Persistent Attempts at Cyberespionage Against Southeast Asian Government Target Have Links to Alloy Taurus

MITRE Techniques

• [T1190] Exploit Public-Facing Application – The attackers exploited vulnerabilities in Exchange Servers to deploy a large number of web shells. [‘…capitalized on vulnerabilities in Exchange Servers to deploy a large number of web shells….’]
• [T1059.003] Windows Command Shell – Reconnaissance commands were run from the shell, including whoami, ipconfig, dir, arp and net. [‘…running reconnaissance commands and tools (e.g., whoami, ipconfig, dir, arp and net, NBTScan)…’]
• [T1082] System Information Discovery – The intrusions included commands used to gather system information during reconnaissance. [‘…whoami, ipconfig, dir, arp and net…’]
• [T1136] Create Account – Administrative accounts were created (Admin$, Back$, infoma$, testuser) to maintain footholds. [‘…creating several administrative accounts (named Admin$, Back$, infoma$ and testuser).’]
• [T1003] OS Credential Dumping – Credential dumping activities included LSASS dumping, Mimikatz, LaZagne, SAM hive access and NTLM downgrade attempts. [‘…dumping Lsass; Mimikatz… NTLM downgrade attack…’]
• [T1047] Windows Management Instrumentation – The attackers used WMI and PowerShell in their operations. [‘…The attackers used Windows Management Instrumentation (WMI) and PowerShell…’]
• [T1021] Remote Services – Lateral movement leveraged SoftEther VPN and AnyDesk (with a default password) to reach target assets. [‘…abusing the remote administration tool AnyDesk…’]
• [T1572] Protocol Tunneling – Reverse SSH tunneling enabled direct RDP to compromised hosts via HTran and Plink. [‘…established a reverse Secure Shell (SSH) tunnel… to tunnel RDP connections…’]
• [T1218] Signed Binary Proxy Execution – LOLBAS technique using Shell32.dll to run Cobalt Strike beacons. [‘…living-off-the-land binaries and scripts (LOLBAS) method of abusing the Windows Shell Common DLL (Shell32.dll)…’]
• [T1113] Screen Capture – Quasar RAT capabilities include screen capture. [‘Capturing screenshots’]
• [T1056] Input Capture – Quasar RAT capabilities include keylogging. [‘Keylogging’]
• [T1059.001] PowerShell – PowerShell was used to download tools and execute commands. [‘…PowerShell with the following command line.’]