[Cyware] Italian government agencies and companies in the target of a Chinese APT

MITRE Techniques

• [T1566.001] Spearphishing Attachment – The first campaign on June 24, 2024 used an Office document. ‘The first campaign on June 24, 2024 used an Office document.’
• [T1566.002] Spearphishing Link – The July 2 campaign directly uses a link to the malicious URL. ‘The July 2 campaign instead directly uses a link to the malicious URL.’
• [T1059.005] VBScript – The VBScript ‘vcruntime.vbs’ runs commands to launch Java and MSI, as shown in the infection chain. ‘the execution of the Java application called “vcruntime.jar” via the VBS script “vcruntime.vbs”.’
• [T1218.005] Msiexec – The installer uses Windows Installer to deploy SkypeMeeting.msi, which installs Skype for Business and launches the malware chain. ‘The execution of SkypeMeeting.msi will therefore involve the installation of the original Skype for Business package…’
• [T1027.001] Obfuscated/Encrypted Files and Information – RC4-encrypted shellcode within vcruntime.bin. ‘contains a shellcode encrypted with RC4’
• [T1113] Screen Capture – The RAT modules include ScreenSpyS.dll for screen capture. ‘ScreenSpyS.dll -> screen capture’
• [T1071.001] Web Protocols – C2 communications occur over web protocols with encryption and Base64 encoding. ‘Communication with the command and control server takes place in an encrypted manner and then encoded in Base64.’
• [T1082] System Information Discovery – Discovery commands executed to learn host/network information (systeminfo.exe, ipconfig, net user, etc.). ‘systeminfo.exe’, ‘ipconfig /all’, ‘net user’, ‘netstat -ano -p tcp’ and other discovery commands.