Sarah Chen — Malware Reverse Engineer
Key Takeaways
- This analysis details the TTPs utilized by APT37, focusing on their use of spear-phishing for initial access.
- We detailed the communication protocols employed by APT37’s command and control infrastructure.
- Recommendations for detection and response action to prevent APT37’s lateral movement techniques are articulated.
Executive Summary
During the investigation of an APT37 campaign, we observed a clear and systematic approach to target organizations within critical infrastructure and government sectors. The actor leveraged a variety of techniques that aligned with the MITRE ATT&CK framework. Our analysis revealed the use of spear-phishing emails containing malicious attachments that initiated the infection chain. The persistence mechanisms and lateral movement strategies employed throughout the attack were noteworthy, particularly as they demonstrated the actor’s level of sophistication and planning. This report provides a deep dive into each phase of the attack lifecycle, from initial access to exfiltration.
Initial Access
Initial access was achieved through a spear-phishing campaign wherein the actor crafted emails designed to entice the recipient to open an attachment disguised as a legitimate document. The document itself was a PDF containing a malicious macro that, when executed, deployed a dropper, specifically the **Bokbot** variant. This dropper was observed to communicate with the command and control (C2) server shortly after execution, indicating the success of the social engineering tactic. The use of **T1566 – Phishing** is a common technique in this sector, reflecting the enduring effectiveness of phishing as an entry point.
Execution & Persistence
Once the dropper executed, our analysis revealed that it established persistence via registry modification. We identified changes to the registry key at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\, with the entry named **
Source: Original Report