Illusory Wishes: China-nexus APT Targets the Tibetan Community

MITRE Techniques

• [T1106] Native API – Low level Windows native APIs like Nt* and Rtl* were used during code injection and execution to evade detection (‘The threat actors use less common Windows native APIs like Nt* and Rtl*, likely to evade detection by EDR solutions’).
• [T1204.002] User Execution: Malicious File – Victims were tricked into running trojanized software downloaded via socially engineered links (‘The victim is tricked into running the trojanized software to initiate the attack chain’).
• [T1547.001] Boot or Logon Autostart Execution: Registry Run Keys/Startup Folder – Malware established persistence through registry autorun keys and startup shortcuts (‘To achieve persistence, the malware adds a registry value under HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun and creates a shortcut in the STARTUP directory’).
• [T1574.001] Hijack Execution Flow: DLL Sideloading – DLL sideloading vulnerabilities in legitimate signed executables were exploited to load malicious DLLs (‘DLL sideloading infection chain with ffmpeg.dll and libvlc.dll malicious DLLs sideloaded by Element.exe and VLC.exe’).
• [T1055.002] Process Injection: Portable Executable Injection – Shellcode was injected into legitimate processes such as ImagingDevices.exe to execute payloads stealthily (‘The stage 1 shellcode loader injects stage 2 shellcode into ImagingDevices.exe’).
• [T1036] Masquerading – Malicious software masqueraded as legitimate or useful Tibetan community applications (‘The software downloaded by users masquerades as software useful to the Tibetan community’).
• [T1027.007] Obfuscated Files or Information: Dynamic API Resolution – APIs were dynamically resolved in loaders to hinder analysis (‘APIs are dynamically resolved in the stage 1 and 2 loaders’).
• [T1027.009] Obfuscated Files or Information: Embedded Payloads – Next-stage executables were embedded within loader binaries (‘The stage 1 and 2 loaders embed their next stages within themselves’).
• [T1027.015] Obfuscated Files or Information: Compression – Payload executables were compressed and embedded to evade detection (‘The stage 3 executables are compressed and embedded in the stage 2 shellcode’).
• [T1620] Reflective Code Loading – Decompressed executables were reflectively loaded into memory for execution (‘The stage 2 loaders use reflective code loading’).
• [T1070.001] Indicator Removal: Clear Windows Event Logs – Ghost RAT supports clearing event logs to cover tracks (‘Ghost RAT supports a command to clear the Windows Event Logs’).
• [T1056.001] Input Capture: Keylogging – Ghost RAT supports keylogging functionality (‘Ghost RAT supports keylogging’).
• [T1083] File and Directory Discovery – Ghost RAT enumerates files and directories on victims’ systems (‘Ghost RAT supports file and directory enumeration’).
• [T1057] Process Discovery – Ghost RAT supports discovery of running processes (‘Ghost RAT supports process enumeration’).
• [T1012] Query Registry – Ghost RAT supports querying and modifying registry keys (‘Ghost RAT supports querying and modifying registry keys’).
• [T1518.001] Software Discovery: Security Software Discovery – PhantomNet enumerates antivirus products via WMI (‘PhantomNet enumerates AV products via WMI’).
• [T1082] System Information Discovery – Both backdoors collect OS version and machine details (‘Ghost RAT and PhantomNet can collect system information such as OS version and machine name’).
• [T1033] System Owner/User Discovery – Ghost RAT supports user enumeration (‘Ghost RAT supports user enumeration’).
• [T1123] Audio Capture – Ghost RAT supports audio recording and playback (‘Ghost RAT supports audio capture’).
• [T1115] Clipboard Data – Ghost RAT can collect clipboard information (‘Ghost RAT supports the collection of clipboard data’).
• [T1005] Data from Local System – Ghost RAT can read files from local system storage (‘Ghost RAT can read local files’).
• [T1113] Screen Capture – Ghost RAT supports screen capture functionality (‘Ghost RAT supports screen capture’).
• [T1125] Video Capture – Ghost RAT supports webcam video capture (‘Ghost RAT supports webcam video capture’).
• [T1573.001] Encrypted Channel: Symmetric Cryptography – Encrypted C2 communication using symmetric cryptography was implemented (‘Ghost RAT uses a symmetric cryptography algorithm to encrypt C2 traffic’).
• [T1095] Non-Application Layer Protocol – Custom binary protocol over TCP was used for C2 communications (‘Ghost RAT and PhantomNet use a custom binary protocol for C2 communication over TCP’).
• [T1071.001] Application Layer Protocol: Web Protocols – PhantomNet supports HTTP and HTTPS for C2 communications (‘PhantomNet supports C2 communication over HTTP and HTTPS’).
• [T1529] System Shutdown/Reboot – Ghost RAT has a command to shutdown infected systems (‘Ghost RAT supports a command to shutdown the infected machine’).