urlscan.io logo urlscan.io
SecurityTrails logo

cyble.com Open in urlscan Pro
192.0.78.231  Public Scan

Back to summary
Submitted URL: https://cyble.com/blog/stealthy-fileless-attack-targets-attendees-of-us-taiwan-defense-industry-event/'
Effective URL: https://cyble.com/blog/stealthy-fileless-attack-targets-attendees-of-us-taiwan-defense-industry-event/
Submission: On September 16 via api from US — Scanned from DE

Form analysis 4 forms found in the DOM

POST https://wordpress.com/email-subscriptions

<form action="https://wordpress.com/email-subscriptions" method="post" accept-charset="utf-8" data-blog="221651828" data-post_access_level="everybody" data-subscriber_email="" id="subscribe-blog" data-hs-cf-bound="true" data-cb-wrapper="true">
  <div class="wp-block-jetpack-subscriptions__form-elements">
    <p id="subscribe-email">
      <label id="subscribe-field-label" for="subscribe-field" class="screen-reader-text"> Type your email… </label>
      <input required="required" type="email" name="email" class="no-border-radius  has-ast-global-color-6-border-color" style="font-size: 16px;padding: 10px 15px 10px 15px;border-color: ast-global-color-6;border-radius: 0px;border-width: 1px;"
        placeholder="Type your email…" value="" id="subscribe-field" title="Please fill in this field.">
    </p>
    <p id="subscribe-submit" style="width: ;max-width: 100%;">
      <input type="hidden" name="action" value="subscribe">
      <input type="hidden" name="blog_id" value="221651828">
      <input type="hidden" name="source" value="https://cyble.com/blog/stealthy-fileless-attack-targets-attendees-of-us-taiwan-defense-industry-event/">
      <input type="hidden" name="sub-type" value="subscribe-block">
      <input type="hidden" name="app_source" value="">
      <input type="hidden" name="redirect_fragment" value="subscribe-blog">
      <input type="hidden" name="lang" value="en_US">
      <input type="hidden" id="_wpnonce" name="_wpnonce" value="55286593b9"><input type="hidden" name="_wp_http_referer" value="/blog/stealthy-fileless-attack-targets-attendees-of-us-taiwan-defense-industry-event/"><input type="hidden" name="post_id"
        value="60811"> <button type="submit" class="wp-block-button__link no-border-radius has-ast-global-color-6-border-color"
        style="background: #cc0000;width: 100%;font-size: 16px;padding: 10px 15px 10px 15px;margin: 0; margin-left: 10px;border-color: ast-global-color-6;border-radius: 0px;border-width: 1px;" name="jetpack_subscriptions_widget"> Subscribe Now <span
          class="jetpack-memberships-spinner"> <svg width="24" height="24" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
            <path d="M12,1A11,11,0,1,0,23,12,11,11,0,0,0,12,1Zm0,19a8,8,0,1,1,8-8A8,8,0,0,1,12,20Z" opacity=".25" fill="currentColor"></path>
            <path d="M10.14,1.16a11,11,0,0,0-9,8.92A1.59,1.59,0,0,0,2.46,12,1.52,1.52,0,0,0,4.11,10.7a8,8,0,0,1,6.66-6.61A1.42,1.42,0,0,0,12,2.69h0A1.57,1.57,0,0,0,10.14,1.16Z" class="jetpack-memberships-spinner-rotating" fill="currentColor"></path>
          </svg></span></button>
    </p>
  </div>
</form>

GET https://cyble.com/

<form class="search-form" action="https://cyble.com/" method="get" data-hs-cf-bound="true" data-cb-wrapper="true">
  <fieldset>
    <span class="text">
      <label for="search-field" class="screen-reader-text">Begin Search...</label>
      <input id="search-field" name="s" class="search-field" autocomplete="off" type="text" value="" placeholder="Begin Search..." tabindex="1">
    </span>
    <button aria-label="Search" id="search_submit" class="button search-submit" tabindex="2"><i class="astra-search-icon"> <span class="ast-icon icon-search"></span> </i></button>
  </fieldset>
</form>

POST https://wordpress.com/email-subscriptions

<form action="https://wordpress.com/email-subscriptions" method="post" accept-charset="utf-8" data-blog="221651828" data-post_access_level="everybody" data-subscriber_email="" id="subscribe-blog-2" data-hs-cf-bound="true" data-cb-wrapper="true">
  <div class="wp-block-jetpack-subscriptions__form-elements">
    <p id="subscribe-email">
      <label id="subscribe-field-2-label" for="subscribe-field-2" class="screen-reader-text"> Type your email… </label>
      <input required="required" type="email" name="email" style="font-size: 16px;padding: 15px 23px 15px 23px;border-radius: 50px;border-width: 1px;" placeholder="Type your email…" value="" id="subscribe-field-2" title="Please fill in this field.">
    </p>
    <p id="subscribe-submit">
      <input type="hidden" name="action" value="subscribe">
      <input type="hidden" name="blog_id" value="221651828">
      <input type="hidden" name="source" value="https://cyble.com/blog/stealthy-fileless-attack-targets-attendees-of-us-taiwan-defense-industry-event/">
      <input type="hidden" name="sub-type" value="subscribe-block">
      <input type="hidden" name="app_source" value="atomic-subscription-modal-lo">
      <input type="hidden" name="redirect_fragment" value="subscribe-blog-2">
      <input type="hidden" name="lang" value="en_US">
      <input type="hidden" id="_wpnonce" name="_wpnonce" value="55286593b9"><input type="hidden" name="_wp_http_referer" value="/blog/stealthy-fileless-attack-targets-attendees-of-us-taiwan-defense-industry-event/"><input type="hidden" name="post_id"
        value="60811"> <button type="submit" class="wp-block-button__link" style="font-size: 16px;padding: 15px 23px 15px 23px;margin: 0; margin-left: 10px;border-radius: 50px;border-width: 1px;" name="jetpack_subscriptions_widget"> Subscribe <span
          class="jetpack-memberships-spinner"> <svg width="24" height="24" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
            <path d="M12,1A11,11,0,1,0,23,12,11,11,0,0,0,12,1Zm0,19a8,8,0,1,1,8-8A8,8,0,0,1,12,20Z" opacity=".25" fill="currentColor"></path>
            <path d="M10.14,1.16a11,11,0,0,0-9,8.92A1.59,1.59,0,0,0,2.46,12,1.52,1.52,0,0,0,4.11,10.7a8,8,0,0,1,6.66-6.61A1.42,1.42,0,0,0,12,2.69h0A1.57,1.57,0,0,0,10.14,1.16Z" class="jetpack-memberships-spinner-rotating" fill="currentColor"></path>
          </svg></span></button>
    </p>
  </div>
</form>

<form id="jp-carousel-comment-form" data-hs-cf-bound="true" data-cb-wrapper="true">
  <label for="jp-carousel-comment-form-comment-field" class="screen-reader-text">Write a Comment...</label>
  <textarea name="comment" class="jp-carousel-comment-form-field jp-carousel-comment-form-textarea" id="jp-carousel-comment-form-comment-field" placeholder="Write a Comment..."></textarea>
  <div id="jp-carousel-comment-form-submit-and-info-wrapper">
    <div id="jp-carousel-comment-form-commenting-as">
      <fieldset>
        <label for="jp-carousel-comment-form-email-field">Email</label>
        <input type="text" name="email" class="jp-carousel-comment-form-field jp-carousel-comment-form-text-field" id="jp-carousel-comment-form-email-field">
      </fieldset>
      <fieldset>
        <label for="jp-carousel-comment-form-author-field">Name</label>
        <input type="text" name="author" class="jp-carousel-comment-form-field jp-carousel-comment-form-text-field" id="jp-carousel-comment-form-author-field">
      </fieldset>
      <fieldset>
        <label for="jp-carousel-comment-form-url-field">Website</label>
        <input type="text" name="url" class="jp-carousel-comment-form-field jp-carousel-comment-form-text-field" id="jp-carousel-comment-form-url-field">
      </fieldset>
    </div>
    <input type="submit" name="submit" class="jp-carousel-comment-form-button" id="jp-carousel-comment-form-button-submit" value="Post Comment">
  </div>
</form>

Text Content

Skip to content
 * CISA Adds Ivanti Cloud Services Appliance Vulnerability to Known Exploited
   Vulnerabilities Catalog (CVE-2024-8190)

Report an Incident

Talk to Sales

We are Hiring!

Login
Login
 * ProductsMenu Toggle
   * For Enterprises(B2B) and GovernmentsMenu Toggle
     * AI-Driven Cybersecurity Platforms
     * Cyble VisionFor Enterprises
       Award-winning cyber threat intelligence platform, designed to provide
       enhanced security through real-time intelligence and threat detection.
     * Cyble HawkFor Federal Bodies
       Protects sensitive information and assets from cyber threats with its
       specialized threat detection and intelligence capabilities built for
       federal bodies.
   * For Enterprises(B2B) and Individuals(B2C)Menu Toggle
     * AmIBreached
       Enables consumers and organizations to Identify, Prioritize and Mitigate
       darkweb risks.
     * Odin by CybleNew
       The most advanced internet-scanning tool in the industry for real-time
       threat detection and cybersecurity
     * The Cyber ExpressSubscribe
       #1 Trending Cyber Security News and Magazine
   * We’ve just released an update!
     Cyble has an update that enhances ASM, CTI and more...
     Menu Toggle
     * Schedule a Demo
 * SolutionsMenu Toggle
   * Detect > Validate > CloseMenu Toggle
     * AI-Driven SolutionsMenu Toggle
       * Attack Surface ManagementNew Features
         Ensure digital security by identifying and mitigating threats with
         Cyble's Attack Surface Management
       * Brand Intelligence
         Comprehensive protection against online brand abuse, including brand
         impersonation, phishing, and fraudulent domains.
       * Cyber Threat Intelligence
         Gain insights and enhance your defense with AI-driven analysis and
         continuous threat monitoring
   * Menu ItemMenu Toggle
     * Dark Web Monitoring
       Stay vigilant and ahead of cybercriminals with Cyble's comprehensive Dark
       Web Monitoring.
     * Vulnerability Management
       Advanced scanning, risk evaluation, and efficient remediation strategies
       to protect against cyber threats.
     * Takedown and Disruption
       Combat online fraud and cybercrime by removing fraudulent sites and
       content, and disrupting malicious campaigns with #1 takedown services by
       Cyble.
   * Solutions by Industry
     
     Menu Toggle
     * Healthcare & Pharmaceuticals
     * Financial Services
       
     * Retail and CPG
     * Technology Industry
     * Educational Platform
   * Solutions by Role
     
     Menu Toggle
     * Information Security
     * Corporate Security
     * Marketing
       
 * Why Cyble?Menu Toggle
   * Compare Cyble
     Learn why Cyble is a key differentiator when it comes to proactive
     cybersecurity.
     Menu Toggle
     * Industry RecognitionAwards
     * Customer Stories
 * ResourcesMenu Toggle
   * Thought LeadershipMenu Toggle
     * Blog
       Discover the latest in cybersecurity with Cyble's blog, featuring a
       wealth of articles, research findings, and insights. CRIL is an
       invaluable resource for anyone interested in the evolving world of cyber
       threats and defenses, offering expert analysis and updates.
     * Threat Actor Profiles
     * SAMA Compliance
     * Events
       Conferences, Webinars, Training sessions and more…
   * Knowledge Hub
     Cyble's Knowledge Hub is a central resource for current cybersecurity
     trends, research, and expert opinions.
     Menu Toggle
     * Case Studies
       Dive into Cyble's case studies to discover real-world applications of
       their cybersecurity solutions. These studies provide valuable insights
       into how Cyble addresses various cyber threats and enhances digital
       security for different organizations.
     * Research Reports
        * Country Reports
        * Industry Reports
        * Ransomware Reports
     
     * WhitepapersDownload
   * Research ReportsLatest Report
     
     Menu Toggle
     * Free Tools
        * Scan The Dark Web
        * Scan The Internet
       
       Menu Toggle
       * External Threat Assessment ReportDownload Report
 * CompanyMenu Toggle
   * Our Story
     Learn about Cyble's journey and mission in the cybersecurity landscape.
     Menu Toggle
     * Leadership Team
       Meet our leadership team.
     * CareersWe are hiring!
       Explore a career with Cyble and contribute to cutting-edge cybersecurity
       solutions. Check out Cyble's career opportunities.
     * Press
 * PartnersMenu Toggle
   * Cyble Partner Network (CPN)Join Us
     Join Cyble's Partner Network to collaborate and innovate in cybersecurity.
     This platform offers unique opportunities for partnerships, fostering
     growth and shared success in tackling cyber threats together.
     Menu Toggle
     * Partner Login
     * Become a PartnerRegister
       Elevate your cybersecurity business with the Cyble Partner Network:
       Access cutting-edge tools, expert support, and growth opportunities.
       Ideal for MSSPs, resellers, and alliances.


Book a Demo
Book a Demo
Main Menu
 * ProductsMenu Toggle
   * For Enterprises(B2B) and GovernmentsMenu Toggle
     * AI-Driven Cybersecurity Platforms
     * Cyble VisionFor Enterprises
       Award-winning cyber threat intelligence platform, designed to provide
       enhanced security through real-time intelligence and threat detection.
     * Cyble HawkFor Federal Bodies
       Protects sensitive information and assets from cyber threats with its
       specialized threat detection and intelligence capabilities built for
       federal bodies.
   * For Enterprises(B2B) and Individuals(B2C)Menu Toggle
     * AmIBreached
       Enables consumers and organizations to Identify, Prioritize and Mitigate
       darkweb risks.
     * Odin by CybleNew
       The most advanced internet-scanning tool in the industry for real-time
       threat detection and cybersecurity
     * The Cyber ExpressSubscribe
       #1 Trending Cyber Security News and Magazine
   * We’ve just released an update!
     Cyble has an update that enhances ASM, CTI and more...
     Menu Toggle
     * Schedule a Demo
 * SolutionsMenu Toggle
   * Detect > Validate > CloseMenu Toggle
     * AI-Driven SolutionsMenu Toggle
       * Attack Surface ManagementNew Features
         Ensure digital security by identifying and mitigating threats with
         Cyble's Attack Surface Management
       * Brand Intelligence
         Comprehensive protection against online brand abuse, including brand
         impersonation, phishing, and fraudulent domains.
       * Cyber Threat Intelligence
         Gain insights and enhance your defense with AI-driven analysis and
         continuous threat monitoring
   * Menu ItemMenu Toggle
     * Dark Web Monitoring
       Stay vigilant and ahead of cybercriminals with Cyble's comprehensive Dark
       Web Monitoring.
     * Vulnerability Management
       Advanced scanning, risk evaluation, and efficient remediation strategies
       to protect against cyber threats.
     * Takedown and Disruption
       Combat online fraud and cybercrime by removing fraudulent sites and
       content, and disrupting malicious campaigns with #1 takedown services by
       Cyble.
   * Solutions by Industry
     
     Menu Toggle
     * Healthcare & Pharmaceuticals
     * Financial Services
       
     * Retail and CPG
     * Technology Industry
     * Educational Platform
   * Solutions by Role
     
     Menu Toggle
     * Information Security
     * Corporate Security
     * Marketing
       
 * Why Cyble?Menu Toggle
   * Compare Cyble
     Learn why Cyble is a key differentiator when it comes to proactive
     cybersecurity.
     Menu Toggle
     * Industry RecognitionAwards
     * Customer Stories
 * ResourcesMenu Toggle
   * Thought LeadershipMenu Toggle
     * Blog
       Discover the latest in cybersecurity with Cyble's blog, featuring a
       wealth of articles, research findings, and insights. CRIL is an
       invaluable resource for anyone interested in the evolving world of cyber
       threats and defenses, offering expert analysis and updates.
     * Threat Actor Profiles
     * SAMA Compliance
     * Events
       Conferences, Webinars, Training sessions and more…
   * Knowledge Hub
     Cyble's Knowledge Hub is a central resource for current cybersecurity
     trends, research, and expert opinions.
     Menu Toggle
     * Case Studies
       Dive into Cyble's case studies to discover real-world applications of
       their cybersecurity solutions. These studies provide valuable insights
       into how Cyble addresses various cyber threats and enhances digital
       security for different organizations.
     * Research Reports
        * Country Reports
        * Industry Reports
        * Ransomware Reports
     
     * WhitepapersDownload
   * Research ReportsLatest Report
     
     Menu Toggle
     * Free Tools
        * Scan The Dark Web
        * Scan The Internet
       
       Menu Toggle
       * External Threat Assessment ReportDownload Report
 * CompanyMenu Toggle
   * Our Story
     Learn about Cyble's journey and mission in the cybersecurity landscape.
     Menu Toggle
     * Leadership Team
       Meet our leadership team.
     * CareersWe are hiring!
       Explore a career with Cyble and contribute to cutting-edge cybersecurity
       solutions. Check out Cyble's career opportunities.
     * Press
 * PartnersMenu Toggle
   * Cyble Partner Network (CPN)Join Us
     Join Cyble's Partner Network to collaborate and innovate in cybersecurity.
     This platform offers unique opportunities for partnerships, fostering
     growth and shared success in tackling cyber threats together.
     Menu Toggle
     * Partner Login
     * Become a PartnerRegister
       Elevate your cybersecurity business with the Cyble Partner Network:
       Access cutting-edge tools, expert support, and growth opportunities.
       Ideal for MSSPs, resellers, and alliances.


TRENDING

TARGETED INDUSTRIES -> IT & ITES | Government & LEA | Technology | Healthcare |
BFSITARGETED COUNTRIES -> United States | Russian Federation | China | United
Kingdom | GermanyTARGETED REGIONS -> North America (NA) | Europe & UK | Asia &
Pacific (APAC) | Middle East & Africa (MEA) | Australia and New Zealand
(ANZ)IOCs -> a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91 |
7bdbd180c081fa63ca94f9c22c457376 |
c67b03c0a91eaefffd2f2c79b5c26a2648b8d3c19a22cadf35453455ff08ead0 |
8c69830a50fb85d8a794fa46643493b2 | bbcf7a68f4164a9f5f5cb2d9f30d9790CVEs ->
CVE-2024-21887 | CVE-2023-46805 | CVE-2017-11882 | CVE-2024-21893 |
CVE-2021-44228TECHNIQUES -> T1082 | T1140 | T1486 | T1083 | T1105TACTICS ->
TA505 | TA0011 | TA453 | TA0005 | TA0007TAGS -> security | the-cyber-express |
firewall-daily | the-cyber-express-news | malwareTHREAT ACTORS -> Lockbit |
Blackcat | Lazarus | VoltTyphoon | KimsukyMALWARE -> CobaltStrike | Qakbot |
Icedid | Trickbot | XmrigSOURCES -> Darkreading | The Cyber Express |
Bleepingcomputer | The Hacker News | Infosecurity Magazine

Home » Blog » Stealthy Fileless Attack Targets Attendees of Upcoming US-Taiwan
Defense Industry Event


 * Cyberattack

 * September 13, 2024


STEALTHY FILELESS ATTACK TARGETS ATTENDEES OF UPCOMING US-TAIWAN DEFENSE
INDUSTRY EVENT

Cyble Research and Intelligence Labs (CRIL) uncovers a campaign targeting the
US-Taiwan Defense Industry Conference, using a malicious file to execute an
in-memory attack, evading detection and exfiltrating sensitive data.


KEY TAKEAWAYS

 * Cyble Research and Intelligence Labs (CRIL) identified a campaign targeting
   individuals connected to the upcoming US-Taiwan Defense Industry Conference,
   as indicated by the lure document uncovered during the investigation.
 * The campaign involves a ZIP archive containing an LNK file that mimics a
   legitimate PDF registration form for deception.
 * When the LNK file is opened, it executes commands to drop a lure PDF and an
   executable in the startup folder, establishing persistence.
 * Upon system reboot, the executable downloads additional content and executes
   it directly in memory, effectively evading detection by the security
   products.
 * The first-stage loader triggers a second-stage loader, which downloads,
   decodes, and compiles C# code in memory, avoiding the creation of traceable
   files on disk.
 * Once the compiled code is executed, the malware exfiltrates sensitive data
   back to the attacker’s server via web requests designed to blend in with
   normal traffic, making detection more difficult.


OVERVIEW

The initial infection vector of this campaign remains unclear; however, based on
the lure document analyzed, there are indications that the attack may have been
delivered to users via spam emails. The attack commences with a suspicious
archive file containing an LNK file disguised as a PDF document. This deception
is designed to trick users into executing the malicious LNK file, which in turn
triggers a series of covert actions in the background.

Upon execution, the LNK file extracts two components: a base64-encoded
executable and the actual lure PDF. The executable is protected using .NET’s
Confuser, an obfuscation tool, to evade detection and is placed in the startup
folder to ensure persistence on the compromised system. Once the executable
runs, it retrieves additional malicious content, specifically a DLL file, from a
remote server. This DLL file is Encrypted using XOR operation to further obscure
its purpose.

The executable employs .NET’s “Assembly.Load” function to load the decrypted DLL
directly into memory, enabling it to bypass traditional security mechanisms that
scan files written to disk. After the DLL is loaded, it downloads encrypted C#
code from the TA-controlled server, compiles it on the victim’s machine, and
then executes it entirely in memory.



During our testing of this malware, we were unable to capture the final payload.
However, analysis of the loader’s code suggests that the payload’s ultimate
purpose is to exfiltrate sensitive data from the victim’s machine to conduct
further malicious activities. Based on the lure document used in this attack, it
is likely that the TA behind this campaign is specifically targeting individuals
associated with the upcoming US-Taiwan Defense Industry Conference.

The figure below shows the infection chain.

Figure 1 – Infection chain


TECHNICAL ANALYSIS

CRIL uncovered a campaign targeting users by posing as registration forms for
the upcoming Conference and distributed malicious ZIP files under the name
“registration_form.pdf.zip”. The ZIP file contains an LNK file disguised as a
PDF. When extracted, the archive presents a file named “registration_form.pdf,”
but this is actually an LNK file with a dual extension (.pdf.lnk), misleading
the user into thinking it is a legitimate PDF document. The malicious LNK file
contains an embedded executable and a lure PDF, both encoded in base64 format,
further concealing the malicious content, as shown in Figure 2.

When the user opens the LNK file, it triggers several background commands.
First, the LNK file searches the base64 embedded content using the “findstr”
command and saving them as “1.txt” and “2.txt,” respectively. Next, the
“certutil” utility decodes these files, storing the lure PDF as ”
registration_form.pdf ” in the Temp directory and the executable as “update.exe”
in the “%AppData%\Roaming\Microsoft\Windows\Start Menu\Programs\Startup” folder,
ensuring persistence. Finally, the registration_form.pdf is opened with the
system’s default PDF viewer. The figure below shows the content of the malicious
LNK file.

Figure 2 – Contents of registration_form.pdf.lnk




LURE DOCUMENT:

The lure document used in this attack suggests that the TA behind the campaign
is likely targeting individuals connected to the upcoming US-Taiwan Defense
Industry Conference, which is scheduled to take place in the United States from
September 22nd to September 24th, 2024.

The potential targets are expected to include key participants such as defense
officials, industry executives, government representatives, and other
stakeholders involved in or attending the event. The timing and focus of the
campaign suggest that the TA aims to exploit the significance of the conference,
potentially for gathering sensitive information to conduct further malicious
activities. This strategic targeting underscores the sophisticated nature of the
campaign and its alignment with geopolitical interests. The figure below shows
the Lure document.

Figure 3 – Contents of the lure document




FIRST STAGE LOADER: UPDATER.EXE

The “Updater.exe” file functions as a loader and is protected using the .NET
“Confuser protector.” It is placed in the Startup folder, ensuring it executes
each time the user logs into the system. Upon execution, the file first verifies
if it is running from the “Startup” directory. If it is, the execution proceeds;
otherwise, it terminates without further action. When the file runs, it sends a
POST request to a compromised site controlled by the TA, transmitting the
victim’s machine.

Next, using “WebClient”, it downloads string content from
“hxxp://tdea.com.tw/asset/uploads/files/68679813[.]txt” and removes the first
character to retrieve the correct base64-encoded content. This reveals the

 1. machine name: “MSEDGEWIN10″
 2. URL for the 2nd stage loader:
    “hxxp://tdea.com.tw/asset/uploads/files/68679815[.]txt“

The first-stage loader downloads a base64-encoded data stream from the above
URL, which is first decoded and then further processed by applying an XOR
operation using a hardcoded key with a decimal value of 16. This operation
results in the extraction of a DLL file. The below shows the decryption loop
used for getting the DLL file.

Figure 4 – Decryption Loop



The extracted DLL is then dynamically loaded and executed using the .NET
“Assembly.Load” function, allowing the TA to invoke malicious functionality
embedded within the DLL. The below figure shows how the “Assembly.Load” function
is used to load the decrypted DLL and call a specific method named “MyEntry”
with in a class named “ConsoleApp.MyClass”

Figure 5 – 1st stage loader




SECOND STAGE LOADER

The “.NET Assembly.Load” function is used to load the second-stage loader, which
functions similarly to the initial stage. This DLL loader retrieves additional
base64-encoded content from the TA’s controlled server. Once the content is
downloaded, it is decoded using base64 and then processed with an XOR operation
using a hardcoded key of 48 in decimal, as shown below.

Figure 6 – Decryption loop



Although the URL “hxxp://tdea.com.tw/asset/uploads/files/68679811[.]txt”
currently doesn’t contain any data, code analysis indicates that the decoded
content is likely XML data containing C# code and assembly references (DLLs)
which utilizes “Compile After Delivery” technique to compile the source code
during runtime.

Figure 7 – Code snippet downloading XML data




IN-MEMORY EXECUTION

The downloaded C# code is compiled in memory using specific compiler parameters
such as “GenerateExecutable = false” and “GenerateInMemory = true”. These
parameters, along with references to core assemblies like “System.dll”,
“System.Data.dll”, and “System.Management.dll”. The “System.Management.dll” is
specifically used to interact with Windows Management Instrumentation (WMI),
allowing the code to query system properties and interact with system components
through WMI queries. This suggests that the TA may use WMI queries to gather
system information from the victim.  

Additional DLLs may also be included as reference assemblies. The compiled code
is executed directly in memory, bypassing the disk entirely, which complicates
detection by conventional security tools.

This method is highly effective for evasion. It allows malware or APT groups to
dynamically generate and execute payloads at runtime, making detection and
mitigation efforts significantly more challenging for defenders. The figure
below shows a code snippet responsible for compiling the downloaded C# code and
executing it in memory.

Figure 8 – Compiling the C# code and executing it in memory




DATA EXFILTRATION

After executing the compiled code, the resulting data is sent back to the TA’s
server using a web request. A “WebClient” object is utilized to upload the data,
where the request’s “ContentType” is set to “application/x-www-form-urlencoded”
to simulate standard form data submission, and the “UserAgent” header is
modified to mimic a web browser. The “UploadString” method is used to send a
POST request to the TA’s specified URL, along with parameters such as a randomly
generated filename, a command flag, and the encoded content being transmitted.

Figure 9 – UploadString method to POST data




NETWORK COMMUNICATION:

The TA leverages a compromised website to host malicious content and frequently
retrieves files stored within an exposed open directory. Moreover, the TA
employs CKFinder, a PHP-based file management framework, to upload and manage
files sent from the victim machines. This framework allows the TA to store
exfiltrated data or additional malicious payloads on the server. The image below
illustrates the structure of the open directory on the compromised site,
highlighting the ease with which the TA can access and manipulate stored files.

Figure 10 – Open Directory




THREAT ATTRIBUTION

Chinese threat actors have a well-documented history of targeting Taiwan,
particularly around significant political events. For instance, during the
period leading up to Taiwan’s presidential election earlier in 2024, there was a
marked increase in cyberattacks within the 24 hours preceding the election, as
reported by Trellix. Despite this pattern, the specific TA behind the current
campaign remains unidentified, and we have not been able to link these tactics,
techniques, and procedures (TTPs) to any known threat actor or advanced
persistent threat (APT) group at this time.


CONCLUSION

This sophisticated attack employs social engineering and advanced in-memory
execution techniques to avoid detection. By disguising the LNK file as a
legitimate conference registration PDF and executing payloads dynamically in
memory, the TAs can conduct malicious activities to steal sensitive information
without leaving traces on the disk. Given the timing and context of the
US-Taiwan Defense Industry Conference, this campaign is likely intended to
conduct malicious operations targeting valuable information related to defense
collaborations.


OUR RECOMMENDATIONS

 * Deploy advanced email filtering solutions to block phishing emails and
   suspicious attachments before they reach the end users. Anti-phishing
   solutions that use machine learning or behavior analysis can also identify
   and block malicious campaigns at an early stage.
 * Implement security solutions with advanced threat detection that can monitor
   in-memory execution of code or PowerShell commands. Tools like EDR (Endpoint
   Detection and Response) should be used to detect unusual behavior, such as
   programs compiling and running C# code in memory.
 * Ensure that users have the least privileges required for their roles,
   reducing the risk of malware being able to execute in privileged areas.
 * Application whitelisting or blocking untrusted applications from executing in
   certain directories can also minimize the risk.
 * Monitor outbound network traffic for signs of exfiltration and communication
   with command-and-control (C2) servers, especially encrypted and
   base64-encoded traffic. Use firewalls, IDS/IPS (Intrusion Detection and
   Prevention Systems), and network analysis tools to detect suspicious web
   traffic patterns.


MITRE ATT&CK® TECHNIQUES

TacticTechniqueProcedureInitial Access (TA0001)Spearphishing Attachment
(T1566.001)The ZIP archive containing the LNK file may be delivered via phishing
or spam emailsPersistence (TA0003)Registry Run Keys / Startup Folder
(T1547.001)update.exe added into the Startup folderExecution (TA0002)User
Execution: Malicious File  (T1204.002)Malicious LNK file executed by the user
after extracted from archive file  Defence Evasion (TA0005)Obfuscated Files or
Information: LNK Icon Smuggling (T1027.012)The LNK file uses a PDF file icon,
leveraging the “IconEnviromentDataBlock” to appear as a harmless PDF
document.Defence Evasion (TA0005)Deobfuscate/Decode Files or Information (T1140)
 Certutil is used to decode base64 content.Defence Evasion (TA0005)Obfuscated
Files or Information: Compile After Delivery (T1027.004)CSharp code is compiled
and executed in memoryCommand and Control (TA0011)Data Encoding: Non-Standard
Encoding (T1132.002)  Encrypted file is downloaded from TA controlled
server.Exfiltration (TA0010)Exfiltration Over Alternative Protocol: Exfiltration
Over Unencrypted Non-C2 Protocol (T1048.003)  Exfiltrated data is transmitted
using standard protocol.


INDICATORS OF COMPROMISE (IOCS)

IndicatorIndicator
TypeComments6b1af6be189e31168b8f4eff84cd475eb5d0cbd08e646760fb352165a30cb269SHA-256registration_form.pdf.zip4989882339d745692eabe0a375d8cecd6e7e3af534cd1173d94867b8d069cd7fSHA-256registration_form.pdf.lnk0e07b96c508dfc0e11f119071cca4ec628dae635771532dae7f034ed369591d7SHA-256updater.exedf92e2c56f53c9139da70c5a813b6512df616abd56dc10dc80a625c4512cb7f2SHA-256updater.exee0174968064b45d1b0c255bec351de94bb59852cb7f2e6ac694debbac59acb7aSHA-256d.dll5aaa5a7ef2eaa13e6e4274ccdb3c80251c868043fa51c2ca1e5b556a65d5166c  
           SHA-25668679815.txt531db819d928243bda43997165da1fa3ebda3412e7d9928cb6bd2a8c898a85ae                       SHA-25668679813.txthxxp://tdea.com.tw/asset/uploads/files/68679813[.]txtURLURL
used to get the DLL
linkhxxp://tdea.com.tw/asset/uploads/files/68679815[.]txtURLURL used to get the
DLL
filehxxp://tdea[.]com[.]tw/ckeditor/ckfinder/core/connector/php/connector[.]php?command=SaveFile&type=Files&currentFolder=%2F&langCode=en&hash=f92a86fd96382c5a

URLPOST request to send exfiltrated
datahxxp://tdea.com.tw/asset/uploads/files/68679811[.]txtURLURL used to get the
CSharp (C#) code


RELATED

THE INTRICATE BABYLON RAT CAMPAIGN TARGETS MALAYSIAN POLITICIANS, GOVERNMENT

Read Cyble's Analysis Uncovering the Babylon RAT Campaign Aimed at Inadvertent
Users in Malaysia

September 4, 2024

In "Threat Actor"

VIETNAMESE ENTITIES TARGETED BY CHINA-LINKED MUSTANG PANDA IN CYBER ESPIONAGE 

CRIL analyzes recent attacks by the Mustang Panda APT on Vietnamese entities,
employing tax compliance and education-based lures.

June 10, 2024

In "APT"

CRYPTOCURRENCY LURES AND PUPY RAT: ANALYSING THE UTG-Q-010 CAMPAIGN 

Cyble analyzes the latest UTG-Q-010 campaign, targeting Chinese entities using
an updated DLL loader and the open-source Pupy RAT.

August 14, 2024

In "APT"



Technical Content! Subscribe to Unlock


Sign up and get access to Cyble Research and Intelligence Labs' exclusive
contents


Email
Country
Phone
Unlock this Content




GET THREAT ASSESSMENT REPORT

Identify External Threats Targeting Your Business
Get My Report
Free

Search for your darkweb exposure



Use Cyble's Largest Dark Web Monitoring Engine to Assess Your Exposure. Make
Sure You're Aware of the Risks by Searching Through Our 150,447,938,145 Records!
We Have Over 50,000 Data Breaches, Several Hacking Forums, Conversations
Indexed.

Download Now


Cybercrime Magazine · AI's Impact On Cybersecurity. Microsoft Recall & Beyond.
Beenu Arora, Co-Founder & CEO, Cyble.

Business Email Address*

Type your email…

Subscribe Now

Share the Post:

PrevPreviousMajor ICS Security Flaws Disclosed in LOYTEC, Hughes, and Baxter
Products
NextGitLab Community and Enterprise Editions Receive New Updates to Mitigate
Severe Security Risks Next


RELATED POSTS

CISA ADDS IVANTI CLOUD SERVICES APPLIANCE VULNERABILITY TO KNOWN EXPLOITED
VULNERABILITIES CATALOG (CVE-2024-8190)

September 16, 2024

TOP CYBER THREATS OF THE WEEK: BRUTE FORCE ATTACKS, CVE ATTEMPTS AND MALWARE
INFECTIONS

September 16, 2024


QUICK LINKS

Main Menu

 * Home
 * About Us
 * Blog
 * Cyble Partner Network (CPN)
 * Press
 * Responsible Disclosure
 * Knowledge Hub
 * Sitemap

PRODUCTS

Main Menu

 * AmIBreached
 * Cyble Vision
 * Cyble Hawk
 * Cyble Odin
 * The Cyber Express

SOLUTIONS

Main Menu

 * Attack Surface Management
 * Brand Intelligence
 * Cyber Threat Intelligence
 * Dark Web Monitoring
 * Takedown and Disruption
 * Vulnerability Management

PRIVACY POLICY

Main Menu

 * AmIBreached
 * Cyble Vision
 * Cyble Trust Portal

SCHEDULE A PERSONALIZED DEMO TO UNCOVER THREATS THAT NO ONE TELLS YOU

Book a Demo
© 2024. Cyble Inc.(Leading Cyber Threat Intelligence Company). All Rights
Reserved
Twitter Linkedin Youtube
Request a demo
Upcoming Events
Research Reports
Talk To Sales



START TYPING AND PRESS ENTER TO SEARCH

Begin Search...


DISCOVER MORE FROM CYBLE

Subscribe now to keep reading and get access to the full archive.

Type your email…

Subscribe

Continue reading

Scroll to Top
 

Loading Comments...

 

Write a Comment...
Email Name Website

We use cookies to ensure that we give you the best experience on our website. If
you continue to use this site we will assume that you are happy with it.Ok





Stay ahead in Cybersecurity with Cyble Research. You can unsubscribe at any
time.


AllowCancel


×
We Value Your Privacy
Settings
NextRoll, Inc. ("NextRoll") and our 19 advertising partners use cookies and
similar technologies on this site and use personal data (e.g., your IP address).
If you consent, the cookies, device identifiers, or other information can be
stored or accessed on your device for the purposes described below. You can
click "Allow All" or "Decline All" or click Settings above to customise your
consent regarding the purposes and features for which your personal data will be
processed and/or the partners with whom you will share personal data.
NextRoll and our advertising partners process personal data to: ● Store and/or
access information on a device; ● Create a personalised content profile; ●
Select personalised content; ● Personalised advertising, advertising
measurement, audience research and services development; ● Services development.
For some of the purposes above, our advertising partners: ● Use precise
geolocation data. Some of our partners rely on their legitimate business
interests to process personal data. View our advertising partners if you wish to
provide or deny consent for specific partners, review the purposes each partner
believes they have a legitimate interest for, and object to such processing.
If you select Decline All, you will still be able to view content on this site
and you will still receive advertising, but the advertising will not be tailored
for you. You may change your setting whenever you see the Manage consent
preferences on this site.
Decline All
Allow All
Manage consent preferences