Rewterz Threat Alert – Antlion APT Group – Active IOCs

Severity

High

Analysis Summary

Nation-State actors from China are attacking financial institutions in Taiwan. The attackers used stealthy techniques to evade detection in a campaign that lasted 18 months. The attackers leveraged EternalBlue exploits and also deployed a backdoor called xPack that allowed them to run WMI commands on the affected systems remotely.

Like most APTs, the campaign was used to exfiltrate data and cyber espionage. At least three organizations were targeted by this attacker in Taiwan. Which includes two financial organizations and a manufacturing company. Interestingly, the threat actors were able to infiltrate the financial and manufacturing organization for 250 and 175 days respectively.

Symantec, a division of Broadcom, cannot state with certainty what the initial infection vector used by the attackers in this campaign was, though in one instance they were seen utilizing the MSSQL service to execute system commands, which indicates that the most likely infection vector was exploitation of a web application or service.

Antlion APT is also known to use malicious emails and phishing techniques to gain initial access to the victim’s networks. The xPack backdoor is a custom .NET loader that decrypts, loads, and executes .bin files. The attackers also used a variety of LoL (living-off-the-land) tools such as WMIC, PowerShell, LSASS, ProcDump, and PsExec.

Impact

• Information Theft and Espionage
• Exposure of Sensitive Data

Indicators of Compromise

MD5

• afa6cad2fd3282ed9c8d522e8d5f7094
• 4a448d283c8b112115a8e3807fa3744a
• 0ad348dd852873e1b8e3ce9af2bcd6a3
• dedac95f360602f882742a31f81ef799
• b51aa600db0615a4971ce75919a93f4f
• 0ee7731c202b82c1822e563428a51da4
• 1de6a5904b0331ed96ec71856dc0baa1

SHA-256

• 12425edb2c50eac79f06bf228cb2dd77bb1e847c4c4a2049c91e0c5b345df5f2
• e4a15537f767332a7ed08009f4e0c5a7b65e8cbd468eb81e3e20dc8dfc36aeed
• e488f0015f14a0eff4b756d10f252aa419bc960050a53cc04699d5cc8df86c8a
• 390460900c318a9a5c9026208f9486af58b149d2ba98069007218973a6b0df66
• e968e0d7e62fbc36ad95bc7b140cf7c32cd0f02fd6f4f914eeb7c7b87528cfe2
• 55636c8a0baa9b57e52728c12dd969817815ba88ec8c8985bd20f23acd7f0537
• 48d41507f5fc40a310fcd9148b790c29aeb9458ff45f789d091a9af114f26f43

SHA-1

• 1483e9c0e14e2d33cbef8782f55f68a15f5fa98f
• ca3b0cbff477bc67d2a71731d93a420f2e298be0
• af4d665fb721ed25b6c56ee52fb835fc2b3320b3
• 300fea252ba087c20fba5801a47ee2852ea213fb
• d7b0ba4958f88b3e7606ee536c90cb08ac258815
• ea39084f647ce3c9f2892118d850a05dd65d750b
• cb04ff706de2c2334827e19721ec829e0bdb804e

Remediation

• Always be suspicious about emails sent by unknown senders.
• Never click on links/attachments sent by unknown senders.
• Block all threat indicators at your respective controls.
• Search for IOCs in your environment.