Daniel Osei — SOC Lead & Malware Analyst
Key Takeaways
- The actor behind the recent APT39 campaign utilized sophisticated obfuscation techniques to bypass traditional security measures.
- Initial access was achieved through spear-phishing emails that leveraged social engineering tactics.
- Continuous monitoring indicates the potential for lateral movement through SMB exploits, highlighting the need for refined network segmentation.
Executive Summary
Our investigation into the recent activity attributed to APT39 highlighted a sophisticated attack chain where the adversary displayed a notable level of operational security. Leveraging a combination of social engineering and technical maneuvers, the actor demonstrated a comprehensive strategy to establish footholds within targeted environments while maintaining persistence and seeking to exfiltrate sensitive data. The intricacies involved necessitate a detailed look at each phase of the attack for enhanced understanding and future defense posturing.
Initial Access
The initial access vector employed by APT39 predominantly involved spear-phishing tactics. We observed the use of carefully crafted emails containing malicious attachments that, when opened, executed a dropper identified as AgentTesla. This particular version of the dropper utilized Windows Management Instrumentation (WMI) for its execution, gaining an ability to execute in environments with User Account Control (UAC) enabled.
During the investigation, we analyzed one such email where the subject line was deliberately misleading, pressuring the target to review urgent paperwork. The attachment masqueraded as a PDF file, thus bypassing initial scrutiny. Successful execution resulted in the deployment of the malware to %APPDATA%\Local\Temp, effectively laying the groundwork for further malicious activity.
Execution & Persistence
Once the dropper executed, our analysis revealed it extracted and deployed a secondary payload — a customized variant of Kryptik. This payload was designed for persistence through the modification of the Windows registry at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run with a new key named adb.exe. This ensured that the implant would re-inject into the system upon reboot.
The payload exhibited several tactics to evade detection, including the use of encryption and encoding techniques that made static analysis challenging. The malware was adept at establishing its presence in the environment by manipulating security products and leveraging operational discrepancies.
Command and Control
Command and Control (C2) communications were primarily conducted over HTTPS, utilizing a dynamically generated domain structure to mask operational footprints. We pinpointed the domains utilizing Domain Generation Algorithm (DGA), which made it increasingly problematic for defenders to correlate and identify active C2 endpoints.
During our monitoring, we observed beacons to various domains that were registered with minimal historical data, flagging them as potentially compromised or malicious. The typical interval for these beacons averaged around 30 minutes, and the payloads sent back were often small in size, focused on exfiltrating keystrokes and clipboard data.
Lateral Movement & Discovery
Once the implant established its C2 communications, our investigation indicated that the actor initiated lateral movement attempts. Utilizing Windows Management Instrumentation (WMI) and the built-in PSExec tool, the adversary sought to discover additional systems within the target’s network. This facilitated the propagation of their malware across multiple endpoints, escalating their privileges through credential dumping techniques from the LSASS process.
More concerning was the use of local administrative privileges to disable security software, thereby leaving systems more vulnerable to further exploitation. We linked this behavior to the observed use of the Mimikatz tool during our analysis, reiterating the importance of monitoring for unusual access patterns in these critical processes.
Impact & Objectives
The objectives of the APT39 campaign appeared centered around exfiltration of sensitive information, particularly targeting intellectual property and personal data of high-value individuals within the victim organizations. Our analysis unveiled multiple instances of data transmission to external sources, likely facilitating espionage activities.
Moreover, the potential for further disrupting the victim’s operations was evident, especially given the increased persistence and resilience of the deployed implants. The actor used advanced evasion techniques that underscored a thorough understanding of the operational environment they were targeting, effectively maximizing their chances of success.
MITRE ATT&CK Mapping
- T1566 – Phishing: Initial access through spear-phishing emails with malicious attachments.
- T1059.001 – Command and Scripting Interpreter: PowerShell: Use of PowerShell via scripts for exploitation and lateral movement.
- T1071.001 – Application Layer Protocol: Web Protocols: C2 communication via HTTPS.
- T1035 – Service Stop: Disabling of security services to maintain persistence.
Detection Opportunities
- Monitor for unusual incoming email patterns, especially those containing rich attachments.
- Review system startup for any irregularities in
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Runthat could indicate malware persistence. - Implement behavioral detection for known tools such as PSExec and Mimikatz to catch lateral movement and credential dumping activities.
Analyst Notes
Organizations should invest in simulating phishing attempts and user education to mitigate the risk from social engineering attacks. Furthermore, enhancing visibility into network traffic will enable rapid identification of C2 communications. Lastly, regular audits of the Williams of privilege assignments and necessary reassessments of network segmentation will bolster defenses against lateral movement tactics.
Source: Original Report