Twisted Panda: Chinese APT espionage operation against Russian state-owned defense institutes – Check Point Research

MITRE Techniques

• [T1566.001] Spearphishing Attachment – Malicious emails with attached documents and links to attacker-controlled sites were used to deliver the loader. “On March 23, malicious emails were sent to several defense research institutes based in Russia. The emails … contained a link to an attacker-controlled site mimicking the Health Ministry of Russia minzdravros[.]com and had a malicious document attached.”
• [T1059.005] Command and Scripting Interpreter: Visual Basic for Applications – External templates contained macro code that imports API functions from kernel32 and used them to write and load components. “The external template contains a macro code that imports several API functions from kernel32 (LoadLibraryA, CreateFileA, WriteFile, ReadFile, etc) and uses them to… “
• [T1574.002] Hijack Execution Flow: DLL Side-Loading – The loader uses DLL sideloading via a legitimate process (cmdl32.exe) and loads cmpbk32.dll/cmpbk64.dll to execute its R1 function. “Load cmpbk32.dll or cmpbk64.dll (depending on the system OS architecture) and execute its exported function R1.”
• [T1055] Process Injection – The SPINNER payload injects into a process path and runs loaded code; later stages involve injection to msiexec.exe. “The injected code begins by dynamically loading a PE file embedded inside and executing it from its entry point.”
• [T1218] Signed Binary Proxy Execution – DLL sideloading by a legitimate, Microsoft-signed process helps evade AV. “DLL sideloading by a legitimate process is a technique commonly used by threat actors; coupling it with a robust loading process can help evade modern anti-virus solutions as, in this case, the actual running process is valid and signed by Microsoft.”
• [T1547.001] Boot or Logon Autostart: Registry Run Keys/Startup Folder – The backdoor creates a Run key for persistence. “it creates a new registry key OfficeInit under SOFTWAREMicrosoftWindowsCurrentVersionRun that points to the cmdl32.exe path.”
• [T1053.005] Scheduled Task – The loader/Decoy chain creates a scheduled task for persistence. “When the malicious document is closed, a PROCESS_DETACH event … and creates a scheduled task for persistence.”
• [T1132] Data Encoding: RC4/XOR – The backdoor encrypts packets with a random RC4 key and XOR decrypts configuration data. “The backdoor generates a random 8-byte RC4 key that is used to encrypt the entire packet” and “The decrypted blob is a position-independent code …”
• [T1071.001] Web Protocols – C2 communication over HTTP/S. “The packet is sent through the HTTP/S depending on the URL retrieved from the malware configuration.”
• [T1082] System Information Discovery – SPINNER collects system information for exfiltration. “creates a string containing Bot ID, Computer name, Local IP, Windows version, Username, Sleep time…, Process ID”
• [T1041] Exfiltration – The backdoor exfiltrates files and manipulates local data as part of its capabilities. “Exfiltrates files from the infected machine and manipulates the local files.”
• [T1027] Obfuscated/Compressed Files and Information – The payload uses compiler-level obfuscations (control flow flattening and opaque predicates) to hinder analysis. “The payload uses two compiler-level obfuscations: Control flow flattening… Opaque predicates.”
• [T1059.003] Command and Scripting Interpreter: Windows Command Shell – The backdoor runs commands via cmd.exe as part of its operational commands. “Run command using cmd.exe”
• [T1005] Ingress Tool Transfer – Self-update and payload delivery logic includes writing to INIT and creating new loader instances. “Self-update – Write data to the INIT file and create another instance of the cmdl32.exe using CreateProcessW.”
• [T1070] Indicator Removal on Host – Self-delete/cleanup actions and persistence cleanup. “Self-delete and exit process (create and run a file named a.bat… Also, delete persistence from the Run Registry Key.)”
• [T1016] System Network Configuration Discovery – Basic host discovery through gathering local IPs and network info as part of the info packet.
• [T1059.007] Windows Command Shell: PowerShell (indirect) – Variants mention shells and command execution pathways that align with shell-based control flow in multiple components.