The Mustang Panda APT group, likely state-sponsored by China, launched a cyberespionage campaign targeting government organizations and NGOs in Vietnam. The attack used Windows LNK files containing partial lure documents to evade detection.
Once opened, the LNK files abused legitimate tools like forfiles.exe to download and execute malicious HTA files from remote servers, and the attackers further leveraged PowerShell, VBScript, and batch files to complete the intrusion.
To bypass detection and increase file size, they also used DLL sideloading via rundll32 to execute malicious DLLs on the compromised systems.
An attack campaign used a malicious LNK file named “Vanban_8647_cuong_che_thi_hanh_quyet_dinh.pdf.lnk” disguised as a PDF document with a double extension. The LNK file’s SHA256 hash is 47eb43acdd342d3975000f650cf656d9f0f759780d85f16d806d6b9a70f1be46.
To evade detection, the attackers appended a portion of the decoy PDF’s data to the LNK file, increasing its size, which suggests the attackers targeted individuals involved in financial activities based on the lure document referencing tax compliance.
A malicious LNK file exploited forfiles.exe to initiate a PowerShell command using mshta, which downloaded a VBScript (.hta) file that further downloaded a remote PowerShell script.
The downloaded script dropped a malicious DLL and executable, then performed DLL sideloading using the legitimate executable to execute the DLL, and the other downloaded HTA file extracted a binary string disguised as a meta tag and saved it as a decoy PDF document.
The Mustang Panda campaign leverages a side-loaded DLL to establish persistence and download an encrypted payload. The DLL creates a mutex and a RUN entry for a malicious executable, and then retrieves an encrypted data file and decrypts it in memory, revealing a shellcode without a PE header.
This shellcode decrypts embedded strings with a single-byte XOR key, creates another mutex, and retrieves the system’s MAC address, which is then encrypted with RC4, encoded in base64, and exfiltrated to the attacker’s C&C server.
The APT campaign targets Vietnamese individuals in the education sector. The attack involves a LNK file disguised as a Word document that downloads a legitimate Word document and a PowerShell script.
The PowerShell script then downloads additional files, including a batch script that further downloads PowerShell scripts, which steal system information, including system info, adaptor information, network information, task list, user account information, and antivirus products, and sends it to the C&C server.
According to CRIL, the attackers then download additional DLLs that act as loaders and connect to a C&C server to carry out further malicious activities.
Also Read:
%20(1).webp?w=1200&resize=1200,0&ssl=1 "Casio Suffers Cyber Attack, Hackers Gain Unauthorized Access")
