Article Content What happened? In March 2018 we detected an ongoing campaign targeting a national data center in the Central Asia that we believe has been active since autumn 2017 The choice of target made this campaign especially significant – it meant the attackers gained access to a wide range of government resources at one fell swoop The operators used the HyperBro Trojan as their last-stage in-memory remote administration tool (RAT) The timestamps for these modules are from December 2017 until January 2018 The anti-detection launcher and decompressor make extensive use of Metasploit’s shikata_ga_nai encoder as well as LZNT1 compression Kaspersky Lab products detect the different artifacts used in this campaign with the following verdicts: Trojan.Win32.Generic, Trojan-Downloader.Win32.Upatre and Backdoor.Win32.HyperBro A full technical report, IoCs and YARA rules are available from our intelligence reporting service (contact us intelligence@kaspersky.com) Who’s behind it? Due to tools and tactics in use we attribute the campaign to LuckyMouse Chinese-speaking actor (also known as EmissaryPanda and APT27) Also the C2 domain update.iaacstudio[.]com was previously used in their campaigns The tools found in this campaign, such as the HyperBro Trojan, are regularly used by a variety of Chinese-speaking actors Regarding Metasploit’s shikata_ga_nai encoder – although it’s available for everyone and couldn’t be the basis for attribution, we know this encoder has been used by LuckyMouse previously Government entities, including the Central Asian ones also were a target for this actor before Due to LuckyMouse’s ongoing waterholing of government websites and the corresponding dates, we suspect that one of the aims of this campaign is to access web pages via the data center and inject JavaScripts into them How did the malware spread? The initial infection vector used in the attack against the data center is unclear It’s possible the actor used a waterhole to infect data center employees The main C2 used in this campaign is bbs.sonypsps[.]com, which resolved to IP-address, that belongs to the Ukrainian ISP network, held by a Mikrotik router using firmware version 6.34.4 (from March 2016) with SMBv1 on board We suspect this router was hacked as part of the campaign in order to process the malware’s HTTP requests The Sonypsps[.]com domain was last updated using GoDaddy on 2017-05-05 until 2019-03-13 FMikrotik router with two-year-old firmware and SMBv1 on board used in this campaign In March 2017, Wikileaks published details about an exploit affecting Mikrotik called ChimayRed According to the documentation, however, it doesn’t work for firmware versions higher than 6.30 This router uses version 6.34 There were traces of HyperBro in the infected data center from mid-November 2017 Shortly after that different users in the country started being redirected to the malicious domain update.iaacstudio[.]com as a result of the waterholing of government websites These events suggest that the data center infected with HyperBro and the waterholing campaign are connected What did the malware do in the data center? Anti-detection stages The resulting deobfuscated code performs typical side loading: it patches pcAnywhere’s image in memory at its entry point The patched code jumps back to the decryptor’s second shikata_ga_nai iteration, but this time as part of the whitelisted application This Metasploit’s encoder obfuscates the last part of the launcher’s code, which in turn resolves the necessary API and maps thumb.db into the same process’s (pcAnywhere) memory The first instructions in the mapped thumb.db are for a new shikata_ga_nai iteration Conclusions LuckyMouse appears to have been very active recently The TTPs for this campaign are quite common for Chinese-speaking actors, where they typically provide new solid wrappers (launcher and decompressor protected with shikata_ga_nai in this case) around their RATs (HyperBro) The most unusual and interesting point here is the target A national data center is a valuable source of data that can also be abused to compromise official websites Another interesting point is the Mikrotik router, which we believe was hacked specifically for the campaign The reasons for this are not very clear: typically, Chinese-speaking actors don’t bother disguising their campaigns Maybe these are the first steps in a new stealthier approach Some indicators of compromise Droppers 22CBE2B0F1EF3F2B18B4C5AED6D7BB79 0D0320878946A73749111E6C94BF1525 Launcher ac337bd5f6f18b8fe009e45d65a2b09b HyperBro in-memory Trojan 04dece2662f648f619d9c0377a7ba7c0 Domains and IPs bbs.sonypsps[.]com update.iaacstudio[.]com wh0am1.itbaydns[.]com google-updata[.]tk windows-updata[.]tk
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content What happened? In March 2018 we detected an ongoing campaign targeting a national data center in the Central Asia that we believe has been active since autumn 2017 The choice of target made this campaign especially significant – it meant the attackers gained access to a wide range of government resources at one fell swoop The operators used the HyperBro Trojan as their last-stage in-memory remote administration tool (RAT) The timestamps for these modules are from December 2017 until January 2018 The anti-detection launcher and decompressor make extensive use of Metasploit’s shikata_ga_nai encoder as well as LZNT1 compression Kaspersky Lab products detect the different artifacts used in this campaign with the following verdicts: Trojan.Win32.Generic, Trojan-Downloader.Win32.Upatre and Backdoor.Win32.HyperBro A full technical report, IoCs and YARA rules are available from our intelligence reporting service (contact us intelligence@kaspersky.com) Who’s behind it? Due to tools and tactics in use we attribute the campaign to LuckyMouse Chinese-speaking actor (also known as EmissaryPanda and APT27) Also the C2 domain update.iaacstudio[.]com was previously used in their campaigns The tools found in this campaign, such as the HyperBro Trojan, are regularly used by a variety of Chinese-speaking actors Regarding Metasploit’s shikata_ga_nai encoder – although it’s available for everyone and couldn’t be the basis for attribution, we know this encoder has been used by LuckyMouse previously Government entities, including the Central Asian ones also were a target for this actor before Due to LuckyMouse’s ongoing waterholing of government websites and the corresponding dates, we suspect that one of the aims of this campaign is to access web pages via the data center and inject JavaScripts into them How did the malware spread? The initial infection vector used in the attack against the data center is unclear It’s possible the actor used a waterhole to infect data center employees The main C2 used in this campaign is bbs.sonypsps[.]com, which resolved to IP-address, that belongs to the Ukrainian ISP network, held by a Mikrotik router using firmware version 6.34.4 (from March 2016) with SMBv1 on board We suspect this router was hacked as part of the campaign in order to process the malware’s HTTP requests The Sonypsps[.]com domain was last updated using GoDaddy on 2017-05-05 until 2019-03-13 FMikrotik router with two-year-old firmware and SMBv1 on board used in this campaign In March 2017, Wikileaks published details about an exploit affecting Mikrotik called ChimayRed According to the documentation, however, it doesn’t work for firmware versions higher than 6.30 This router uses version 6.34 There were traces of HyperBro in the infected data center from mid-November 2017 Shortly after that different users in the country started being redirected to the malicious domain update.iaacstudio[.]com as a result of the waterholing of government websites These events suggest that the data center infected with HyperBro and the waterholing campaign are connected What did the malware do in the data center? Anti-detection stages The resulting deobfuscated code performs typical side loading: it patches pcAnywhere’s image in memory at its entry point The patched code jumps back to the decryptor’s second shikata_ga_nai iteration, but this time as part of the whitelisted application This Metasploit’s encoder obfuscates the last part of the launcher’s code, which in turn resolves the necessary API and maps thumb.db into the same process’s (pcAnywhere) memory The first instructions in the mapped thumb.db are for a new shikata_ga_nai iteration Conclusions LuckyMouse appears to have been very active recently The TTPs for this campaign are quite common for Chinese-speaking actors, where they typically provide new solid wrappers (launcher and decompressor protected with shikata_ga_nai in this case) around their RATs (HyperBro) The most unusual and interesting point here is the target A national data center is a valuable source of data that can also be abused to compromise official websites Another interesting point is the Mikrotik router, which we believe was hacked specifically for the campaign The reasons for this are not very clear: typically, Chinese-speaking actors don’t bother disguising their campaigns Maybe these are the first steps in a new stealthier approach Some indicators of compromise Droppers 22CBE2B0F1EF3F2B18B4C5AED6D7BB79 0D0320878946A73749111E6C94BF1525 Launcher ac337bd5f6f18b8fe009e45d65a2b09b HyperBro in-memory Trojan 04dece2662f648f619d9c0377a7ba7c0 Domains and IPs bbs.sonypsps[.]com update.iaacstudio[.]com wh0am1.itbaydns[.]com google-updata[.]tk windows-updata[.]tk ### Response: .