Cyble researchers describe SharpPanda, a China-linked APT, expanding its arsenal with undetected loaders and weaponized Office documents to target high-level government officials in G20 nations. The campaign relies on spear-phishing with exploits in Microsoft Word, a RoyalRoad-based loader, and a backdoor capable of data exfiltration, persistence via a scheduled task, and expansive post-compromise actions. #SharpPanda #RoyalRoad
Keypoints
- SharpPanda APT has intensified operations targeting government officials from G20 countries, building on prior Southeast Asia-focused campaigns.
- Initial access is achieved via spear-phishing emails delivering weaponized MS Office documents that exploit vulnerabilities and pull in the next-stage payload from a C2 server.
- The weaponized RTF document uses RoyalRoad to embed an encrypted payload and shellcode that decrypts and drops a DLL loader named “c6gt.b” in %temp%.
- Persistence is established by creating a scheduled task that runs rundll32.exe to execute StartA from the dropped DLL daily.
- The DLL loader collects system information, checks for antivirus, encrypts data with RC4, encodes with base64, and exfiltrates to a C2 URL over an uncommon port.
- The final payload (backdoor) can capture screenshots, enumerate processes, manage files, and retrieve registry/network data, enabling wide post-compromise capabilities.
MITRE Techniques
- [T1566] Spear-phishing Attachment – The infection process initiates through a spam email comprising an attached MS Office document named ‘[FINAL] Hiroshima Action Statement for Resilient Global Food Security_trackchanged.docx.’ These emails, with the subject line ‘[Sending Finalized Text] G7+Partners FASS Meeting,’ are distributed to multiple employees within government entities across G20 countries. – “The infection process initiates through a spam email comprising an attached MS Office document named [FINAL] Hiroshima Action Statement for Resilient Global Food Security_trackchanged.docx. These emails, with the subject line [Sending Finalized Text] G7+Partners FASS Meeting, are distributed to multiple employees within government entities across G20 countries.”
- [T1204] User Execution – The weaponized documents prompt users to open them, enabling the next stage via remote template injection to retrieve payload from C2. – “The emails contain weaponized versions of seemingly genuine official documents, which employ the remote template injection method to retrieve the next stage of the malware from the TA’s Command-and-Control (C&C) server.”
- [T1203] Exploitation for Client Execution – RoyalRoad weaponizes the RTF by exploiting Microsoft Word’s Equation Editor vulnerabilities to deliver code. – “RoyalRoad leverages a specific set of vulnerabilities, including CVE-2018-0802, CVE-2018-0798, and CVE-2017-11882, within the Equation Editor of Microsoft Office.”
- [T1053] Scheduled Task – The loader creates a persistent scheduled task that runs a DLL export daily. – “creating a scheduled task entry, which executes the export function ‘StartA’ from the DLL ‘c6gt.b’ using rundll32.exe on a daily basis.”
- [T1497] Virtualization/Sandbox Evasion – The loader incorporates anti-analysis techniques to hinder detection. – “anti-analysis and anti-debugging techniques into their loaders to avoid being detected.”
- [T1027] Obfuscated/Compressed Files or Information – The RTF contains an encrypted payload and shellcode. – “The RTF file includes both an encrypted payload and shellcode.”
- [T1082] System Information Discovery – The loader collects host machine details and security status. – “The loader collects various data from the victim’s computer. This includes the hostname, operating system name, OS version, username, Internet information, as well as the presence of any installed anti-virus software on the machine.”
- [T1105] Ingress Tool Transfer – The initial payload is downloaded from a remote C2 server. – “Upon opening the document, it initiates the download of a new payload from the attacker’s remote server (hxxp[:]//13[.]236[.]189[.]80:8000/res/translate[.]res), which is RTF file serving as the next-level payload.”
- [T1065] Uncommonly Used Port – C2 communications occur via non-standard ports. – “hxxps://13[.]236[.]189[.]80:8001/G0AnyWhere_up[.]jsp?Data=[redacted]”
- [T1071] Application Layer Protocol – Exfiltration over an HTTP(s)-like channel to the C2. – “The encrypted data is then exfiltrated using the below C&C URL: hxxps://13[.]236[.]189[.]80:8001/G0AnyWhere_up[.]jsp?Data=[redacted]”
Indicators of Compromise
- [MD5/SHA1/SHA256] context – f39442edc4a96ce729e50f66901263e1, 734b1cd163937e9509ea616f5f7ff8870f7be8e5, and 1 more hash
- [MD5/SHA1/SHA256] context – ea889308acb4249af92807cc7d70f084, 92c8f9ea9b6555e1b9c42cd7302f7caf62eb83e6
- [MD5/SHA1/SHA256] context – 57b64a1ef1b04819ca9473e1bb74e1cf4be76b89b144e030dc1ef48f446ff95b
- [URL] context – hxxp[:]//13[.]236[.]189[.]80:8000/res/translate[.]res
- [IP:Port] context – 13.236.189.80:8000
- [File Name] context – [FINAL] Hiroshima Action Statement for Resilient Global Food Security_trackchanged.docx, c6gt.b, Downloader.dll
- [Threat Actor/Group] context – SharpPanda
- [Other] context – DLL loader named c6gt.b, RC4-encrypted payload with key xkYgv127, Base64 encoding
Read more: https://blog.cyble.com/2023/06/01/sharppanda-apt-campaign-expands-its-arsenal-targeting-g20-nations/