The slow Tick-ing time bomb: Tick APT group compromise of a DLP software developer in East Asia

MITRE Techniques

• [T1195.002] Supply Chain Compromise – Compromise update servers delivering malicious updates. ‘The attackers compromised update servers, which delivered malicious updates on two occasions to machines inside the network.’
• [T1199] Trusted Relationship – Trojanized installers used by the company to compromise customers. ‘The attackers trojanized installers of legitimate tools used by the company, which eventually resulted in the execution of malware on the computers of the company’s customers.’
• [T1059.005] Command and Scripting Interpreter: Visual Basic – ReVBShell VBScript backdoor variant used by attackers. ‘The backdoor is written in VBScript and the controller code is written in Python.’
• [T1059.006] Command and Scripting Interpreter: Python – ShadowPy downloader uses Python for its operations. ‘ShadowPy is a downloader developed in Python…’
• [T1547.001] Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder – Loaders persist via Run keys. ‘Netboy and ShadowPy loaders persist via a Run key.’
• [T1543.003] Create or Modify System Process: Windows Service – Loaders persist by creating a Windows service. ‘persist by creating a service.’
• [T1574.002] Hijack Execution Flow: DLL Side-Loading – ShadowPy and Netboy loaders use DLL side-loading (vssapi.dll via avshadow.exe). ‘vssapi.dll being side-loaded by avshadow.exe.’
• [T1036.004] Masquerading: Masquerade Task or Service – Loaders use legitimate service/description names. ‘loaders use legitimate service and description names when creating services.’
• [T1027] Obfuscated Files or Information – Payloads and configuration are encrypted/obfuscated; overlays contain components. ‘encrypted in its overlay, three major components: the py2exe custom loader, the Python engine and the PYC code.’
• [T1055.002] Process Injection: Portable Executable Injection – Loaders inject into svchost.exe. ‘injects a payload into a designated process (svchost.exe).’
• [T1080] Taint Shared Content – Replaced legitimate applications used by technical support, enabling malware execution within the network. ‘Tick replaced legitimate applications used by technical support…’
• [T1039] Data from Network Shared Drive – Netboy and ReVBShell collect data from network shares. ‘Data from Network Shared Drive’
• [T1113] Screen Capture – Netboy can capture the screen. ‘Screen Capture’
• [T1071.001] Web Protocols – HTTP C2 communications for ShadowPy and ReVBShell. ‘communication via HTTP protocol with their C&C server.’
• [T1132.001] Data Encoding: Standard Encoding – Base64 encoding used in communications. ‘base64 to encode communication with their C&C servers.’
• [T1573] Encrypted Channel – RC4 (Netboy) and AES (ShadowPy) used for encryption. ‘Netboy uses RC4. ShadowPy uses AES.’
• [T1041] Exfiltration Over C2 Channel – Netboy and ReVBShell exfiltrate data over the C2 channel.
• [T1567.002] Exfiltration Over Web Service: Exfiltration to Cloud Storage – Exfiltration via a web service. ‘Exfiltration to cloud storage.’