Article Content This post was written with contributions from Jessica Saavedra-Morales, Thomas Roccia, and Asheer Malhotra.  McAfee Advanced Threat Research analysts have discovered a new operation targeting humanitarian aid organizations and using North Korean political topics as bait to lure victims into opening malicious Microsoft Word documents Our analysts have named this Operation Honeybee, based on the names of the malicious documents used in the attacks Advanced Threat Research analysts have also discovered malicious documents authored by the same actor that indicate a tactical shift These documents do not contain the typical lures by this actor, instead using Word compatibility messages to entice victims into opening them The Advanced Threat Research team also observed a heavy concentration of the implant in Vietnam from January 15–17 Background  On January 15, Advanced Threat Research discovered an operation using a new variant of the SYSCON backdoor The Korean-language Word document manual.doc appeared in Vietnam on January 17, with the original author name of Honeybee Document properties This malicious document contains a Visual Basic macro that dropped and executed an upgraded version of the implant known as SYSCON, which appeared in 2017 in malicious Word documents as part of several campaigns using North Korea–related topics The malicious Visual Basic script uses a unique key (custom alphabet) to encode data We have seen this in previous operations using SYSCON This key was also used in the Honeybee campaign and appears to have been used since August 2017 Examples of decoy documents Several additional documents surfaced between January 17 and February 3 All contain the same Visual Basic macro code and author name as Honeybee Some of the malicious documents were test files without the implant From our analysis, most these documents were submitted from South Korea, indicating that some of the targeting was in South Korea We also observed a related malicious document created January 12 by the author Windows User that contained a different encoding key, but essentially used the same macro and same type of implant as we saw with the recent Honeybee documents This document, “International Federation of Red Cross and Red Crescent Societies – DPRK Country Office,” drops an implant with the control server address 1113427185.ifastnet.org, which resolves to the same server used by the implants dropped in the Honeybee case The directory contents of control server 1113427185.ifastnet.org The directory contents of ftp.byethost11.com, from Honeybee samples Log files of compromised machines from February 2018 Honeybee samples MaoCheng Dropper Aside from finding the malicious documents, the Advanced Threat Research team discovered a Win32-based executable dropper This dropper uses a stolen digital signature from Adobe Systems This certificate is also used by another Korean-language malware compiled January 16 (hash: 35904f482d37f5ce6034d6042bae207418e450f4) with an interesting program database (PDB) path D:\Task\DDE Attack\MaoCheng\Release\Dropper.pdb The malware is a Win32 executable that pretends to be a Word document based on its icon This is a dropper for the same type of malware as observed with the other Word documents This sample also dropped a decoy document with the author name Honeybee This sample, however, contained a bug that interfered with the execution flow of the dropper, suggesting that the authors did not test the malware after code signing it The decoy document uses the cloud-based accounting software company Xero as a lure:  A decoy document from MaoCheng dropper Possible Operator  The Advanced Threat Research team has identified the following persona (snoopykiller@mail.ru) tied to this recent operation Based on our analysis, the actor registered two free hosting accounts: navermail.byethost3.com, which refers to the popular South Korean search engine, and nihon.byethost11.com The email address was used to register a free account for a control server in all the implants described in our analysis.  Technical Analysis Let’s start with an overview of the attack:  We continue with the components involved in this operation The malicious Word file is the beginning of the infection chain and acts as a dropper for two DLL files The Word file contains malicious Visual Basic macro code that runs when the document is opened in Word using the Document_Open() autoload function The word file also contains a Base64-encoded file (encoded with a custom key) in it that is read, decoded, and dropped to the disk by the macro The Document_Open() subroutine implementing the malicious functionality Decoding and writing the CAB file to %temp% The decoded CAB file in the Visual Basic memory buffer The DLL contains the following PDB path: D:\Task\MiMul\NTWDBLIB\Release\NTWDBLIB.pdb Credentials are encoded in the .ini file Decoded credential data contained in ipnet.ini.   dll: The malicious DLL file run as a service (using svchost.exe) The DLL contains the following PDB path: D:\Task\MiMul\FTPCom_vs10\Release\Engine.pdb Immediately restart the service Remove the batch files to reduce the fingerprint on the system   IPNet.dll runs as a service under svchost.exe This document was created January 10 Contents of the decoy document This variant also consists of two CAB files that are dropped to %temp%, depending on the OS (x86 or x64) Ipnet.dll may also be either 64-bit or 32-bit Similarities between this variant and the original malware sample:  Service name is the same: COMSysApp The DLL and ini files contain the same functions as described elsewhere in this post  Data Reconnaissance The following information is gathered from the endpoint and sent to the control server Writes new config info (control server connection info) to new ipnet.ini cmd /c put <new_file_name> <existing_file_name>: Copies existing file to new file name Furthermore, based on the various metadata in both documents and executables, the actor is likely a Korean speaker The techniques used in the malicious documents such as the lure messages closely resemble what we have observed before in South Korea The attacker appears to target those involved in humanitarian aid and inter-Korean affairs We have seen this operation expand beyond the borders of South Korea to target Vietnam, Singapore, Argentina, Japan, Indonesia, and Canada Some new droppers have not been observed before in the wild The MaoCheng dropper was apparently created specifically for this operation and appeared only twice in the wild
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content This post was written with contributions from Jessica Saavedra-Morales, Thomas Roccia, and Asheer Malhotra.  McAfee Advanced Threat Research analysts have discovered a new operation targeting humanitarian aid organizations and using North Korean political topics as bait to lure victims into opening malicious Microsoft Word documents Our analysts have named this Operation Honeybee, based on the names of the malicious documents used in the attacks Advanced Threat Research analysts have also discovered malicious documents authored by the same actor that indicate a tactical shift These documents do not contain the typical lures by this actor, instead using Word compatibility messages to entice victims into opening them The Advanced Threat Research team also observed a heavy concentration of the implant in Vietnam from January 15–17 Background  On January 15, Advanced Threat Research discovered an operation using a new variant of the SYSCON backdoor The Korean-language Word document manual.doc appeared in Vietnam on January 17, with the original author name of Honeybee Document properties This malicious document contains a Visual Basic macro that dropped and executed an upgraded version of the implant known as SYSCON, which appeared in 2017 in malicious Word documents as part of several campaigns using North Korea–related topics The malicious Visual Basic script uses a unique key (custom alphabet) to encode data We have seen this in previous operations using SYSCON This key was also used in the Honeybee campaign and appears to have been used since August 2017 Examples of decoy documents Several additional documents surfaced between January 17 and February 3 All contain the same Visual Basic macro code and author name as Honeybee Some of the malicious documents were test files without the implant From our analysis, most these documents were submitted from South Korea, indicating that some of the targeting was in South Korea We also observed a related malicious document created January 12 by the author Windows User that contained a different encoding key, but essentially used the same macro and same type of implant as we saw with the recent Honeybee documents This document, “International Federation of Red Cross and Red Crescent Societies – DPRK Country Office,” drops an implant with the control server address 1113427185.ifastnet.org, which resolves to the same server used by the implants dropped in the Honeybee case The directory contents of control server 1113427185.ifastnet.org The directory contents of ftp.byethost11.com, from Honeybee samples Log files of compromised machines from February 2018 Honeybee samples MaoCheng Dropper Aside from finding the malicious documents, the Advanced Threat Research team discovered a Win32-based executable dropper This dropper uses a stolen digital signature from Adobe Systems This certificate is also used by another Korean-language malware compiled January 16 (hash: 35904f482d37f5ce6034d6042bae207418e450f4) with an interesting program database (PDB) path D:\Task\DDE Attack\MaoCheng\Release\Dropper.pdb The malware is a Win32 executable that pretends to be a Word document based on its icon This is a dropper for the same type of malware as observed with the other Word documents This sample also dropped a decoy document with the author name Honeybee This sample, however, contained a bug that interfered with the execution flow of the dropper, suggesting that the authors did not test the malware after code signing it The decoy document uses the cloud-based accounting software company Xero as a lure:  A decoy document from MaoCheng dropper Possible Operator  The Advanced Threat Research team has identified the following persona (snoopykiller@mail.ru) tied to this recent operation Based on our analysis, the actor registered two free hosting accounts: navermail.byethost3.com, which refers to the popular South Korean search engine, and nihon.byethost11.com The email address was used to register a free account for a control server in all the implants described in our analysis.  Technical Analysis Let’s start with an overview of the attack:  We continue with the components involved in this operation The malicious Word file is the beginning of the infection chain and acts as a dropper for two DLL files The Word file contains malicious Visual Basic macro code that runs when the document is opened in Word using the Document_Open() autoload function The word file also contains a Base64-encoded file (encoded with a custom key) in it that is read, decoded, and dropped to the disk by the macro The Document_Open() subroutine implementing the malicious functionality Decoding and writing the CAB file to %temp% The decoded CAB file in the Visual Basic memory buffer The DLL contains the following PDB path: D:\Task\MiMul\NTWDBLIB\Release\NTWDBLIB.pdb Credentials are encoded in the .ini file Decoded credential data contained in ipnet.ini.   dll: The malicious DLL file run as a service (using svchost.exe) The DLL contains the following PDB path: D:\Task\MiMul\FTPCom_vs10\Release\Engine.pdb Immediately restart the service Remove the batch files to reduce the fingerprint on the system   IPNet.dll runs as a service under svchost.exe This document was created January 10 Contents of the decoy document This variant also consists of two CAB files that are dropped to %temp%, depending on the OS (x86 or x64) Ipnet.dll may also be either 64-bit or 32-bit Similarities between this variant and the original malware sample:  Service name is the same: COMSysApp The DLL and ini files contain the same functions as described elsewhere in this post  Data Reconnaissance The following information is gathered from the endpoint and sent to the control server Writes new config info (control server connection info) to new ipnet.ini cmd /c put <new_file_name> <existing_file_name>: Copies existing file to new file name Furthermore, based on the various metadata in both documents and executables, the actor is likely a Korean speaker The techniques used in the malicious documents such as the lure messages closely resemble what we have observed before in South Korea The attacker appears to target those involved in humanitarian aid and inter-Korean affairs We have seen this operation expand beyond the borders of South Korea to target Vietnam, Singapore, Argentina, Japan, Indonesia, and Canada Some new droppers have not been observed before in the wild The MaoCheng dropper was apparently created specifically for this operation and appeared only twice in the wild ### Response: .