China’s Cyberspies Targeting Southeast Asian Government Entities

A sweeping and “highly active campaign” that originally set its
sights on Myanmar has broadened its focus to strike a number of
targets located in the Philippines, according to new research.

Russian cybersecurity firm Kaspersky, which first spotted the
infections in October 2020, attributed them to a threat actor it
tracks as “LuminousMoth^[1],” which it connected
with medium to high confidence to a Chinese state-sponsored hacking
group called HoneyMyte or Mustang Panda^[2], given its observed
victimology, tactics, and procedures.

About 100 affected victims have been identified in Myanmar,
while the number of victims jumped to nearly 1,400 in the
Philippines, although the researchers noted that the actual targets
were only a fraction of the initial numbers, including government
entities located both within the two countries and abroad.

The goal of the attacks is to affect a wide perimeter of targets
with the aim of hitting a select few that are of strategic
interest, researchers Mark Lechtik, Paul Rascagneres, and Aseel
Kayal said. Put differently, the intrusions are simultaneously
wide-ranging and narrow-focused, enabling the threat acor to siphon
intelligence from high-profile targets.

The infection vector used in the campaign involves sending a
spear-phishing email to the victim containing a Dropbox download
link that, when clicked, leads to a RAR archive that’s designed to
mimic a Word document. The archive file, for its part, comes with
two malicious DLL libraries (“version.dll” and “wwlib.dll”) and two
corresponding executable files that run the malware.

Upon successfully gaining a foothold, an alternative infection
chain observed by Kaspersky leverages removable USB drives to
propagate the malware to other hosts with the help of
“version.dll”. On the other hand, the purpose of “wwlib.dll” is to
download a Cobalt Strike beacon on the compromised Windows system
from a remote attacker-controlled domain.

In some instances, the attacks incorporated an extra step
wherein the threat actor deployed a post-exploitation tool in the
form of a signed-but-rogue version of Zoom video conferencing app,
using it to hoover sensitive files to a command-and-control server.
A valid digital certificate was used to sign the software in an
effort to pass off the tool as benign. Also spotted on some
infected machines was a second post-exploitation utility that
steals cookies from Google Chrome browser.

LuminousMoth’s malicious cyber operations and its possible ties
to Mustang Panda APT may also be an attempt to shift tactics and
update their defensive measures by re-tooling and developing new
and unknown malware implants, Kaspersky noted, thus potentially
obscuring any ties to their past activities and blurring their
attribution to known groups.

“APT actors are known for the frequently targeted nature of
their attacks. Typically, they will handpick a set of targets that
in turn are handled with almost surgical precision, with infection
vectors, malicious implants and payloads being tailored to the
victims’ identities or environment,” Kaspersky researchers
said.

“It’s not often we observe a large-scale attack conducted by
actors fitting this profile, usually due to such attacks being
noisy, and thus putting the underlying operation at risk of being
compromised by security products or researchers.”