Rewterz Threat Alert – Lazarus APT Group – Active IOCs
February 4, 2022Rewterz Threat Advisory – Multiple Microsoft Edge (Chromium-based) Vulnerabilities
February 7, 2022Rewterz Threat Alert – Lazarus APT Group – Active IOCs
February 4, 2022Rewterz Threat Advisory – Multiple Microsoft Edge (Chromium-based) Vulnerabilities
February 7, 2022Severity
High
Analysis Summary
Nation-State actors from China are attacking financial institutions in Taiwan. The attackers used stealthy techniques to evade detection in a campaign that lasted 18 months. The attackers leveraged EternalBlue exploits and also deployed a backdoor called xPack that allowed them to run WMI commands on the affected systems remotely.
Like most APTs, the campaign was used to exfiltrate data and cyber espionage. At least three organizations were targeted by this attacker in Taiwan. Which includes two financial organizations and a manufacturing company. Interestingly, the threat actors were able to infiltrate the financial and manufacturing organization for 250 and 175 days respectively.
Symantec, a division of Broadcom, cannot state with certainty what the initial infection vector used by the attackers in this campaign was, though in one instance they were seen utilizing the MSSQL service to execute system commands, which indicates that the most likely infection vector was exploitation of a web application or service.
Antlion APT is also known to use malicious emails and phishing techniques to gain initial access to the victim’s networks. The xPack backdoor is a custom .NET loader that decrypts, loads, and executes .bin files. The attackers also used a variety of LoL (living-off-the-land) tools such as WMIC, PowerShell, LSASS, ProcDump, and PsExec.
Impact
- Information Theft and Espionage
- Exposure of Sensitive Data
Indicators of Compromise
MD5
- afa6cad2fd3282ed9c8d522e8d5f7094
- 4a448d283c8b112115a8e3807fa3744a
- 0ad348dd852873e1b8e3ce9af2bcd6a3
- dedac95f360602f882742a31f81ef799
- b51aa600db0615a4971ce75919a93f4f
- 0ee7731c202b82c1822e563428a51da4
- 1de6a5904b0331ed96ec71856dc0baa1
SHA-256
- 12425edb2c50eac79f06bf228cb2dd77bb1e847c4c4a2049c91e0c5b345df5f2
- e4a15537f767332a7ed08009f4e0c5a7b65e8cbd468eb81e3e20dc8dfc36aeed
- e488f0015f14a0eff4b756d10f252aa419bc960050a53cc04699d5cc8df86c8a
- 390460900c318a9a5c9026208f9486af58b149d2ba98069007218973a6b0df66
- e968e0d7e62fbc36ad95bc7b140cf7c32cd0f02fd6f4f914eeb7c7b87528cfe2
- 55636c8a0baa9b57e52728c12dd969817815ba88ec8c8985bd20f23acd7f0537
- 48d41507f5fc40a310fcd9148b790c29aeb9458ff45f789d091a9af114f26f43
SHA-1
- 1483e9c0e14e2d33cbef8782f55f68a15f5fa98f
- ca3b0cbff477bc67d2a71731d93a420f2e298be0
- af4d665fb721ed25b6c56ee52fb835fc2b3320b3
- 300fea252ba087c20fba5801a47ee2852ea213fb
- d7b0ba4958f88b3e7606ee536c90cb08ac258815
- ea39084f647ce3c9f2892118d850a05dd65d750b
- cb04ff706de2c2334827e19721ec829e0bdb804e
Remediation
- Always be suspicious about emails sent by unknown senders.
- Never click on links/attachments sent by unknown senders.
- Block all threat indicators at your respective controls.
- Search for IOCs in your environment.