APT Activity
ReportGOVERNMENT ESPIONAGE AND
UNPATCHED VULNERABILITIESApril 2023 – September 2023

(eset):research

ESET APT ACTIVITY REPORTAPRIL - SEPTEMBER 2023 | 2

Contents
Executive summary3

Middle Eastern groups14

Targeted countries and verticals4

POLONIUM15

China-aligned groups5

North Korea-aligned groups 16

Mustang Panda6

Andariel17

FishMonger6

Lazarus17

TA4107

ScarCruft17

GREF7

Kimsuky18

MirrorFace8

Konni18

GALLIUM8

Russia-aligned groups19

DigitalRecyclers8

Sandworm20

TheWizards8

Gamaredon20

PerplexedGoblin8Turla21

Worok9

Sednit21

India-aligned groups 10

Other22

Donot Team11

SturgeonPhisher23

Iran-aligned groups12

Winter Vivern23

MuddyWater13

About ESET24

OilRig13

ESET APT ACTIVITY REPORT

Executive summary

Targeted countries and verticals

China

India

Iran

Middle East

North Korea

RussiaOther

About ESETAPRIL - SEPTEMBER | 3

Executive summary
Welcome to the latest issue of the ESET APT Activity Report!
This report summarizes the activities of selected advanced persistentan unidentified entity in Saudi Arabia, deploying a payload that suggests

groups: DigitalRecyclers, repeatedly compromising a governmental

threat (APT) groups that were observed, investigated, and analyzed

the possibility of this threat actor serving as an access development

organization in the EU; TheWizards, conducting adversary-in-the-by ESET researchers from April 2023 until the end of September 2023.

team for a more advanced group.

middle attacks; and PerplexedGoblin, targeting another government

In the monitored timespan, we observed a notable strategy of APT

organization in the EU.

groups utilizing the exploitation of known vulnerabilities to exfiltrate

The prime target of Russia-aligned groups remained Ukraine, wheredata from governmental entities or related organizations. Russia-aligned

we discovered new versions of the known wipers RoarBat and

ESET APT Activity Reports contain only a fraction of the cybersecurity

Sednit and Sandworm, North Korea-aligned Konni, and geographically

NikoWiper, and a new wiper we named SharpNikoWiper, all deployed

intelligence data provided to customers of ESET’s private APT reports.

unattributed Winter Vivern and Sturgeon Phisher seized the opportunity

by Sandworm. Interestingly, while other groups – such as Gamaredon,

ESET researchers prepare in-depth technical reports and frequent

to exploit vulnerabilities in WinRAR (Sednit, SturgeonPhisher, andGREF, and SturgeonPhisher – target Telegram users to try to exfiltrateactivity summaries detailing activities of specific APT groups, in the

Konni), Roundcube (Sednit and Winter Vivern), Zimbra (Winter Vivern),

information or at least some Telegram-related metadata, Sandworm

form of ESET APT Reports PREMIUM, to help organizations tasked withand Outlook for Windows (Sednit) to target various governmental

uses this service for active measure purposes, advertising its cyber-protecting citizens, critical national infrastructure, and high-value assetsorganizations in Ukraine, Europe, and Central Asia. Regarding China-

sabotage operations. However, Gamaredon remained the most activefrom criminal and nation-state-directed cyberattacks. Comprehensivealigned threat actors, GALLIUM probably exploited weaknesses ingroup in Ukraine, significantly enhancing its data-collecting capabilities

descriptions of activities described in this document were therefore

Microsoft Exchange servers or IIS servers, extending its targeting fromby redeveloping existing tools and deploying new ones.

previously provided exclusively to our premium customers. Moretelecommunications operators to government organizations aroundinformation about ESET APT Reports PREMIUM and its delivery of

the world; MirrorFace probably exploited vulnerabilities in the Proself

North Korea-aligned groups continued to focus on Japan, Southhigh-quality, strategic, actionable, and tactical cybersecurity threat

online storage service; and TA410 probably exploited flaws in the Adobe

Korea, and South Korea-focused entities, employing carefully crafted

intelligence is available at the ESET Threat Intelligence page.

ColdFusion application server.

spearphishing emails. The most active Lazarus scheme observed was
Operation DreamJob, luring targets with fake job offers for lucrative

ESET products protect our customers’ systems from the malicious

Iran- and Middle East-aligned groups continued to operate at

positions. This group consistently demonstrated its capability to create

activities described in this report. Intelligence shared here is based

high volume, primarily focusing on espionage and data theft frommalware for all major desktop platforms. Finally, our researchers

mostly on proprietary ESET telemetry data and has been verified byorganizations in Israel. Notably, Iran-aligned MuddyWater also targeted

uncovered the operations of three previously unidentified China-aligned

ESET researchers.

ESET APT ACTIVITY REPORT

Executive summary

Targeted countries and verticals

China

India

Iran

Middle East

North Korea

RussiaOther

About ESET

Targeted countries and verticals
TARGETED COUNTRIES AND REGIONSTARGETED BUSINESS VERTICALS

Armenia

Pakistan

Bangladesh

Philippines

Gambling companies and their customers

Central Asia

PolandGovernmental organizations and entities

China

Saudi Arabia

Hosting providers

Czechia

SerbiaIndustrial networks

European Union

Slovakia

IT companies

French Polynesia

South Korea

Local governments and institutions

GreeceTajikistan

Media organizations

GuyanaTürkiye (aka Turkey)

Political entities

Hong Kong

UkrainePrivate companies

IsraelUnited Arab Emirates

Scholars and journalists specializing in North Korea

Japan

United States

Research institutes

KuwaitUyghurs and other Turkic ethnic minorities

Telecommunication operators

Mali

Universities

APRIL - SEPTEMBER | 4

ESET APT ACTIVITY REPORT

Executive summary

China

Targeted countries and verticals

China

India

Iran

Middle East

North Korea

RussiaOther

About ESETAPRIL - SEPTEMBER 2023 | 5

ESET APT ACTIVITY REPORT

Executive summary

Targeted countries and verticals

China

India

Iran

Middle East

North Korea

RussiaOther

About ESETAPRIL - SEPTEMBER 2023 | 6

Mustang Panda FishMonger TA410 GREF MirrorFace GALLIUM DigitalRecyclers TheWizards PerplexedGoblin Worok

Summary of China-aligned APT group activity seen by
ESET Research in April 2023 – September 2023
During the past six months, ESET researchers continued to observe several

Targets first received a spearphishing email with a tracking pixel, enablingbox (see Figure 1) and if the visitor clicks on OK, a Windows executable is

China-aligned APT groups targeting European government organizations,the attacker to know when the target opens the email. A malicious link is

downloaded onto the device.

including Mustang Panda and a group we named DigitalRecyclers. We alsothen sent in a second email. We believe the goal is to identify users who are

observed a governmental entity in Guyana being targeted by a cluster ofmore likely to open phishing emails and target them specifically in order toactivity we named Operation Jacana, a governmental entity in Kuwait andreduce the risk of the payload being reported to IT or security services.

a hosting provider targeted by TA410 and, finally, a watering hole attack by
FishMonger against a Pakistani government website. In the same period,
MirrorFace continued to heavily target Japanese organizations. We also
uncovered a China-aligned APT group, which we named TheWizards, spyingon Chinese speakers in mainland China and abroad using adversary-in-themiddle (AitM) attacks. We also discovered that the Worok APT group has
developed a new Go backdoor that we have named GoFighting.

That malicious link leads to a ZIP archive containing a LNK file that
downloads and executes an HTA script, which then deploys the group’s
classic trident Korplug loader. The only significant difference here beingthat the malicious DLL is written in Nim. While this is the first instance we
could find of Mustang Panda using Nim, it is consistent with the group’s
recent exploration of new programming languages and technology.
Over the last months, we also observed Mustang Panda increasingly relying

Mustang Panda

on Cloudflare to hide its actual C&C and distribution servers.

In August, ESET researchers identified a campaign by Mustang Panda

FishMonger

targeting a governmental organization in Slovakia. There is no indication
leading us to think that this organization was successfully compromised. It
is worth noting that this Mustang Panda spearphishing operation happened
amidst the political campaigns for the Slovak parliamentary elections.

In July, ESET researchers detected a watering-hole attack on a legitimate,but presumably compromised, Pakistani government website. If thevisitor is using a computer, not a smartphone, the script displays an alert

Figure 1. Malicious alert box

The downloaded executable is a backdoor named Trochilus, which iscommonly used by other China-aligned APT groups such as Webworm.
However, the C&C server had typical characteristics of the ShadowPad
servers deployed by FishMonger. Therefore, we believe with medium
confidence that FishMonger is behind this watering-hole attack and is a
Trochilus backdoor user.

ESET APT ACTIVITY REPORT

Executive summary

TA410
The various TA410 subgroups were defined in a
WeLiveSecurity blogpost.
FlowingFrog

Targeted countries and verticals

China

India

This version of LookBack is almost identical to those
we described in our WeLiveSecurity blogpost, while
the Stegmap sample downloads a image containing
the encrypted next stage encoded in the image.

Iran

Middle East

North Korea

RussiaOther

GREF
We recently published a WeLiveSecurity blogpost
documenting two active campaigns targeting Android
users, that we attribute to the GREF group.

About ESETAPRIL - SEPTEMBER 2023 | 7

The campaigns have distributed the Android
BadBazaar espionage code through the Google Play
store, Samsung Galaxy Store, and dedicated websites
representing the malicious apps Signal Plus Messenger
and FlyGram. The threat actors patched the opensource Signal and Telegram apps for Android withIn mid 2023, we observed activity by the FlowingFrog

malicious code that we have identified as BadBazaar,

TA410 subgroup on the server of a US hosting provider.

which has previously been used to target Uyghurs andWe detected samples of the Tendyron backdoor

other Turkic ethnic minorities. Based on our research,that were deployed after the attacker unsuccessfully

potential victims were also lured to install the malicious

tried to deploy multiple Jakarta Server Pages (JSP)

FlyGram app from a Uyghur Telegram group focused

web backdoors. The Tendyron backdoor and multiple

on Android app sharing; see Figure 2.

variations of the JSP web backdoor were transferred to

The purpose of these trojanized apps is to exfiltrate

the server in quick succession.

user data and, specifically in Signal Plus Messenger, toWe believe initial access was achieved by exploiting

spy on victims’ Signal communication. After publishinga known vulnerability, since the affected server

our blogpost, Volexity published a report on three

was running an out-of-date version of the Adobe

Android malware families – BadBazaar, BadSignal, andColdFusion application server.

BadSolar – and attributed them to a group they call
EvilBamboo. More specifically, the BadSignal malware

LookingFrog

family analyzed by Volexity is what ESET has described

ESET researchers observed activity in our telemetry

as trojanized Signal and Telegram applications, with theby the LookingFrog TA410 subgroup on a computer

added malicious code that has the same functionality

belonging to a governmental entity in Kuwait. We

as earlier BadBazaar variants reported by Lookout.

detected a sample of the group’s custom LookBack

In order to avoid confusion: moving forward, we will

implant, along with the Stegmap backdoor and aadopt this naming convention to distinguish between

persistence tool; both of the latter two were previously

the original BadBazaar, and its BadSignal variant, which

attributed to Looking Frog in a blogpost by Symantec.

is delivered via trojanized applications.
Figure 2. Signal Plus Messenger apps on Google Play (left; no longer available), Samsung Galaxy Store (center), and the FlyGram app on Galaxy Store (right)

ESET APT ACTIVITY REPORT

Executive summary

Targeted countries and verticals

MirrorFace
MirrorFace continued with its campaigns targeting Japanese entities
exclusively. In August 2023, we observed an interesting change in theattack vector: instead of compromising an entity via the victim opening a
malicious attachment to a spearphishing email, MirrorFace compromised
an IT company through a vulnerable server. Our analysis of the incident
indicates that the server was most likely compromised through a vulnerable
instance of Proself, an online storage service. Proself released an advisory in
July 2023 stating that its products contained an authentication bypass andzero-day remote code execution vulnerability that had been confirmed to
be already exploited.

China

India

Iran

Middle East

North Korea

United Arab Emirates, and Hong Kong), and against gambling companies

the attackers exploited one or more of the various remote code execution

based outside mainland China. ESET researchers discovered this threat

vulnerabilities discovered in the past few years on these platforms, or

actor when a malicious update was downloaded by a popular, legitimate

reused already deployed webshells in order to deploy their own implants.

Chinese application.

On the compromised systems, GALLIUM deployed mim221, a custom

TheWizards group has capabilities to conduct adversary-in-the-middle

credential theft implant based on Mimikatz.

(AitM) attacks using a custom tool we discovered and have named

DigitalRecyclers
ESET researchers uncovered the activity of a newly identified
cyberespionage group, which we have named DigitalRecyclers, that
Union since 2018, using a toolset originally developed by threat actors fromtime of a research institute. MirrorFace delivered its flagship backdoor

Pakistan in the 2010s.

enriched its toolset repertoire and, besides its in-house developed malware,
MirrorFace has started using publicly available exploitation tools as well.

GALLIUM
During the last six months, ESET researchers have observed GALLIUM

In a recent incident, we were able to determine that the attackers
dropped a first-stage downloader through a Microsoft Exchange web
server accessible from the internet. Interestingly, attackers accessedthe victim’s server using a custom VPN service that is also used by
BackdoorDiplomacy. The use of such custom anonymization networks is
an ongoing trend among China-aligned threat actors.
We believe that DigitalRecyclers is loosely linked to BackdoorDiplomacy andthe wider APT15 family.

compromising telecommunications operators in Mali, Türkiye, and French
Polynesia, and a government organization in Guatemala. We discovered
these campaigns while monitoring implants known to have been usedby GALLIUM in the past, including the recently documented toolset usedduring Operation Tainted Love.

APRIL - SEPTEMBER 2023 | 8

Microsoft IIS servers, all with numerous webshells detected; it’s likely thatthe same trend and once again compromised a vulnerable server, but thisfrp, and a previously undescribed backdoor. This shows that MirrorFace has

About ESET

individuals based in mainland China and abroad (e.g., the Philippines, therepeatedly compromised a governmental organization in the European

EfsPotato, DCOMPotato, FullPowers, Yasso, the customized reverse proxy

Other

Most of the compromised systems are Microsoft Exchange servers or

A few days after the aforementioned incident, MirrorFace continued on

LODEINFO alongside various publicly available exploitation tools such as

Russia

TheWizards
TheWizards is a China-aligned APT group active since at least 2021,
engaging in cyberespionage operations against Chinese-speaking

Spellbinder. This tool uses IPv6 SLAAC spoofing to redirect traffic anddeliver custom malware via software updates by legitimate applications.
The tools developed by this group include two backdoors that we’ve named
WizardNet and DarkNights.
Since gambling is illegal under Chinese law and Chinese citizens thus
turn to foreign online gambling companies, this would explain why
TheWizards group spies on such companies, most likely to identify Chinese
citizens infringing the law. This is not the first time we have witnesseda China-aligned APT group targeting gambling companies: Operation
ChattyGoblin, which we mentioned in our previous APT activity report,
compromised a gambling company in the Philippines by targeting its
support agents.

PerplexedGoblin
ESET researchers recently discovered a government organization in
the European Union being targeted by an APT group we have named
PerplexedGoblin. It uses a backdoor, TurboSlate, that we discovered andnamed in November 2022.
In our T3 2022 APT Activity Report, we mentioned the discovery of thisnew backdoor in a government organization in the European Union; it canESET APT ACTIVITY REPORT

Executive summary

Targeted countries and verticals

be deployed in various ways, including a DLL side-loading chain and a bringyour own vulnerable software (BYOVS) chain. At that time, we attributed
TurboSlate with medium confidence to Goblin Panda. However, after
tracking the threat actor behind TurboSlate for months, we reevaluated our
initial assessment: without a strong enough link between TurboSlate and aknown group, we now track this activity cluster as PerplexedGoblin.

Worok
Worok is a China-aligned cyberespionage group, active since at least 2020,
that targets high-profile companies and local governments mostly in Asia,
which we first documented in a WeLiveSecurity blogpost.
ESET researchers discovered a previously undocumented Go backdoor
that we have named GoFighting and that we attribute to Worok.
GoFighting is a reimplementation of Worok’s PowHeartBeat backdoor
and the GoFighting commands are the same as the ones used by Worok’s
PowHeartBeat backdoor. A noticeable difference from PowHeartBeat is thepresence in GoFighting of a network fallback mechanism based on GitHub.

China

India

Iran

Middle East

North Korea

RussiaOther

About ESETAPRIL - SEPTEMBER 2023 | 9

ESET APT ACTIVITY REPORT

Executive summary

India

Targeted countries and verticals

China

India

Iran

Middle East

North Korea

RussiaOther

About ESETAPRIL - SEPTEMBER 2023 | 10

ESET APT ACTIVITY REPORT

Executive summary

Targeted countries and verticals

China

India

Iran

Middle East

North Korea

RussiaOther

About ESETAPRIL - SEPTEMBER 2023 | 11

Donot Team

Summary of India-aligned APT group activity seen by
ESET Research in April 2023 – September 2023
Donot Team

During the last six months, we noticed most threat
actors in the region moving away from malicious RTF

In the mobile threat landscape, we saw threat actors(Rich Text Format) files and Equation Editor exploits,

increasing their efforts and a continuing evolution

and trying to find new, reliable ways of distributingof threats. Donot Team reportedly managed totheir malware. We detected attempts to use LNK

publish its Android trojan on the Google Play store for(Windows shortcut) files, as well as CHM (Compiled

approximately two months; however, the number ofHTML Help) and HTA (HTML Application) files, withvictims is estimated to be only in the low hundreds.

varying degrees of success. The most prevalent

Speaking of Donot Team, in Q2 and Q3 of 2023 itcompromise vector remains a spearphishing email with

continued its attacks on government organizations,a macro-enabled Office document in the attachment.

mostly in Pakistan and Bangladesh. The group’s yty

Considering the prevalent use of the Zimbra

framework is still being developed, with a steadycollaboration suite in this region, it is no surprise to see

stream of incremental updates.

that frequent phishing attempts targeting governmentorganizations continue (we've documented similar
attacks in this WeLiveSecurity blogpost) in Q2 and Q3of 2023; most of them use free, dynamic DNS services,such as servehttp.com or viewdns.net, both owned
by No-IP. We also have detected repeated phishingattempts imitating the Bangladesh Army Outlook Web
Access portal; see Figure 3.

Figure 3. Phishing page imitating the Bangladesh Army webmail portal

ESET APT ACTIVITY REPORT

Iran

Executive summary

Targeted countries and verticals

China

India

Iran

Middle East

North Korea

RussiaOther

About ESETAPRIL - SEPTEMBER 2023 | 12

ESET APT ACTIVITY REPORT

Executive summary

Targeted countries and verticals

China

India

Iran

Middle East

North Korea

RussiaOther

About ESETAPRIL - SEPTEMBER 2023 | 13

MuddyWater OilRig

Summary of Iran-aligned APT group activity seen by
ESET Research in April 2023 – September 2023
Over the course of Q2 and Q3 2023, ESET researchers continued tracking

C&C servers. The secondary payload, a PowerShell-based backdoor, canIn early July, we observed a new variant of OilRig’s backdoor, Mango, that

Iran-aligned threat groups targeting victims in Israel (OilRig) and Saudi

download and execute arbitrary payloads. It removes the first payload fromwas uploaded to VirusTotal1 by a user in the Netherlands. Five additional

Arabia (MuddyWater). The latter group continues to build and deploy

disk, performs some information gathering on the compromised host, andsamples were submitted within the following week, mostly with thePowerShell-based backdoors with a focus on initial access and data

begins beaconing to the C&C server every 10 seconds.

file path %ALLUSERSPROFILE%\Office356\Menorah. The sample is acollection, possibly as an access development team for a more advanced
group. Finally, OilRig has been observed developing and deploying C++ andC#/.NET backdoors that are generally full-featured backdoors. Initial accessfor OilRig still seems to be via spearphishing emails, particularly whentargeting local governments in Israel – an effort on which OilRig has spentconsiderable time going back to 2021.

OilRigIn April, we observed OilRig deploying a new toolset to several victims in
Israel. The backdoor, OilForceGTX (named after its filename, gtx.exe), is
deployed in C:\ProgramData\NVIDIA GTX\v10.1, a path that mimics
legitimate NVIDIA software. OilRig also deployed two helper DLLs,

MuddyWater

NotifyTrayLib and Nuget_Tools, to the same directory. These DLLs are

In March 2023, prior to the attack on the Israel Institute of Technology

OilForceGTX to evade detection. In conjunction with this discovery, we also(aka Technion) by DarkBit (a joint effort between MuddyWater and an

uncovered a Microsoft Excel spreadsheet with a malicious macro that drops

unidentified group), ESET researchers were tracking the C&C infrastructure

OilForceGTX, along with the original email used to deliver the spreadsheet.

used by DarkBit as MuddyWater’s. After that ransomware attack,Both files were uploaded to VirusTotal by a user in Israel. Based on the

MuddyWater continued well into April to use the same C&C servers

upload location and content, we assess that OilRig was probably targeting

to target an unidentified victim in Saudi Arabia. The initial vector ofa local government institution in Israel, which aligns closely with OilRigcompromise is unknown, but post-compromise activities included theactivity over the past two years.

deployment of a batch script that downloaded a second payload from the1

SHA-1: C9D18D01E1EC96BE952A9D7BD78F6BBB4DD2AA2A

meant to provide runtime support in the form of additional modules for

C#/.NET first-stage backdoor and contains small updates to the first versionof Mango that we discovered in early 2023. Both versions support the same
capabilities, with only small changes in the implementation and constants.
Some interesting changes are the changing of the filename and internalname of the assembly from Mango to Menorah and the modification of thesymbol names throughout the code, probably using an obfuscator/name
generator. The C&C server was updated, but the URL structure, encryption
key, and C&C protocol remained the same.

ESET APT ACTIVITY REPORT

Executive summary

Targeted countries and verticals

China

India

Middle East

Iran

Middle East

North Korea

RussiaOther

About ESETAPRIL - SEPTEMBER 2023 | 14

ESET APT ACTIVITY REPORT

Executive summary

Targeted countries and verticals

China

India

Iran

Middle East

North Korea

RussiaOther

About ESETAPRIL - SEPTEMBER 2023 | 15

POLONIUM

Summary of Middle Eastern APT group activity seen by
ESET Research in April 2023 – September 2023
POLONIUM
POLONIUM continues to field PowerShell-based backdoors, but also uses
Python-based backdoors with a heavy focus on exploiting victims in Israel
for espionage and data theft.
In April, we observed POLONIUM deploying a new backdoor, CreepyPie,
to an unidentified organization in Israel. CreepyPie is a Python script thatconnects to a remote C&C server, receives and executes commands, andsends the output back to the C&C server. The attackers used a short
VBScript to invoke CreepyPie, probably persisting in compromised systems
by executing the VBScript from a scheduled task.
CreepyPie uses the WebSocket protocol to communicate with its C&C
server. Operator command options include taking a screenshot (saved
as GameTools.png) and any command accessible through cmd.exe(with output saved as a plain text file that is misleadingly named
GameTools.dll).
POLONIUM continues to rely on the CreepySnail backdoor to target victims
in Israel. We also saw the group utilize legitimate utilities such as
ntdsutil.exe – a command line tool for managing Active Directory –to dump the Active Directory database. CreepySnail can then be used to
extract such information from the compromised system.

ESET APT ACTIVITY REPORT

Executive summary

Targeted countries and verticals

China

India

Iran

North Korea

Middle East

North Korea

RussiaOther

About ESETAPRIL - SEPTEMBER 2023 | 16

ESET APT ACTIVITY REPORT

Executive summary

Targeted countries and verticals

China

India

Iran

Middle East

North Korea

RussiaOther

About ESETAPRIL - SEPTEMBER 2023 | 17

Andariel Lazarus ScarCruft Kimsuky Konni

Summary of North Korea-aligned APT group activity
seen by ESET Research in April 2023 – September 2023
During the last six months, ESET researchers continued to track the

In general, the attackers’ TTPs still include the easy-to-detect usage

MultiLayerSwap appeared to be a cryptocurrency trading platform offeringdevelopment of several North Korea-aligned threat actors. Andariel andof native Windows command prompt tools in order to perform

instant transfers across different blockchains. However, MultiLayerSwap did

ScarCruft both targeted Japanese institutions, while most of the observed

reconnaissance and lateral movement.

not appear very trustworthy and after a brief examination we concluded

Lazarus activities were associated with the Operation DreamJob cluster.
We also continued to investigate the use of the SimpleTea malware family:
a common code base used by the Lazarus group to create malware for all
major desktop OS platforms: Windows, Linux, and macOS. Finally, Kimsuky
continued its targeting of international scholars and journalists specializing
in North Korea, and Konni remained active in South Korea.

Lazarushighlights Lazarus’s ongoing targeting of cryptocurrency-related entities.

We saw activity mostly belonging to the Operation DreamJob cluster in

We also continued to observe Lazarus using macOS payloads against its

this period. In April 2023, we wrote about new Linux malware, OdicLoader
and SimplexTea, in connection with the infamous 3CX supply-chain attack.
OdicLoader is an ELF downloader responsible for fetching and executing

Andarielthe SimplexTea Linux backdoor from the OpenDrive cloud service. At the

In late May 2023, we observed an attack against an industrial network

backdoor was in fact part of a common Lazarus code base used for allin Japan, conducted by the Andariel group. Various custom tools weremajor desktop platforms: Windows, Linux, and macOS. After discovering

deployed, such as an infostealer we have named Shoplifter, capable

this commonality, we decided to use the SimpleTea name for all malwareof logging keystrokes, stealing clipboard content, and exfiltrating thederived from this common code base, even if there are slight variations infile system structure. Interestingly, the attackers also deployed AutoIt

their functionalities.

malware with very similar capabilities. Finally, we also observed a simple
HTTP downloader capable of retrieving AES-128-encrypted payloads, andSpyXstealer, a custom tool used to steal browser data such as passwords
and credit card information.

2

SHA-1: CB123A197A3BAA8865A3CA2CEE25022D0A578371

3

SHA-1: 744A816A4D9FBC0B358500B25E6F5AFD7B52C718

that it is a copycat of a legitimate cBridge project by CelerNetworks. Thistime, we did not know that the code used to compile the SimplexTea LinuxIn September, a user from Slovenia submitted a new variant of OdicLoader2
to VirusTotal . While the variant discussed in our blogpost was disguised
as an HSBC-themed job offer, this one has a MultiLayerSwap theme.

targets. Samples of SimpleTea for macOS were uploaded to VirusTotal3
from Hong Kong and China, and we also discovered a macOS WebbyTea
downloader. Its associated Python loader has code to pick a payload
according to the OS it is executed on: Windows, Linux, or Darwin (the core
Unix system of macOS). This illustrates again the capability and willingnessof the Lazarus group to attack all major operating systems.

ScarCruft
In this period, ScarCruft continued to target entities in South Korea, butalso in Japan. It still relies on Ruby scripts in some of its campaigns, but also
the RokRAT backdoor.
In September, a ZIP archive containing a malicious LNK file named
Korea National Intelligence Society 2023 Summer Academic

ESET APT ACTIVITY REPORT

Executive summary

Targeted countries and verticals

China

India

Iran

Middle East

North Korea

RussiaOther

About ESETAPRIL - SEPTEMBER 2023 | 18

Conference and 5th National Strategy

files containing BAT and VBS downloaders. Very similar

Colloquium (Final) - Korea's national

compromise chains have also been reported to be usedsecurity and intelligence in a period ofby the other North Korea-aligned APT groups Kimsuky

great transition.lnk was uploaded to VirusTotal4(text in Chinese) and ScarCruft. The campaign’s initialfrom South Korea.

payload filenames mention taxes, salaries, or contracts,
such as 국세청 종합소득세 해명자료 제출 안내.hwp.lnk

Once executed, a decoy PDF is opened (see Figure 4)(machine translation: Information on submitting

and shellcode is downloaded from OneDrive. At thetime of analysis, the server responded with shellcode

comprehensive income tax explanation

containing the RokRAT backdoor, illustrating theand 법인렌탈계약서.txt.lnk (machine translation:materials to the National Tax Service)continuing usage of this backdoor by ScarCruft.

Corporate rental contract).

KimsukyInterestingly, we detected an attempt by Konni toabuse a recent WinRAR vulnerability: CVE 2023-

Kimsuky adjusted its approaches and, like many other38831. A crafted, misnamed ZIP file (wallet_

threat actors, started to utilize tools such as OneNote,

Screenshot_2023_09_06_Qbao_Network.rar)

Compiled HTML Help (CHM), and Windows shortcut

containing a decoy HTML page as well as a malicious(LNK) files in its campaigns. The group also rewrote

executable – a downloader – was uploaded tosome of its malware in Go to evade detections and toVirusTotal5. The decoy document contains screenshots

get the upper hand against security solutions.
Kimsuky’s most notable activity is its continuation of aspearphishing campaign targeting analysts, academic
scholars, researchers, and journalists who focus on
North Korean matters. In this campaign, Kimsuky
impersonates someone from a relevant communityand distributes high-quality spearphishing emails,
in the person’s name, to other selected members ofthat community. This enables Kimsuky to gain thetrust of its targets. Often, Kimsuky continues withthe communication in a predefined way to establish

4

SHA-1: 0105234C9FB904CC4BFD6EC0E1E78163B2F5825C

5

SHA-1: E0795C874BD9BBDF71C10164C483357F759CB41E

Figure 4. Decoy PDF document

rapport with the target. Once a certain point in thecommunication is reached, Kimsuky sends a malicious
attachment or link to the target. The intention is either
to compromise the target’s machine or to harvest
credentials through a fake website mimicking a known
service. The ultimate goal of the campaigns is usually
to gather strategic intelligence.

Figure 5. Decoy document screenshot of a Qbao cryptocurrency wallet
PDF document

Konni
Konni ran several finance-themed campaigns targeting
South Korea. The compromise chain consisted ofspearphishing emails with a link to a ZIP file that
contains a malicious LNK file. If the LNK file is executed,
it runs PowerShell code that extracts both the decoy
document and the actual payload from data appended
to the LNK file. The payloads are commonly CAB or ZIP

of a Qbao cryptocurrency wallet; see Figure 5.

ESET APT ACTIVITY REPORT

Executive summary

RussiaTargeted countries and verticals

China

India

Iran

Middle East

North Korea

RussiaOther

About ESETAPRIL - SEPTEMBER 2023 | 19

ESET APT ACTIVITY REPORT

Executive summary

Targeted countries and verticals

China

India

Iran

Middle East

North Korea

RussiaOther

About ESETAPRIL - SEPTEMBER 2023 | 20

Sandworm Gamaredon Turla Sednit

Summary of Russia-aligned APT group activity seen by
ESET Research in April 2023 – September 2023
During the past six months, ESET researchers continued to observe activity

command line utility for secure file deletion, SDelete (Secure Delete).

of Russia-aligned APT groups mostly targeting Ukraine and EU countries.

The functionality is like the older NikoWiper variant used in October 2022:

These groups include Sandworm, Gamaredon, Turla, and Sednit, withat that time it was used against a company in the energy sector in Ukraine.

Gamaredon being the group most active in targeting Ukraine.

In this variant of NikoWiper, the attackers left the PDB path

Sandworm
In April 2023, CERT-UA published a notification about a cyberattack
conducted by Sandworm against a government institution in Ukraine.
Attackers deployed a malicious BAT script (named RoarBat), which performs
data wiping operations using a legitimate WinRAR application. The script
uses WinRAR.exe in command line mode to move files into an archive, andthen deletes the original files once they have been added to the archive.
In June 2023, we discovered another variant of RoarBat, deployed in a media
organization in Ukraine, which is slightly different: specifically, it targets
media files with extensions such as .drawio, .jfif, .mkv, .avi, .mxf, and.MTS, which are commonly found at media organizations.
In July 2023, we detected two data wiping attacks conducted by Sandworm
using a new version of NikoWiper6. This wiper was deployed against agovernment organization and private companies. It abuses a legitimate

6

SHA-1: BBB7D42ADB6C6F6D3FEE3F80BEBD8CBED7FC3A94

c:\Users\Mykyta\Desktop\prjs\Chelomey\Release\Chelomey.pdb,
which reveals that this malware project is probably named after Vladimir

GamaredonIn the current reporting period, Gamaredon significantly improved its
intelligence collecting capabilities. Specifically, it extended the functionalityof existing tools and developed and deployed new tools to collect evenmore data from compromised computers.

Chelomey, an engineer and designer in the missile program of the former

In April, we discovered a new version of the PteroSteal credential stealer,

Soviet Union. In addition, attackers left a false flag: they used the Ukrainian

which is now capable of stealing credentials, and other information related

given name Mykyta rather than the same Russian name Nikita.

to email accounts, stored by the email clients Outlook and The Bat!.

In August 2023, we detected a new wiper that we named SharpNikoWiper.

In June, we discovered several new tools:

SharpNikoWiper abuses the legitimate SDelete command line utility, as• PteroCookie, which is capable of stealing cookies from Opera, Firefox,

does NikoWiper, but unlike NikoWiper this variant is written in C#, hence
the name SharpNikoWiper. In addition to data wiping using SDelete, thiswiper attempts to rewrite with zeros the first 65,536 bytes of the first ten
connected hard drives , if they exist, by writing directly to\\.\PhysicalDrive<DRIVE_NUMBER>.
During this period, we observed that Sandworm used a pro-Russian
Telegram channel (@solntsepekZ) to promote information aboutcybersabotage operations it had conducted. This Telegram channel
attempts groundlessly to blame CERT-UA and discredit its reputation.

Chrome, and Edge.

• PteroSig, which is designed to exfiltrate information stored by the Signal
desktop application.

• PteroGram, which exfiltrates data from the Telegram Desktop
application.

In August we discovered two new Gamaredon tools. First, PteroBleed isdesigned to exfiltrate IndexedDB data from Opera, Chrome, and Edgebrowsers. This tool specifically looks for data stored in this database by web

ESET APT ACTIVITY REPORT

Executive summary

Targeted countries and verticals

China

India

Iran

Middle East

North Korea

RussiaOther

About ESETAPRIL - SEPTEMBER 2023 | 21

versions of Telegram and WhatsApp applications, and for data that might

for Windows. This vulnerability allows attackers to trigger an NTLM

be used by various Ukrainian military web services. The second tool we

authentication request to an attacker-controlled server by sending a

discovered that month is PteroScout, which is used for reconnaissance. It

specially crafted meeting invite. Initially, this was a zero-day vulnerability

gathers detailed information about the compromised system.

disclosed in March 2023. A newer campaign was targeting organizations in
Ukraine, Poland, and Czechia.

Turla
In July 2023, CERT-UA published a technical analysis of a new implantnamed CAPIBAR that it attributes to Turla. Using ESET telemetry, we wereable to detect the deployment of CAPIBAR not only in Ukraine but alsoin Greece and Guyana. Most victims are governmental entities, a typicaltarget of Turla.
We believe that the initial access vector used to deploy the server
component, acting as a C&C server for other victims, is known RCEvulnerabilities in Microsoft Exchange such as ProxyLogon and ProxyShell.

SednitIn June 2023, we discovered a set of spearphishing campaigns, which we
named Operation RoundPress, exploiting an XSS vulnerability in Roundcube(CVE-2020-35730); see an example in Figure 6. Using this vulnerability,
attackers are able to inject malicious JavaScript code into the victim’s
Roundcube webmail server. The injected code is able to steal emails,
address books, and create forwarding rules to steal incoming emails. This
campaign was also documented by CERT-UA and Recorded Future.
According to our telemetry, Operation RoundPress targets government
staff in Armenia, Tajikistan, and Ukraine.
In August and September 2023, we detected an updated version of
Operation RoundPress spearphishing, exploiting the same XSS vulnerability.

Figure 6. Spearphishing email used in Operation RoundPress

This campaign was targeting organizations in Serbia, Greece, Poland, andUkraine.
In August 2023, we detected a Sednit spearphishing campaign targeting theCVE-2023-38831 WinRAR vulnerability. This vulnerability allows attackers
to execute arbitrary code with WinRAR versions prior to v6.23. According
to Group-IB, it has been used in the wild since April 2023 by crimeware
threat actors against traders. Sednit’s emails used the agenda of theEuropean parliament as a lure (see Figure 7) and targeted political entities
in the EU and Ukraine.
In August 2023, we detected a new set of spearphishing emails used by
Sednit that exploit the CVE-2023-23397 vulnerability in Microsoft Outlook

Figure 7. Targeted phishing using the European Parliament agenda as a lure

In September 2023, CERT-UA published a notification about a Sednit
spearphishing campaign, whose execution chain relies on the user manuallyclicking on a link in the email, which opens an archive, and then executes
a BAT script from that archive. To the best of our knowledge, this was acompletely manual execution chain, relying on the lure to motivate the user
to click on the malicious BAT script.

ESET APT ACTIVITY REPORT

Executive summary

Other

Targeted countries and verticals

China

India

Iran

Middle East

North Korea

RussiaOther

About ESETAPRIL - SEPTEMBER 2023 | 22

ESET APT ACTIVITY REPORT

Executive summary

Targeted countries and verticals

China

India

Iran

Middle East

North Korea

RussiaOther

SturgeonPhisher Winter Vivern

Other notable APT activities
In this section, we review notable activities fromhttps://akn[.]tj/down/Winrar.rar. Then it extracts

groups with as yet unknown alignments.

and executes the next stage contained in this second

SturgeonPhisher
SturgeonPhisher is a cyberespionage group that wearchive: a .NET dropper and a custom Go backdoor wenamed GoBatDoor.

Dear Colleagues,
Due to the planned technical work, theMinistry's mail server https://<redacted>.
gov.ua/ may temporarily not respond to user
requests.

first introduced in our previous APT activity report

Winter Vivern

and that mainly targets governments in Central Asia.

Winter Vivern is a cyberespionage group that wejavascript">eval(atob('<base64-encoded

In that earlier report we mentioned that we observed

mentioned in our previous APT activity report.

payload>'));</script>]:##str_replacement_0##

a decline of SturgeonPhisher activity and we assessed

In particular, it exploited an XSS vulnerability,that the group was busy retooling.

CVE-2022-27926, in the Zimbra portal to target at least[WebResource:<script type=ext/

Best regards,

two different governmental organizations in Europe.

<redacted>

we observed new variants of the group’s Telegram

In late August 2023, we detected a wave of

If the webmail server is vulnerable, JavaScript code willbackdoor, now developed in PowerShell and Go,

spearphishing emails against a Ukrainian governmental

be executed in the context of the browser, leading toin addition to the usual Python variant based on

entity. The email was intended to exploit an XSS

the display of a fake Roundcube login window that

pyTelegramBotAPI.

vulnerability in Roundcube (CVE-2020-35730). Noteexfiltrates to its C&C server whatever credentials athat the same vulnerability is currently being exploited

victim might enter.

This actually happened in the following months andIn late August 2023, SturgeonPhisher jumped on the
WinRAR CVE-2023-38831 vulnerability bandwagon to

by Sednit in Operation RoundPress.

target individuals in Tajikistan. A ZIP archive was sent

The email messages were probably sent fromas an attachment and attempts to exploit the CVE-

a compromised email address; their subject is2023-38831 vulnerability. If it succeeds, or if the user

Important warning on maintenance, and the bodyclicks on the 27885.pdf.cmd file the archive contains,is the following:

additional malware will be downloaded from ​About ESETAPRIL - SEPTEMBER 2023 | 23

ESET APT ACTIVITY REPORT

Executive summary

Targeted countries and verticals

China

India

Iran

Middle East

North Korea

RussiaOther

About ESETAPRIL - SEPTEMBER 2023 | 24

About ESETFor more than 30 years, ESET® has been developing

WeLiveSecurity.com

industry-leading IT security software and services to@ESETresearchdeliver comprehensive, multilayered protection against
cybersecurity threats for businesses and consumers
worldwide. ESET has long pioneered machine learning

ESET GitHub
ESET Threat Reports and APT Activity Reports

and cloud technologies that prevent, detect and respondto malware. ESET is a privately owned company that
promotes scientific research and development worldwide.

© 2023 ESET, spol. s r.o. - All rights reserved.
Trademarks used herein are trademarks or registered trademarks of ESET, spol. s r.o.
All other names and brands are registered trademarks of their respective companies.

(eset):research