaign uses a multi-stage infection chain starting with phishing attachments, Base64-encoded PowerShell payloads, and a series of modules (e.g., capture.net.exe, chkey.net.exe, pull.net.exe, shell.net.exe) to control the host, exfiltrate data, and maintain persistence. #STIFFBIZON #Konni #APT37 #NorthKorea #Bizon #OlgaBozheva
Keypoints
- STIFF#BIZON is a Konni/APT37-aligned campaign observed targeting multiple countries, with indications of shared tradecraft and artifacts.
- Initial access is via phishing documents containing a compressed archive with malicious files (missile.docx and _weapons.doc.lnk).
- The loader uses Base64-encoded payloads and PowerShell stagers to download and execute additional components (weapons.doc and wp.vbs) and establish C2.
- Stage 2 (wp.vbs) creates a new scheduled task (Office Update) to run a PowerShell script encoded in Base64, enabling C2 communications.
- Stage 4 introduces multiple modules (capture.net.exe, chkey.net.exe, pull.net.exe, shell.net.exe) for credential access, browser data theft, and an interactive shell for command execution.
- Indicators of compromise include specific IPs (e.g., 185.176.43.106) and domains (547857.c1.biz, 65487.c1.biz) plus a set of dynamic hashes for loaded components.
- Attribution to APT37 remains uncertain; possible false-flag manipulation and correlations with FancyBear/APT28 are discussed.
- Securonix provides mitigations, detections, and hunting queries focused on credential protection, restricted PowerShell/VBScript execution, and geo-blocking.
MITRE Techniques
- [T1566.001] Spearphishing Attachment – Infection starts through phishing emails with a malicious attachment. ‘The infection starts through phishing emails, which attempt to lure the victim to open a malicious attachment. In this particular case the threat actors attached a file containing the malware.’
- [T1059.001] PowerShell – Base64 payload executed as a PowerShell stager initiating C2 and downloading/running files. ‘The Base64 payload is executed as another PowerShell stager which initiates C2 communication and downloads and runs both “weapons.doc” and “wp.vbs” files.’
- [T1059.003] Windows Command Shell – Command-line activity observed during recon (e.g., ‘cmd /c tasklist’ and similar). ‘Initial recon begins: cmd /c cd /d “C:Users” && dir /a/o-d/s *.*’
- [T1053.005] Scheduled Task – wp.vbs creates a new scheduled task that runs a PowerShell script encoded in Base64. ‘The scheduled task executes a PowerShell script encoded in Base64.’
- [T1569.002] Service Execution – Service-based persistence and execution (e.g., wpcsvc service manipulation and DLL/services). ‘Service installation for persistence’ and related registry/service commands (e.g., reg add … wpcsvc.dll).
- [T1134.001] Token Impersonation/Theft – Decrypting browser state to bypass MFA using a stored state key. ‘This state key is encrypted using DPAPI… decrypt the cookie database offline and use this to import cookies into a machine controlled by the TA and access any available services without MFA authentication.’
- [T1548.002] Bypass User Account Control – Anti-debugging and privilege escalation via rundll32 usage and WaitForDebugEvent tricks. ‘anti-debugging techniques with API WaitForDebugEvent and ContinueDebugEvent to execute passed cmdline.’
- [T1027.005] Indicator Removal from Tools – Deleting traces (e.g., ‘del /f /q’ of artifacts). ‘del /f /q “C:Windowssystem32wpcsvc.*”‘ (examples of cleanup steps).
- [T1606.001] Web Cookies – Harvesting browser credentials to access services without MFA. ‘State key … encrypted using DPAPI… decrypt the cookie database offline and use cookies to access services without MFA authentication.’
- [T1082] System Information Discovery – Gathering host information during recon (e.g., ‘systeminfo’, ‘dir’, ‘tasklist’). ‘cmd /c systeminfo’ and similar commands.
- [T1113] Screen Capture – Capturing screenshots and exfiltrating results. ‘Capture.net.exe … to create a screenshot using Win32 GDI API and upload the gzipped results to the C2 server.’
- [T1119] Automated Collection – Automated data gathering from the infected host (e.g., browser data, credentials).
- [T1071.001] Web Protocols – Command and control over HTTP(S) endpoints (view.php, info.php, dn.php). ‘Download lure document: weapons.doc: /view.php?…’ and similar C2 communications.
- [T1105] Ingress Tool Transfer – Transferring tools/TA files to the victim host. ‘Transfer tools/TA files to victim host:’
- [T1041] Exfiltration Over C2 Channel – Data exfiltration conducted via C2 channel. ‘Automated Exfiltrated’ and ‘Exfiltration Over C2 Channel’ referenced.
Indicators of Compromise
- [IP] 185.176.43.106 – Host communication / C2 activity
- [Domain] 547857.c1.biz – C2/recon domain
- [Domain] 65487.c1.biz – C2/recon domain
- [SHA256] food.bat – 07b10c5a772f6f3136eb58a7034bcb5ce71c0c740aaa528d3bae318d939b2242
- [SHA256] seed.bat – 5d28072d76bd6af944fcec8045cbc24410a58fe70eef6f83c50934245ec92e60
- [SHA256] wpcsvc.dat – b9727fb553894d857900c0a18f82723659d136329ef56bbe9388905a666f1197
- [SHA256] wpcsvc.dll – 12df9753abd867118ce97e6570c2bde780c7913ecab4b91ef7f540c4fede2772
- [SHA256] wpcsvc.ini – 6f325fb0a7de6f05490f1eb3c0e5826a44a11ed2dee4c17f486b8200f539d49e
- [SHA256] wp.nprv.dll (wpnprv.dll) – 35d38eed9168c16d2dd595fa9542a411080d12de971ea3d3c12dd5c44e454049
- [SHA256] weapons.doc – 31a9801e5e2e5fd7f66f23bc8456069b6a958e03838e431ccf7d84867f88c840
- [SHA256] _weapons.doc.lnk – 5fce9f27326549cc6091ba1f806e7c161878a2642411a941ba484b0c1c7adb8f
- [SHA256] wp.vbs – 9f27430ed919e74c81b0487542fe29a65a0b860a6a290e3b032f3a5ba7c691bc
- [SHA256] z.exe – b6987a717741329d5b64f769c9d3f1f572b42c7375dd841aecbf2b6d4096d6de
- [SHA256] capture.net.exe – dee7826f5b7f0cbc97a81de8f6844a011cc836269bc5d00a0594dfec5386613c
- [SHA256] chkey.net.exe – 44566d506e0348c999a66ee5158b0014a74bdd3f038e40ca76e5b069b8991f85
- [SHA256] pull.net.exe – 9c82477eac14abfb7f507806a941e4e5633dd07c4b73a44b10296ec28e3df162
- [SHA256] shell.net.exe – 5f3483823342318c4154bbef806cec2187a0360f079237a456603896ff7f5473
Read more: https://www.securonix.com/blog/stiffbizon-detection-new-attack-campaign-observed/