Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government

MITRE Techniques

• [T1100] Web Shell – The attackers gained access by installing web shells on a compromised web server. Quote: “The threat actor behind CL-STA-0046 gained access to the environment after installing several web shells on a compromised web server.”
• [T1021.002] SMB/Windows Admin Shares – Lateral movement via SMB after initial access. Quote: “The attackers conducted additional activities using the web shells. They moved laterally via SMB and downloaded additional tools.”
• [T1082] System Information Discovery – Basic host discovery using commands like ipconfig and whoami. Quote: “Initially, the attackers performed basic reconnaissance commands such as ipconfig and whoami.”
• [T1046] Network Service Scanning – Information gathering with netscan and nbtscan. Quote: “Later, they used netscan and nbtscan to gather further information about the victim.”
• [T1059.003] Windows Command Shell – Command execution using a shell-like tool (demo.exe). Quote: “the attackers started to deliver tools to the compromised server. The attackers used a “shell-like” tool named demo.exe to run additional commands.”
• [T1105] Ingress Tool Transfer – Downloading multiple tools to establish footholds. Quote: “The attackers downloaded several different tools.”
• [T1090] Proxy – Use of web server as a proxy to reach other network systems (SessionManager and OwlProxy both provide proxy capabilities). Quote: “This threat also allows attackers to use the web server as a proxy to communicate with additional systems on the network.”
• [T1071.001] Web Protocols – Cobalt Strike beacon communicating with C2 (HTTP/Web protocols). Quote: “The attackers attempted to execute Artifactd.exe, as shown in Figure 2 above, which is a Cobalt Strike beacon configured to communicate with the command and control (C2) 27.124.26[.]83.”
• [T1572] Protocol Tunneling – EarthWorm used to tunnel C2 traffic to external servers. Quote: “EarthWorm is a publicly available SOCKS tunneler… Using EarthWorm, the attackers sent and received data to and from their C2 server.”
• [T1068] Exploitation for Privilege Escalation – SpoolFool PoC used for privilege escalation (CVE-2022-21999). Quote: “The attackers used this tool to attempt to create a local administrator user (username admin with the default password Passw0rd!).”