Rewterz Threat Alert – APT41 Intrusion Activities – IoCs

Severity

High

Analysis Summary

APT41 intrusion activities originating from China are being detected again. Earlier this year, APT41 launched a global intrusion campaign using multiple exploits. These recent computer intrusions are affecting more than 100 victim companies and organizations globally. These computer network exploitation (CNE) operations are mainly targeting the following industries:

• Education
• Computer hardware
• Software, including video gaming
• Government
• Healthcare
• Hospitality
• Social networking
• Non-governmental organizations
• Telecommunications

The group is known for having conducted numerous computer intrusions as well as criminal for-profit computer fraud on a global scale, using sophisticated tradecraft against a variety of targets, such as compromising legitimate software for supply chain intrusions, using custom malware, deploying ransomware, and engaging in crypto-jacking attacks. Spearphishing emails with malicious files is a common tactic for the initial infection. Spearphishing themes frequently target HR departments with malicious archive files masqueraded as applicant resumes. In addition, the group conducted supply chain compromises resulting in the victimization of third-party customers throughout the world. They steal login credentials for administrative accounts to expand their unauthorized access. Additionally, the actors may deploy legitimate third-party VPN software such as SoftEther on victim networks to facilitate follow-on access to the victim network. The group has also deployed “Skeleton Key” malware to create a master password that will work for any account in the domain.

Exploited Vulnerabilities:

The group is also known for rapidly exploiting publicly identified security vulnerabilities. This technique allowed the group to gain access into victim accounts using publicly available exploit code against VPN services. Security vulnerabilities such as CVE-2019-19781, CVE-2019-11510, CVE-2019-16920, CVE-2019-16278, CVE-2019-1652/CVE-2019-1653, and CVE-2020-10189 were exploited for installation of widely available remote access tools like Cobalt Strike.

Impact

• Credential Theft
• Unauthorized Access
• Malicious Code Execution
• Privilege Escalation
• Defense Evasion
• Data Exfiltration
• System Compromise

Indicators of Compromise

Domain Name

• ad[.]lflink[.]com
• id[.]serveuser[.]com
• sexyjapan[.]ddns[.]info
• biller[.]zzux[.]com
• image[.]x24hr[.]com
• splash[.]dns04[.]com
• bschery[.]zzux[.]com
• images[.]h1x[.]com
• sport[.]wikaba[.]com
• bsnl1[.]dynamic-dns[.]net
• images[.]ikwb[.]com
• spyd123[.]dynamic-dns[.]net
• bswan[.]authorizeddns[.]org
• item[.]itemdb[.]com
• testtest[.]x24hr[.]com
• cat[.]moneyhome[.]biz
• l1nkedin[.]ns01[.]biz
• token[.]dns04[.]com
• cipp[.]dns04[.]com
• linkedin[.]2waky[.]com
• udm[.]dns05[.]com
• clients[.]cleansite[.]info
• money[.]moneyhome[.]biz
• udomain[.]mrbonus[.]com
• cronous[.]wikaba[.]com
• mtnl1[.]dynamic-dns[.]net
• udomaincom[.]dynamic-dns[.]net
• ddns[.]4pu[.]com
• mxmail[.]esmtp[.]biz
• users[.]fartit[.]com
• ddxsn[.]ddns[.]info
• netsysdom[.]dynamic-dns[.]net
• vada[.]my03[.]com
• dr0pb0x[.]zyns[.]com
• newnw[.]4pu[.]com
• vb[.]xxuz[.]com
• dropbox[.]dns2[.]us
• newpic[.]sexxxy[.]biz
• voda[.]dns04[.]com
• excharge[.]sexxxy[.]biz
• news[.]mrbonus[.]com
• wind[.]ikwb[.]com
• faceb00k[.]ns01[.]info
• nxead[.]itemdb[.]com
• winner[.]ikwb[.]com
• faceb0ok[.]2waky[.]com
• pachost[.]dynamic-dns[.]net
• winner[.]serveuser[.]com
• firejun[.]freeddns[.]com
• pachost[.]wikaba[.]com
• wordpr[.]dynamic-dns[.]net
• firejun[.]freetcp[.]com
• patch[.]itsaol[.]com
• wordpressb[.]justdied[.]com
• firejun[.]myddns[.]com
• pd[.]zzux[.]com
• wpblog[.]dynamic-dns[.]net
• foods[.]x24hr[.]com
• pd1[.]dynamic-dns[.]net
• wwwss[.]mrbasic[.]com
• forum1[.]zzux[.]com
• pdbana[.]dynamic-dns[.]net
• wxxxs[.]mefound[.]com
• foryou[.]x24hr[.]com
• pic[.]4pu[.]com
• xnews[.]ikwb[.]com
• free[.]itsaol[.]com
• pic[.]x24hr[.]com
• xnews[.]mypicture[.]info
• gold[.]bigmoney[.]biz
• purdue[.]dynamic-dns[.]net
• xvideo[.]mrslove[.]com
• gold[.]mrbonus[.]com
• readme[.]myddns[.]com
• xx0ssd[.]isasecret[.]com
• happysky[.]edns[.]biz
• rem0te[.]edns[.]biz
• xx0xx[.]dnset[.]com
• help[.]wikaba[.]com
• remoteset[.]zyns[.]com
• xznews[.]zzux[.]com
• hike[.]dns04[.]com
• remotetest[.]dynamic-dns[.]net
• zxerbqr[.]zyns[.]com

From Email

• 0x41ex@gmail[.]com
• hee_chow_ming@yahoo[.]com[.]hk
• nslookup168@gmail[.]com
• 0x5h31l@gmail[.]com
• hiliana550jonson@gmail[.]com
• nuyuchen1983@hotmail[.]com
• 3g[.]xiao[.]i@gmail[.]com
• himyjb@gmail[.]com
• parameters4512@outlook[.]com
• a210f1@gmail[.]com
• holleword@hotmail[.]com
• paulmckee518@gmail[.]com
• aaronjayjack@outlook[.]com
• hostay88@gmail[.]com
• peterlovell29@gmail[.]com
• agsyhfyrdetyhfdgsh@gmail[.]com
• hrprter777@gmail[.]com
• petervc1983@gmail[.]com
• andreatilley178@gmail[.]com
• hrsimon59@gmail[.]com
• petter[.]mark@mail[.]com
• andr-lang@outlook[.]com
• ikoumoutzelis@gmail[.]com
• puttyoffice@gmail[.]com
• angela[.]kuolt90@gmail[.]com
• inministryofhealth@gmail[.]com
• qiongzhi777@live[.]com
• angelatyrrell844@gmail[.]com
• ishiicaron@gmail[.]com
• qungtlak@gmail[.]com
• anssi[.]kanninen@outlook[.]com
• jacktake@outlook[.]com
• richardreed647@gmail[.]com
• anvisoftceo@gmail[.]com
• jennyradford45@gmail[.]com
• robertaponte331@gmail[.]com
• anydkim9@gmail[.]com
• jimgrem@msn[.]com
• robertblanchard511@gmail[.]com
• artomikkola@outlook[.]com
• jimgrou@msn[.]com
• ryandaws@outlook[.]com
• ashiksaha73@gmail[.]com
• jinnyit987@gmail[.]com
• shavonyasbjqoj@gmail[.]com
• b1ackn1ve@gmail[.]com
• johnx19@hotmail[.]com
• skydrive1951@hotmail[.]com
• bajsingh63@gmail[.]com
• jonreal27@gmail[.]com
• skydrivewinsborn@hotmail[.]com
• baptistevillanyi@gmail[.]com
• josephbrier300@gmail[.]com
• sotadoanfybs@hotmail[.]com
• bhssasqza54251@gmail[.]com
• josuepined@outlook[.]com
• stevenwhipple48@gmail[.]com
• blackwolf915@gmail[.]com
• justbyebye@hotmail[.]com
• summery679@gmail[.]com
• blackwolf915@outlook[.]com
• justinbethune@hotmail[.]com
• susanne[.]sawer@gmail[.]com
• bogart[.]mig@gmail[.]com
• karolinebartush67@gmail[.]com
• sworgan88@gmail[.]com
• bossjiang2016@outlook[.]com
• lauramuollo@yahoo[.]com
• symanteclabs@outlook[.]com
• carlietoole56@gmail[.]com
• lauren19111@hotmail[.]com
• takeown2009@outlook[.]com
• cary[.]emily90@gmail[.]com
• lhm_cn@msn[.]com
• terrenceruddell59@gmail[.]com
• cheng[.]cheng[.]cheng3@gmail[.]com
• lhmjustfun@gmail[.]com
• thplldeepak@gmail[.]com
• chris[.]weaver049@gmail[.]com
• liveupdate@outlook[.]com
• tony[.]john90@outlook[.]com
• ckevin324@gmail[.]com
• maddulasavitri@gmail[.]com
• tw[.]slax@gmail[.]com
• code[.]sec01@gmail[.]com
• mark_hedin@yahoo[.]com
• ualmansife523f@gmail[.]com
• danieldociu81@gmail[.]com
• michaelbrown2151@gmail[.]com
• unameid@gmail[.]com
• dilo220sayontony@gmail[.]com
• mikecoo2020@yahoo[.]com
• us[.]webgame@gmail[.]com
• epovkhan@gmail[.]com
• mm4rbury@outlook[.]com
• vaniadower5641c@gmail[.]com
• ervartiainen@gmail[.]com
• morissafetzko4@gmail[.]com
• violetteclaveau54c@gmail[.]com
• georgecraven379@gmail[.]com
• mralphmielke@gmail[.]com
• willardstone92@gmail[.]com
• gogoiobit@gmail[.]com
• ms[.]alienware@gmail[.]com
• wljsdd@gmail[.]com
• greatyeon3@gmail[.]com
• mstsc@live[.]com
• wrennieeller564c@gmail[.]com
• greatyeon7@gmail[.]com
• myjobs[.]kr[.]hr@gmail[.]com
• ysummer56@gmail[.]com
• gsecdump@gmail[.]com
• nanettehoagland676@gmail[.]com
• zeplin[.]law@gmail[.]com
• gtagqwrxjhec@gmail[.]com
• nesakjsfdkl8754@gmail[.]com
• zeplincopyright@gmail[.]com
• gwanling1456@yahoo[.]com
• niying322@gmail[.]com
• zeplinlegal@gmail[.]com
• hangobangeros526c@gmail[.]com
• nodarie89@yahoo[.]com
• znetdevil@msn[.]com
• haueh410gakiam@gmail[.]com
• nohavesky@hotmail[.]com

Source IP

• 45[.]32[.]68[.]14
• 45[.]32[.]93[.]169
• 216[.]24[.]182[.]48
• 207[.]246[.]16[.]107
• 64[.]64[.]236[.]27
• 104[.]243[.]19[.]49
• 104[.]243[.]23[.]73
• 104[.]36[.]69[.]105
• 107[.]182[.]18[.]149
• 107[.]182[.]24[.]70
• 107[.]182[.]26[.]43
• 172[.]96[.]204[.]252
• 173[.]242[.]122[.]198
• 176[.]122[.]162[.]149
• 176[.]122[.]163[.]125
• 176[.]122[.]188[.]254
• 149[.]154[.]157[.]48
• 216[.]24[.]179[.]23
• 64[.]64[.]251[.]135
• 65[.]49[.]192[.]74
• 74[.]120[.]175[.]144
• 74[.]82[.]201[.]8
• 80[.]251[.]220[.]225
• 80[.]251[.]222[.]7
• 80[.]251[.]222[.]80
• 140[.]82[.]23[.]214
• 173[.]242[.]117[.]47
• 149[.]248[.]16[.]107
• 192[.]69[.]89[.]157
• 149[.]28[.]88[.]49
• 64[.]64[.]234[.]24
• 45[.]86[.]163[.]136
• 104[.]194[.]85[.]41
• 51[.]68[.]28[.]242
• 207[.]246[.]108[.]247
• 104[.]224[.]185[.]36
• 138[.]68[.]78[.]69
• 45[.]77[.]28[.]164
• 67[.]230[.]163[.]214

Remediation

• Block the threat indicators at their respective controls.
• Strictly avoid downloading attachments from untrusted sources.
• Maintain up-to-date antivirus signatures and engines.
• Immediately patch all the exploited vulnerabilities.
• Maintain a patch management program to update all vulnerable products as soon as a patch is released by the official source.
• Implement a strong password policy and MFA.
• Make sure all third-party vendors are compliant to standard security requirements. 
• Actively scan and monitor internet-accessible applications for unauthorized access, modification, and anomalous activities.