Chinese APT Exploits VSCode to Target Asian Governments

Unit 42 researchers uncovered that the Chinese APT group Stately Taurus exploited Visual Studio Code in espionage operations targeting Southeast Asian governments. This novel technique used VS Code’s embedded reverse shell to gain footholds, with links to ShadowPad backdoor activity and multiple TTPs observed by researchers. #StatelyTaurus #ShadowPad

Keypoints

Threat Actor: Stately Taurus (a Chinese APT group with multiple aliases).
Target: Government entities in Southeast Asia.
Novel Technique: Abuse of Visual Studio Code’s embedded reverse shell feature to gain access.
Persistence: Scheduled task launching a script named startcode.bat to maintain access.
Exfiltration: Data exfiltration conducted via Dropbox to blend in and evade detection.
ShadowPad Link: A ShadowPad backdoor activity cluster operated in parallel within the same target environment, with potential connections and shared indicators.

MITRE Techniques

[T1219] Remote Access Software – Abuse of Visual Studio Code’s embedded reverse shell feature. Quote: ‘Exploitation of Visual Studio Code’s embedded reverse shell feature.’
[T1041] Data Exfiltration – Using Dropbox to exfiltrate sensitive data. Quote: ‘Using Dropbox to exfiltrate sensitive data.’
[T1003] Credential Dumping – Utilizing Mimikatz and LaZagne for credential harvesting. Quote: ‘Utilizing Mimikatz and LaZagne for credential harvesting.’
[T1021] Lateral Movement – Using PsExec and WMI for lateral movement across the network. Quote: ‘Using PsExec and WMI for lateral movement across the network.’
[T1021.004] SSH – OpenSSH-based lateral movement. Quote: ‘OpenSSH allows the user to connect to a remote machine via SSH.’
[T1560.001] Archive Collected Data – Archiving files for exfiltration (e.g., Listeners.bat). Quote: ‘Listeners.bat to archive files for exfiltration.’
[T1055] Process Injection – ShadowPad spawns and injects code into wmplayer.exe, which in turn spawns and injects code into dllhost.exe. Quote: ‘ShadowPad spawns and injects code into wmplayer.exe, which in turn spawns and injects code into dllhost.exe.’
[T1574.002] DLL Side-loading – imecmnt.exe loaded via DLL sideloading to load the ShadowPad module (imjp14k.dll). Quote: ‘abused the legitimate process imecmnt.exe via DLL sideloading to load the ShadowPad module (imjp14k.dll).’
[T1047] Windows Management Instrumentation (WMI) – Used WMI to execute remote processes. Quote: ‘WMI to execute remote processes in the environment.’
[T1110.005] Password Spraying – Tscan capabilities include scanning, password spraying and command execution. Quote: ‘Tscan’s capabilities include scanning, password spraying and command execution.’
[T1046] Network Service Scanning – SharpNBTScan used to perform environment scanning. Quote: ‘SharpNBTScan (renamed as win1.exe) to perform scanning in the environment.’
[T1003.003] NTDS.dit – NTDS.dit theft via Vssadmin and SYSTEM hive. Quote: ‘to steal Active Directory data, the attacker attempted to steal NTDS.dit as shown in Figure 12.’
[T1543.003] Windows Service – Persistence via a service. Quote: ‘to keep ShadowPad running on victim machines, the attacker created persistence via a service.’
[T1003.001] LSASS Memory Dump – Lsass-dump-main used to retrieve credentials from memory. Quote: ‘Lsass-dump-main to retrieve passwords in memory.’
[T1021.002] SMB/Windows Admin Shares – PsExec used for lateral movement via SMB. Quote: ‘PsExec allows the execution of processes on remote systems.’
[T1059] Command and Scripting Interpreter – Listeners.bat indicates batch file usage for command/script execution (embedded in the exfiltration workflow). Quote: ‘Listeners.bat to archive files for exfiltration’ (contextual reference).

Indicators of Compromise

Stately Taurus Cluster
SharpNBTScan

[Hash] 506fc87c8c96fef1d2df24b0ba44c8116a9001ca5a7d7e9c01dc3940a664acb0
[Hash] aa2c0de121ae738ce44727456d97434faff21fc69219e964e1e2d2f1ca16b1c5

Listeners.bat

[Hash] 8fdac78183ff18de0c07b10e8d787326691d7fb1f63b3383471312b74918c39f
[Hash] 39ceb73bcfd1f674a9b72a03476a9de997867353172c2bf6dde981c5b3ad512a

ShadowPad Cluster
ShadowPad

[Hash] 0f11b6dd8ff972a2f8cb7798b1a0a8cd10afadcea201541c93ef0ab9b141c184
[Hash] 456e4dae82a12bcda0506a750eac93bf79cc056b8aad09ec74878c90fd67bd8f
[Hash] bdadcd2842ed7ba8a21df7910a0acc15f8b0ca9d0b91bebb49f09a906ae217e6

ShadowPad C2

[IP] 216.83.40[.]84

ShadowPad Service Names

WindowsMailServices
test12
WindowsEdgeUpdateServices
WindowsMailServices
Javaservice
WindowsEdgeUpdateServices

Mimikatz

[Hash] ac34e1fb4288f8ad996b821c89b8cd82a61ed02f629b60fff9eb050aaf49fc31

In-Swor

[Hash] 440e7bce4760b367b46754a70f480941a38cd6cd4c00c56bbaeb80b9c149afb1
[Hash] 5bfc45f7fce27d05e753a61dde5fab623efff3e4df56fb6a0cf178a0b11909ce
[Hash] fb0c4db0011ee19742d7d8bd0558d8ee8be2ef23c4c61a3e80a34fba6c96f3ff
[Hash] 965dd0b255f05ff012d2f152e973e09ceb9e95b6239dc820c8ac4d4492255472

Lsass-dump-main

[Hash] acedfe9c662c2666787cbbf8d3a0225863bab2c239777594b003381244ed81ba

Tscan

[Hash] cca63c929f2f59894ea2204408f67fc1bff774bb7164fde7f42d0111df9461bd

LaZagne

[Hash] 3cc5ee93a9ba1fc57389705283b760c8bd61f35e9398bbfa3210e2becf6d4b05

ShadowPad Cluster Attacker C2

[IP] 185.132.125[.]72

Appendix: Further Activity Related to ShadowPad

The threat actor used the following tools to perform reconnaissance in victim environments:

Tscan: The attacker used a variation of the open-source tool fscan, which they named Tscan. Tscan’s capabilities include scanning, password spraying and command execution.

The ShadowPad Activity Tools

ADExplorer64.exe: The attacker attempted to use AD Explorer to query an Active Directory database.

Credential Theft

In-Swor and Mimikatz-related tooling

NTDS.dit and Registry

NTDS.dit theft with Vssadmin to create a shadow copy and dumping the SYSTEM hive from the registry.