Article Content FireEye Threat Intelligence analysts identified a spear phishing campaign carried out in August 2015 targeting Hong Kong-based media organizations A China-based cyber threat group, which FireEye tracks as an uncategorized advanced persistent threat (APT) group and other researchers refer to as “admin@338,” may have conducted the activity.[1] The email messages contained malicious documents with a malware payload called LOWBALL We collaborated with Dropbox to investigate the threat, and our cooperation revealed what may be a second, similar operation The threat group’s latest activity coincided with the announcement of criminal charges against democracy activists.[6] During the past 12 months, Chinese authorities have faced several challenges, including large-scale protests in Hong Kong in late 2014, the precipitous decline in the stock market in mid-2015, and the massive industrial explosion in Tianjin in August 2015 In Hong Kong, the pro-democracy movement persists, and the government recently denied a professor a post because of his links to a pro-democracy leader.[7] Multiple China-based cyber threat groups have targeted international media organizations in the past The targeting has often focused on Hong Kong-based media, particularly those that publish pro-democracy material The media organizations targeted with the threat group’s well-crafted Chinese language lure documents are precisely those whose networks Beijing would seek to monitor The first email references the creation of a Christian civil society organization to coincide with the anniversary of the 2014 protests in Hong Kong known as the Umbrella Movement This campaign, however, is clearly designed for those who read the traditional Chinese script commonly used in Hong Kong The communication occurs via HTTPS over port 443 However, this is most likely meant to be a mechanism to update the compromised host with a new version of the LOWBALL malware The threat group monitors its Dropbox account for responses from compromised computers Once the LOWBALL malware calls back to the Dropbox account, the attackers will create a file called “[COMPUTER_NAME]_upload.bat” which contains commands to be executed on the compromised computer This batch file is then executed on the target computer, with the results uploaded to the attackers’ Dropbox account in a file named “[COMPUTER_NAME]_download” We observed the threat group upload a second stage malware, known as BUBBLEWRAP (also known as Backdoor.APT.FakeWinHTTPHelper) to their Dropbox account along with the following command:  @echo off    ren "%temp%\upload" audiodg.exe    start %temp%\audiodg.exe    dir d:\ >> %temp%\download    systeminfo >> %temp%\download    del %0     We have previously observed the admin@338 group use BUBBLEWRAP A Second Operation FireEye works closely with security researchers and industry partners to mitigate cyber threats, and we collaborated with Dropbox to respond to this activity The Dropbox security team was able to identify this abuse and put countermeasures in place Our cooperation uncovered what appears to be a second, ongoing operation, though we lack sufficient evidence to verify if admin@338 is behind it The attack lifecycle followed the same pattern, though some of the filenames were different, which indicates that there may be multiple versions of the malware In addition, while the operation targeting Hong Kong-based media involved a smaller number of targets and a limited duration, we suspect this second operation involves up to 50 targets At this time, we are unable to identify the victims LOWBALL is an example of malware that abuses cloud storage services to mask its activity from network defenders The LOWBALL first stage malware allows the group to collect information from victims and then deliver the BUBBLEWRAP second stage malware to their victims after verifying that they are indeed interesting targets A version of this article appeared first on the FireEye Intelligence Center The FireEye Intelligence Center provides access to strategic intelligence, analysis tools, intelligence sharing capabilities, and institutional knowledge based on over 10 years of FireEye and Mandiant experience detecting, responding to and tracking advanced threats FireEye uses a proprietary intelligence database, along with the expertise of our Threat Intelligence Analysts, to power the Intelligence Center [1] FireEye currently tracks this activity as an “uncategorized” group, a cluster of related threat activity about which we lack information to classify with an advanced persistent threat number [2] FireEye Hiding in Plain Sight: FireEye and Microsoft Expose Obfuscation Tactic https://www2.fireeye.com/rs/fireye/images/APT17_Report.pdf [3] FireEye HAMMERTOSS: Stealthy Tactics Define a Russian Cyber Threat Group [4] Moran, Ned and Alex Lanstein FireEye “Spear Phishing the News Cycle: APT Actors Leverage Interest in the Disappearance of Malaysian Flight MH 370.” 25 March 2014 https://www.fireeye.com/blog/threat-research/2014/03/spear-phishing-the-news-cycle-apt-actors-leverage-interest-in-the-disappearance-of-malaysian-flight-mh-370.html [5] Moran, Ned and Thoufique Haq “Know Your Enemy: Tracking a Rapidly Evolving APT Actor.” 31 October 2013 Poison Ivy: Assessing Damage and Extracting Intelligence [6] BBC News “Hong Kong student leaders charged over Umbrella Movement.’” 27 August 2015 http://www.bbc.com/news/world-asia-china-34070695 [7] Zhao, Shirley, Joyce Ng, and Gloria Chan “University of Hong Kong’s council votes 12-8 to reject Johannes Chan’s appointment as pro-vice-chancellor.” 30 September 2015 http://www.scmp.com/news/hong-kong/education-community/article/1862423/surprise-move-chair-university-hong-kong [8] Wong, Alan Pro-Democracy Media Company’s Websites Attacked.  “Pro-Democracy Media Company’s Websites Attacked.” New York Times 18 June 2014 http://sinosphere.blogs.nytimes.com/2014/06/18/pro-democracy-media-companys-websites-attacked/ 31 August 2015 http://www.ejinsight.com/20150831-hku-concern-group-raises-proxy-fears-in-key-vote/ 
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content FireEye Threat Intelligence analysts identified a spear phishing campaign carried out in August 2015 targeting Hong Kong-based media organizations A China-based cyber threat group, which FireEye tracks as an uncategorized advanced persistent threat (APT) group and other researchers refer to as “admin@338,” may have conducted the activity.[1] The email messages contained malicious documents with a malware payload called LOWBALL We collaborated with Dropbox to investigate the threat, and our cooperation revealed what may be a second, similar operation The threat group’s latest activity coincided with the announcement of criminal charges against democracy activists.[6] During the past 12 months, Chinese authorities have faced several challenges, including large-scale protests in Hong Kong in late 2014, the precipitous decline in the stock market in mid-2015, and the massive industrial explosion in Tianjin in August 2015 In Hong Kong, the pro-democracy movement persists, and the government recently denied a professor a post because of his links to a pro-democracy leader.[7] Multiple China-based cyber threat groups have targeted international media organizations in the past The targeting has often focused on Hong Kong-based media, particularly those that publish pro-democracy material The media organizations targeted with the threat group’s well-crafted Chinese language lure documents are precisely those whose networks Beijing would seek to monitor The first email references the creation of a Christian civil society organization to coincide with the anniversary of the 2014 protests in Hong Kong known as the Umbrella Movement This campaign, however, is clearly designed for those who read the traditional Chinese script commonly used in Hong Kong The communication occurs via HTTPS over port 443 However, this is most likely meant to be a mechanism to update the compromised host with a new version of the LOWBALL malware The threat group monitors its Dropbox account for responses from compromised computers Once the LOWBALL malware calls back to the Dropbox account, the attackers will create a file called “[COMPUTER_NAME]_upload.bat” which contains commands to be executed on the compromised computer This batch file is then executed on the target computer, with the results uploaded to the attackers’ Dropbox account in a file named “[COMPUTER_NAME]_download” We observed the threat group upload a second stage malware, known as BUBBLEWRAP (also known as Backdoor.APT.FakeWinHTTPHelper) to their Dropbox account along with the following command:  @echo off    ren "%temp%\upload" audiodg.exe    start %temp%\audiodg.exe    dir d:\ >> %temp%\download    systeminfo >> %temp%\download    del %0     We have previously observed the admin@338 group use BUBBLEWRAP A Second Operation FireEye works closely with security researchers and industry partners to mitigate cyber threats, and we collaborated with Dropbox to respond to this activity The Dropbox security team was able to identify this abuse and put countermeasures in place Our cooperation uncovered what appears to be a second, ongoing operation, though we lack sufficient evidence to verify if admin@338 is behind it The attack lifecycle followed the same pattern, though some of the filenames were different, which indicates that there may be multiple versions of the malware In addition, while the operation targeting Hong Kong-based media involved a smaller number of targets and a limited duration, we suspect this second operation involves up to 50 targets At this time, we are unable to identify the victims LOWBALL is an example of malware that abuses cloud storage services to mask its activity from network defenders The LOWBALL first stage malware allows the group to collect information from victims and then deliver the BUBBLEWRAP second stage malware to their victims after verifying that they are indeed interesting targets A version of this article appeared first on the FireEye Intelligence Center The FireEye Intelligence Center provides access to strategic intelligence, analysis tools, intelligence sharing capabilities, and institutional knowledge based on over 10 years of FireEye and Mandiant experience detecting, responding to and tracking advanced threats FireEye uses a proprietary intelligence database, along with the expertise of our Threat Intelligence Analysts, to power the Intelligence Center [1] FireEye currently tracks this activity as an “uncategorized” group, a cluster of related threat activity about which we lack information to classify with an advanced persistent threat number [2] FireEye Hiding in Plain Sight: FireEye and Microsoft Expose Obfuscation Tactic https://www2.fireeye.com/rs/fireye/images/APT17_Report.pdf [3] FireEye HAMMERTOSS: Stealthy Tactics Define a Russian Cyber Threat Group [4] Moran, Ned and Alex Lanstein FireEye “Spear Phishing the News Cycle: APT Actors Leverage Interest in the Disappearance of Malaysian Flight MH 370.” 25 March 2014 https://www.fireeye.com/blog/threat-research/2014/03/spear-phishing-the-news-cycle-apt-actors-leverage-interest-in-the-disappearance-of-malaysian-flight-mh-370.html [5] Moran, Ned and Thoufique Haq “Know Your Enemy: Tracking a Rapidly Evolving APT Actor.” 31 October 2013 Poison Ivy: Assessing Damage and Extracting Intelligence [6] BBC News “Hong Kong student leaders charged over Umbrella Movement.’” 27 August 2015 http://www.bbc.com/news/world-asia-china-34070695 [7] Zhao, Shirley, Joyce Ng, and Gloria Chan “University of Hong Kong’s council votes 12-8 to reject Johannes Chan’s appointment as pro-vice-chancellor.” 30 September 2015 http://www.scmp.com/news/hong-kong/education-community/article/1862423/surprise-move-chair-university-hong-kong [8] Wong, Alan Pro-Democracy Media Company’s Websites Attacked.  “Pro-Democracy Media Company’s Websites Attacked.” New York Times 18 June 2014 http://sinosphere.blogs.nytimes.com/2014/06/18/pro-democracy-media-companys-websites-attacked/ 31 August 2015 http://www.ejinsight.com/20150831-hku-concern-group-raises-proxy-fears-in-key-vote/  ### Response: .