Rewterz Threat Alert – Earth Preta aka Mustang Panda APT Group – Active IOCsIOCs

Severity

High

Analysis Summary

MustangPanda, aka Bronze President and TA416, has been active since at least 2012. This threat actor targeted government agencies, think tanks, NGOs, and even Vatican-affiliated religious institutions in the United States and Europe. Asian countries, such as Taiwan, Hong Kong, Mongolia, Tibet, and Myanmar, were the main focus of the past campaigns. The group is notorious for creating phishing lures based on current events that might interest its target, for example, Covid-19 pandemic, political subjects, and most trending issues like Russian-Ukrainian cyber warfare.

The Trojan application PlugX has been the most popular malicious implant utilized by Mustang Panda and is still the preferred spying weapon for the group. The recent Mustang Panda activity involves the use of DLL side-loading to deliver PlugX. The initial infection vector is an executable downloaded from a remote URL. The executable is responsible for installing the malware by dropping the required files (a DLL loader, a legitimate binary, and the PlugX payload) onto the system. The legitimate binary is the Adobe CEF Helper and is vulnerable to DLL side-loading. When the installer runs the legitimate binary, the dropped DLL is loaded. This DLL is the loader for the final payload. First, it reads a hardcoded .dat file that contains the XOR key for decrypting the final payload, then it performs the decryption and loads the malware into memory. Once running in memory, the PlugX payload is able to decrypt its configuration data, which includes its installation location, the XOR key for C2 communication, and any C2 addresses and ports.

This APT group has been active for many years and is known to use a variety of tactics and techniques to compromise target systems, including spear-phishing campaigns, custom malware, and exploiting vulnerabilities in popular software. MustangPanda is considered to be one of the more sophisticated APT groups, and it is known for its ability to maintain a persistent presence within target networks and exfiltrate large amounts of sensitive data without being detected.

Impact

• Information Theft
• Exposure To Sensitive Data

Indicators of Compromise

MD5

• 98017f1f26edc48b42098b708019bcbe
• 9b92fc29dd51a53658393d10f1c59ee6
• 0c329e41c842125875197c4372adcde1

SHA-256

• c96723a68fc939c835578ff746f7d4c5371cb82a9c0dffe360bb656acea4d6e1
• 460c459db77c5625ed1c029b2dd6c6eae5e631b81a169494fb0182d550769f76
• ce308b538ff3a0be0dbcee753db7e556a54b4aeddbddd0c03db7126b08911fe2

SHA-1

• f9e96d0492e0726594158536d64c5e0a4384a8dc
• f412ed38330b1e1706547475b85977621bdbdecb
• f54895c6137e6ce6ce8e0581869e8243e2825aea

URL

https://www.jcswcd.com/tuncxwfw

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Maintain cyber hygiene by updating your anti-virus software and implementing a patch management lifecycle.
• Maintain Offline Backups – In a ransomware attack, the adversary will often delete or encrypt backups if they have access to them. That’s why it’s important to keep offline (preferably off-site), encrypted backups of data and test them regularly.
• Emails from unknown senders should always be treated with caution.
• Never trust or open ” links and attachments received from unknown sources/senders.
• Patch and upgrade any platforms and software timely and make it into a standard security policy. Prioritize patching known exploited vulnerabilities and zero-days.
• Along with network and system hardening, code hardening should be implemented within the organization so that their websites and software are secure. Use testing tools to detect any vulnerabilities in the deployed codes.
• Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets