Nation-State actors from China are attacking financial institutions in Taiwan. The attackers used stealthy techniques to evade detection in a campaign that lasted 18 months. The attackers leveraged EternalBlue exploits and also deployed a backdoor called xPack that allowed them to run WMI commands on the affected systems remotely.
Like most APTs, the campaign was used to exfiltrate data and cyber espionage. At least three organizations were targeted by this attacker in Taiwan. Which includes two financial organizations and a manufacturing company. Interestingly, the threat actors were able to infiltrate the financial and manufacturing organization for 250 and 175 days respectively.
Symantec, a division of Broadcom, cannot state with certainty what the initial infection vector used by the attackers in this campaign was, though in one instance they were seen utilizing the MSSQL service to execute system commands, which indicates that the most likely infection vector was exploitation of a web application or service.
Antlion APT is also known to use malicious emails and phishing techniques to gain initial access to the victim’s networks. The xPack backdoor is a custom .NET loader that decrypts, loads, and executes .bin files. The attackers also used a variety of LoL (living-off-the-land) tools such as WMIC, PowerShell, LSASS, ProcDump, and PsExec.