Suspected China-Based Espionage Operation Against Military Targets in Southeast Asia

MITRE Techniques

• [T1059.001 ] PowerShell – Used to execute malicious scripts and remotely run commands across systems (‘detected suspicious PowerShell activity indicating an existing compromise.’).
• [T1047 ] Windows Management Instrumentation – Employed for remote deployment and lateral movement across endpoints (‘They used a combination of Windows Management Instrumentation (WMI) and native Windows .NET commands to deploy malware to additional endpoints’).
• [T1071.001 ] Application Layer Protocol: Web Protocols (HTTP) – C2 communications used HTTP with custom verbs for command and control and data exchange (‘custom HTTP requests as communication parameters (PUT, POT, DPF, UPF, CPF, LPF)’).
• [T1102 ] Web Service – Legitimate web services (Pastebin and Dropbox) used as dead-drop resolvers for dynamic C2 resolution (‘Both use the same Pastebin repository to resolve their respective C2 addresses’ and ‘using an attacker-controlled Dropbox account as the primary DDR source’).
• [T1543.003 ] Create or Modify System Process: Windows Service – Attackers created a new service to facilitate payload execution and persistence (‘created a new service to facilitate payload execution’).
• [T1574.001 ] Hijack Execution Flow: DLL Search Order Hijacking – DLL hijacking used by placing a malicious DLL in system32 and registering it to be loaded by a shadow copy service (‘performed DLL hijacking by placing the malicious swprv32.sys AppleChris DLL in the system32 directory’).
• [T1055.012 ] Process Injection: Process Hollowing – MemFun dropper used process hollowing to inject shellcode into a suspended legitimate process to run payloads in memory (‘launches dllhost.exe in a suspended state and decrypts an embedded shellcode payload … injected into the suspended process’).
• [T1055.001 ] Process Injection: DLL Injection / Reflective Loading – MemFun and loaders used reflective DLL loading to execute payloads in memory without dropping files to disk (‘the injected shellcode functions as a loader … performs reflective DLL loading’).
• [T1070.006 ] Indicator Removal on Host: Timestomping – The MemFun dropper adjusted file timestamps to match system files to evade forensic detection (‘retrieves the creation timestamp of the Windows System directory and sets its own file creation timestamp to match it’).
• [T1134 ] Access Token Manipulation – Token impersonation was used to steal and impersonate logged-on user credentials and inherit proxy settings to bypass restrictions (‘performs token impersonation to steal and impersonate logged-on user credentials’).
• [T1003 ] OS Credential Dumping – Credential harvesting from lsass.exe to retrieve plaintext passwords and NTLM hashes via Getpass (Mimikatz derivative) (‘attempts to extract plaintext passwords, NTLM hashes and authentication data directly from the lsass.exe process memory’).
• [T1497 ] Virtualization/Sandbox Evasion – Sleep timers and delayed execution used to outlast automated sandbox monitoring windows (‘designed to sleep for six hours (21,600 seconds)’ and ‘delayed execution through sleep timers of 30 seconds (EXE) and 120 seconds (DLL)’).
• [T1041 ] Exfiltration Over C2 Channel – Files and data exfiltrated over the established C2 channel using AppleChris commands for file upload and download (‘File upload, download and deletion’ and command symbols for download/upload operations).
• [T1090 ] Proxy – The Tunneler variant included a proxy/tunneling command to create reverse TCP tunnels for network pivoting (‘? – Proxy Tunnel: Creates a reverse TCP tunnel for network pivoting’).