APT Threat Landscapein Japan 2020
May 21, 2021
Macnica Networks Corp.
TEAMT5

Copyr ight © 2021 Macnica Net works Corp. and Team T5, Inc. All r ights reser ved.

Although the information contained in this document is based on sources that Macnica Networks has judged to bereliable, Macnica Networks does not guarantee the accuracy of those sources. This document may also include theopinions of the authors, which are subject to change. The copyright of this document is held by Macnica Networks and
TeamT5. Reproduction or redistribution of this document, either in whole or in part, by any means, be it in hard-copy form
or electronically, or by any other method, without the prior consent of Macnica Networks or TeamT5, is prohibited.

Table of contents
Introduction ・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・ 2Timeline of attacks and targeted industries ・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・ 3
Summary of Attacks ・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・ 5
April 2020 (media, think tanks, N/A) ・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・ 5
May 2020 (N/A) ・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・ 6
June 2020 (Manufacturing)・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・ 7
August 2020 (Manufacturing)・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・ 8
October - December 2020 (Multiple manufacturing and IT ser vices) ・・・・・・・・・・・・・・・・・・・・・・・・・・・・・ 8
December 2020 - Februar y 2021 (media, think tanks) ・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・ 9

New TTPs and RATs ・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・ 10
CloudDragon (Kimsuky) ・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・ 10
Attack tools used after intrusion in the A41APT attack campaign ・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・ 12
Targeted attack against national security entity ・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・ 15
Cooperation among threat actors based in China (Sanyo, Tick, Winnti Group) ・・・・・・・・・・・・・ 20
LODEINFO evolving cyber espionage campaign ・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・ 29

Threat actors assessment ・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・ 33
Threat actors’ TTPs (Tactics, Techniques, and Procedures)・・・・・・・・・・・・・・・・ 34
Detection & Mitigation Approach ・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・ 37
Malware deliver y / Intrusion ・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・ 37
Installation / Command & Control (C2) ・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・ 38
Lateral Movement and Exfiltration ・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・ 38

Indicators of Compromise ・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・・ 39

APT Threat Landscape in Japan 2020

Introduction
Since 2014, Macnica Networks has analyzed targeted attacks (cyber espionages) against Japan, led by its
Security Research Center. Unlike ransomware attacks, with these types of cyber espionages, whose aim is tosteal information (personal identifiable information, policy-related information, manufacturing data, etc.),
many organizations remain unaware that they have been compromised over a long period of time.
Additionally, many cyber espionage incidents have not been disclosed in Japan and it is hard to share
relevant information on them effectively.
However, as we analyze the traces of attacks (malwares, infrastructures, logs) that have been collected todate, through the efforts of domestic and international cyber security industries over many years,
Information such as the TTPs, purposes, intentions, and skill levels of threat actors are gradually coming tolight. Such initiatives consist of strategic information-sharing across organizations and the conversion of that
information into intelligence. This is the 5th edition of our research report of cyber espionage against Japan.
Since previous edition, we started to research and write joint reports in collaboration with cyber security
company TeamT5 in Taiwan. Because targeted attacks (cyber espionages) are heavily dependent on
geopolitical risks and tensions between nations, the collaboration with TeamT5 also has great meaning andsignificance in that regard.
This report describes in detail espionage campaigns observed in the 2020 fiscal year (April 2020 to March
2021) that were conducted in attempts to steal confidential information from Japanese organizations.
Focusing mainly on cases involving use of high-stealth remote access trojans (RATs), this report describes
new attack techniques and how such threats can be detected. Lists of the indicators used in the various
attack campaigns described within the report are provided at the end.
As a countermeasure against targeted attacks that gradually undermine the industrial competitiveness ofcompanies, we will continue our efforts in carrying out persistent analysis and awareness campaign.

2

Macnica Net works Corp. and Team T5, Inc.

APT Threat Landscape in Japan 2020

Timeline of attacks and targeted industries
Regarding attack trends in FY2020, as compared to those observed in the previous fiscal year,1 Tick andBlackTech that targeted organizations in Japan were less active in FY2020. On the other hand, there were
two active campaigns which were high possibility link to APT10, one is the campaign using LODEINFO
malware, which mainly targeted entities related with national security, and another is A41APT campaign
which targeted various kinds of industries.

Table 1. FY2020 Timeline of espionage activities
20/04

DarkHotel

20/05

20/06

20/07

20/08

20/09

20/10

20/11

20/12

21/1

21/03

N/A

APT10

Media

Media

（LODEINFO）

Think tanks

Think tanks

Sanyo

Manufacturing（Tonto Team）

Manufacturing

APT10

Manufacturing（A41APT）

CloudDragon

21/02

IT services

N/A（Kimsuky）

DarkSeoul（VSingle）

N/A

As with previous observations, we observed an attack activity thought to be by DarkHotel in first half of thisfiscal year. New things we analyzed are the attack by the CloudDragon (Kimsuky2) and the attack using
VSingle malware 3 by DarkSeoul group against Japan (We attribute the threat actor using VSingle malware is
one of the sub-groups of Lazarus, which is concerned with the attack known as DarkSeoul4). Throughout theyear, numerous attacks targeting media and think tank organizations from the APT10 group using LODEINFO
malware5 were observed.
The A41APT attack campaign6 7 8 attributed to APT10 was also observed, wherein attacks were carried out
with several different payloads (SodaMaster, P8RAT, Cobalt Strike Stager Shellcode, xRAT) loaded on
memory by the same type of loader (DES_Loader). Many industries have been targeted in the campaign
including several manufacturing businesses and IT services.

1 https://www.macnica.net/pdf/mpressioncss_ta_report_2019_4_en.pdf
2 https://yoroi.company/research/the-north-korean-kimsuky-apt-keeps-threatening-south-korea-evolving-its-ttps/
3 https://blogs.jpcert.or.jp/en/2021/03/Lazarus_malware3.html
4 https://www.sans.org/reading-room/whitepapers/critical/tracing-lineage-darkseoul-36787
5 https://blogs.jpcert.or.jp/en/tags/lodeinfo/
6 https://jsac.jpcert.or.jp/archive/2021/pdf/JSAC2021_202_niwa-yanagishita_en.pdf
7 https://securelist.com/apt10-sophisticated-multi-layered-loader-ecipekac-discovered-in-a41apt-campaign/101519/
8 https://www.lac.co.jp/lacwatch/report/20201201_002363.html

3

Macnica Net works Corp. and Team T5, Inc.

APT Threat Landscape in Japan 2020

According to the published information on the A41APT campaign, other targets were government, medical,
and clothing-related organizations, and industries.9 We consider this campaign may have been the mostactive campaign among ones targeting Japan. Although few, we observed the attack using ShadowPad,
which was conducted by Sanyo (Tonto Team10).

NA

IT services

17%

Media

25%

8%

Manufacturing

33%

Think tanks

17%

Figure 1. Pie chart of targeted industries (FY2020)

As the attacks using the LODEINFO malware targeting media and think tank organizations were carried out
throughout the year, the proportion of attacks targeting media and think tanks has become quite large.
Although APT10’s A41APT campaign was observed largely in the manufacturing industry, we recommend to
focus on government, medical, clothing-related industries not included in this chart, too. As to A41APT
campaign targeting medical and clothing-related industries which are not usually targets of APT10,
our analysis currently suggests the possibility of a change in the targeting trend, and the possibility ofspringboards to intrude their true target, attackers have gone after associated companies that were easy tointrude. Even among targeted attacks, we think the A41APT campaign is a class of attack that is particularly
hard to detect. The reason why it is hard to detect is that the actor compromises servers in branch offices or
subsidiaries in foreign countries and the number of compromised servers is very small. Furthermore, malware
communicates with C2 servers via IP addresses instead of domain names and the IP address is unique toeach compromised server. The actor intrudes from the sites which are more vulnerable than head quarter inJapan and it is difficult to detect malicious network traffic with network atomic indicators like IP addresses.
We recommend that these industries described here to use the detection methods described in the latter
half of this document as a reference and assess if branch offices, subsidiaries are not compromised, if
possible.
The attack trend we observed throughout 2020 made us realize again that cyber espionage is a very
difficult problem. It is hard to detect and discover intrusions and it takes much time to detect breaches.
The statistics within this report are just the tip of the iceberg. We hope that the adversaries’ techniques
described in this report will be a useful reference and that help to exercise proper caution.

9 https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage
10 https://blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html

4

Macnica Net works Corp. and Team T5, Inc.

APT Threat Landscape in Japan 2020

Summary of Attacks
Summaries of attacks observed in each month from April to March are described below.

April 2020 (media, think tanks, N/A)
APT10 LODEINFO
Many cases of spear phishing emails were observed targeting media and think-tank-related organizations
with the intention of infecting the targets with the APT10 group’s LODEINFO malware.11 When a malicious
macro in the Microsoft Word file attached to the spear phishing email is enabled, two files, a legitimate
executable file and a side-loading DLL that contains the LODEINFO malware, are written in and executed.
While LODEINFO v0.1.2 was observed in January 2020, in April it was upgraded to v0.2.7 and in June it was
upgraded to v0.3.8. New feature “ransom” which encrypts the file was implemented in v0.3.8 however wehave not observed that the threat actor used this ransom feature and had an impact on the targets as thetime of writing this report.

Figure 2. Ransom function implemented in LODEINFO v0.3.8

DarkHotel
The file uploaded to the public malware repository(SHA256: 9233133a60362d5507dfe84a491ecf29b9b7a8d5c3fab52e1d9accf2f4a678fb) is a Microsoft Word filewith a malicious macro. When the macro is enabled, it creates four scheduled tasks and runs Word
(WINWORD.EXE) processes to inject the PowerShell code into them with parameters passed as arguments.
These spawned Word processes will download two files via injected PowerShell code.

Figure 3. Execution of PowerShell command in Word process

11 https://www.nikkei.com/article/DGXMZO61445290T10C20A7SHB000/

5Macnica Net works Corp. and Team T5, Inc.

APT Threat Landscape in Japan 2020

The following URLs are accessed with fixed User-Agent to download files. Unfortunately, when we analyzed
this sample, we could not get the responses from the URLs.
http[:]//wp.hitominote[.]com/smessr/retouch8.php
http[:]//wp.hitominote[.]com/smessr/favicon.ico?2020
http[:]//nano.toyota-rnd[.]com/cdn/proc1.php
http[:]//nano.toyota-rnd[.]com/cdn/favicon.ico?
User-Agent: Mozila/5.0 (Windows NT 6.1; Win64; x64; rv:72.0) Gecko/20191232 FireFox/72.0
Considering the characteristics such as complex downloader processing and heavy use of a task scheduler,
our analysis suggests that this is an attack similar to one by the DarkHotel in the past.

CloudDragon
A Payload of CloudDragon was uploaded to the public malware repository from Japan in December 2020.
(SHA256: 2fb6cf5003543cb0355eba8f4242f2e34d61106c813b7bfeb5816de0e0d508f1,
C2: rolls-royce-love.890m[.]com) From its compilation date (Sat Apr 11 22:50:54 2020 JST), we think thispayload was used in the campaign around April 2020, and we think there is a possibility that the attack
thought to be targeting South Korea that were reported in March 2020 2 may also have targeted someorganizations in Japan.

May 2020 (N/A)
DarkSeoul VSingle
The file named either NvContainer.exe or sqlsv.exe was uploaded to the public malware repository in May
2020 (SHA256: eb846bb491bea698b99eab80d58fd1f2530b0c1ee5588f7ea02ce0ce209ddb60).
When it runs, it injects the “VSingle.dll” contained in itself into Explorer.exe process. The injected VSingle.
dll file on the memory of Explorer.exe is same with the VSingle malware described in the published blog. 3
This sample communicates with the following URLs.
http[:]//toysbagonline[.]com/reviews
http[:]//purewatertokyo[.]com/list
http[:]//pinkgoat[.]com/input
http[:]//yellowlion[.]com/remove
http[:]//salmonrabbit[.]com/find
http[:]//bluecow[.]com/input

6

Macnica Net works Corp. and Team T5, Inc.

APT Threat Landscape in Japan 2020

Figure 4. Debug symbols and file names seen in VSingle malware

June 2020 (Manufacturing)
APT10 A41APTIn June 2020, we observed APT10 group’s A41APT campaign. The detected file OPENGL32.DLL was a loader
named DES_Loader (also known as Ecipekac, Sig_Loader, and HEAVYHAND), which was loaded by alegitimate executable file, ”waasmedic.exe”, that the attacker placed in the same directory. The payloadthat was subsequently decrypted on the memory of the waasmedic.exe, through multi-stage shellcodes
was SodaMaster6 (also known as DelfsCake, dfls, and DARKTOWN). SodaMaster is the remote access tooland supports “d”, “f”, “l”, “s” commands from C2 server. “d” loads and executes DLL that has been
downloaded from C2 server on the memory. “s” downloads and executes payload related with remoteshell.

Figure 5. The dfls command function implemented in SodaMaster7

Macnica Net works Corp. and Team T5, Inc.

APT Threat Landscape in Japan 2020

August 2020 (Manufacturing)
Sanyo ShadowPad
In August 2020, we observed ShadowPad and we attribute the sample to Sanyo (Tonto Team). The filesecur32.DLL (SHA256:8504c06360f82b01b27aa1c484455e8a6ce9c332d38fe841325521d249514bfa) was
loaded by a legitimate executable file, “iecoupdate.exe”, that the actor placed in the same directory.
This DLL file reads an encrypted payload contained within itself and after decoding it with the 0x56 XOR, it
runs svchost.exe and inject decrypted code into it. Numerous junk codes which calculate unused values areinserted into the decrypted code to hinder code analysis. The payload injected into svchost.exe was
ShadowPad (C2: 101.78.177[.]244:443).

Figure 6. The ShadowPad loader containing a lot of junk code

October — December 2020 (Multiple manufacturing and IT services)
APT10 A41APT
From October through December of 2020, we observed many attacks of A41APT campaign conducted by
APT10 group. The detected samples were DES_Loader observed in June 2020 and legitimate executable files
for DLL Side-Loading. There were other payloads than SodaMaster loaded on the memory, P8RAT6 (alsoknown as GreetCake and HEAVYPOT) and the Cobalt Strike Stager Shellcode, which sends a beacon
disguised as a JQuery request.
Spear phishing emails were not observed for infection vector and the actor exploited the vulnerabilities of
SSL-VPN devices or used the stolen credentials in the past and deployed malwares on the compromised
servers.
The initial version of P8RAT had unique strings inside it, “Set Online Time”, “Set Reconnect Timeout”, whichshowed setting timer behaviors.

8

Macnica Net works Corp. and Team T5, Inc.

APT Threat Landscape in Japan 2020

Figure 7. Characteristic strings seen in early versions of P8RAT

December 2020 — February 2021 (media, think tanks)
APT10 LODEINFO
We observed again many spear phishing email attacks whose goal were to compromise recipients’ devices
with LODEINFO malware. We think these attacks were conducted by APT10 group. The LODEINFO versions
we observed were from v.0.4.6 to v0.4.8. A keylogger function is implemented in v.0.4.6 or later versions.

9

Macnica Net works Corp. and Team T5, Inc.

APT Threat Landscape in Japan 2020

New TTPs and RATs
In this section we will present information, in some details, focusing on observations and analyses not yet
touched on by the published investigative reports previously cited.

CloudDragon (Kimsuky)
The file named backcoor.dll that was uploaded to the public malware repository in December 2020
(SHA256: 2fb6cf5003543cb0355eba8f4242f2e34d61106c813b7bfeb5816de0e0d508f1, C2:rolls-royce-love.890m[.]com) was a payload named Jambog, made by the CloudDragon attack group.
Jambog starts at loaded condition of DllMain() function. According to published information,2 the DLL file isthought to be a remote operation tool that resides on the system after being dropped by spear phishingemail. At the start of processing, it creates a mutex with the IMPOSSIBLE-2 value to avoid multiple launches
on the infected host. It then creates two threads. One is checking whether infected host is a target or not bysending information to the C2 server. The other is communicating with the C2 server, downloading
commands as file, reading and decrypting those files, and then executing the commands obtained
therefrom. It is thought that the C2 communication to check infected host and the one to receive
commands are identified by URL string. When the URL string is “?m=a&p1=<character string comprising thephysical address of the NIC with - removed>&p2=<OS version>_DROPPER”, it is for communication to checkthe target, and when it is “?m=a&p1=<character string comprising the physical address of the NIC with removed>”, it is for downloading command files.

Figure 8. Thread for C2 communication by CloudDragon Jambog

10

Macnica Net works Corp. and Team T5, Inc.

APT Threat Landscape in Japan 2020

The strings such as 8E84AFCB83AD5E894AC0… and 11F583CE40EFC4EB075AA… seen in Figure 8 arereminiscent of hexadecimal numbers. These are obfuscated strings that are decrypted and used after same
XOR decryption. Through their decryption, the C2 server address and the Win32 API function names used bythis malware are obtained. In the decryption, 2 characters of the obfuscated string are treated as 1 byte,
the string is divided into the 2 byte arrays. One is up to the 16 byte and the other is after that. The value
derived from XOR being applied twice in the byte array after the 16 byte will be the decrypted character
string.

Figure 9. CloudDragon Jambog obfuscation decoding

The C2 commands are thought to be as follows: a command to download a DLL for updating and register itby regsvr32.exe to reside in the system as a COM server (1); a command to decrypt the downloaded file,
expand it on the memory, and run it (2); and a command to upload the information files obtained from thesystem (3); the default condition is to create process and upload the results.

11

Macnica Net works Corp. and Team T5, Inc.

APT Threat Landscape in Japan 2020

Figure 10. Remote operation function implemented in CloudDragon Jambog

Considering that, according to published information,2 this has been indicated as a sample with a low
detection rate that appears to be a targeted attack, and considering that this sample is thought to havebeen used in attacks over some time, from April 2020 until its detection and uploading to the public
repository in December 2020, please check for suspicious actions remaining on your network log or host(such as DLL injection in Explorer.exe), also using our analysis as a reference.

Attack tools used after intrusion in the A41APT attack campaign
The file named vmtools.dll that was uploaded to the public malware repository in October 2020 (SHA256:
08eaef6be41244bce8fdc908bee03ec7549197f4fcd7dd0da90a5c14f67e4c4b, C2: 88.198.101[.]58) is a
DES_Loader used for DLL side-loading in ATP10’s A41APT campaign. Attack tools thought to have been used
after gaining access with this sample include arcback.cmd(SHA256: 2926b7faaac641086e979ee8a6de747ed3afcc184a44fa3d621919f19780b2ad)
and svchost.vbs (SHA256: 09e90c178870e72860401300a91a5a12ae84b0bdb639d7d08fc2ff09706460f2).
The arcback.cmd deploys Active Directory information collecting tool csvde.exe from a CAB file encodedwith base64. It is thought that attacker dumps a set of information that can be acquired from domain
controller and put into a csv file.

12

Macnica Net works Corp. and Team T5, Inc.

APT Threat Landscape in Japan 2020

Figure 11. Csvde command implemented in arcback.cmd batch file

Based on this information, it is possible that the attacker finds and moves to another target within theorganization network. Also, the attack campaign has been detected and the attack has ended, theattacker may use information such as department names and email addresses for spear phishing email, etc.
in the next attack campaign. In terms of countermeasures, if performing monitoring with a tool that canrecord commands, such as EDR, because the command argument of csvde is long, verification of csvde
execution from character strings within the argument could be used as a reference for detection. Also,
because attackers tend to implement this kind of tool on hosts that have weak security measures, in order todetect this tool on a remote host, it is considered to monitor suspicious login to the domain controller12(reference material describes the characteristics of the csvde in event log).
Svchost.vbs is a tool that establishes a remote connection to another PC within the organization network
using WMI, allowing the attacker to perform various operations with ease. It is thought that by specifying
interactive remote shell operation (/shell) and a (/cmd) mode to execute a single command in theargument, it allows the attacker to perform remote operation of another host within the network. With a setof 77 commands that can be executed in /cmd mode, this is a remote operation tool with an abundance offunctions, including executing PowerShell and other functions, besides manipulation of files, folders,processes, and registries.

12 https://www.jpcert.or.jp/english/pub/sr/20170612ac-ir_research_en.pdf

13

Macnica Net works Corp. and Team T5, Inc.

APT Threat Landscape in Japan 2020

Figure 12. Part of the 77 commands implemented in svchost.vbs

Among these commands, the check-cyber command is a one to verify installed security products. Although
it primarily checks for US security products, it also includes strings such as “Fujitsu” and “HITACHI”. Checking
for Japanese security tools suggests the attacker’s caution regarding targets.

Figure 13. Security product information collection implemented in svchost.vbs

14

Macnica Net works Corp. and Team T5, Inc.

APT Threat Landscape in Japan 2020

Below is an example of the check-cyber2 (cc2) command being executed on a remote computer and theevent log’s WMI Active Trace being enabled on the side which the command was remotely executed.
Because commands and connection sources are recorded in the event log, these can be used to detectattacks and can be helpful for identifying remote sources.

Figure 14. Event log on the remote side where WMI was executed by svchost.vbs

Targeted attack against national security entity
Unique Defense Evasion Techniques
Around the beginning of April 2020, a malicious document file thought to be targeting organizations or
individuals in Japan was uploaded to the public malware repository. This document file is a downloader that
infects a target with malwares by downloading files from external servers when a macro is enabled.
Although our investigation has not identified the targeted entities, we think that it was aimed atorganizations or individuals involved in national security from the content of the decoy document (thecontent was cloned from a Web article about Japanese national security policy).

15

Macnica Net works Corp. and Team T5, Inc.

APT Threat Landscape in Japan 2020

Figure 15. Decoy document pretending to show the contents when a macro is enabled

Abusing a macro to download files from external servers is itself nothing new, however this attack used two
unique defense evasion techniques.

1. Launching malwares periodically abusing task scheduling functionality
When the macro is enabled, the following 4 tasks are registered.

Table 2. Registered Tasks
E x e c u t e d pro g r a m pa t h

Task nameInterval

GncNet%APPDATA%\GncNet\smssr.exe BoostPC GncSoftware

10 minutes

BoostB2B%USERPROFILE%\BoostPC\b2bClient.exe

16 minutes

BoostPC%USERPROFILE%\BoostPC\BoostPC.exe

30 minutes%APPDATA%\GncSoftware\GncSoftware.exe

30 minutes

GncSoftware

When this technique of regularly running malware via a task scheduler is used, the malwares do not resideon the device. It may not be possible to detect them by the forensic method of obtaining and investigating
the state of the device at that time.

16

Macnica Net works Corp. and Team T5, Inc.

APT Threat Landscape in Japan 2020

2. Process hollowing to evade EDR detection
When attackers want to download and run external files using a macro, they often abuse the PowerShell
pre-installed in Windows OS platform. For this reason, the process tree (process parent-child relationship)that runs cmd.exe from WINWORD.EXE and then runs powershell.exe is suspicious and is easily detected by
EDR products, etc. Possibly for the purpose of evading detection by EDR products, the macro used in thiscase injects the powershell.exe binary codes into spawned WINWORD.EXE processes, and the injected
powershell.exe codes download files from external servers. In this way, it does not appear as though thepowershell.exe has been run from WINWORD.EXE. from the process tree view (Figure 16.)

Figure 16. Process tree of injecting PowerShell codes into spawned word processes

Table 3. External communication destinations
Notes

External communication destination

Downloaded file saved

http[:]//wp.hitominote[.]com/smessr/retouch8.php

as %APPDATA%\GncNet\smssr.exe
Downloaded file saved

http[:]//nano.toyota-rnd[.]com/cdn/proc1.php

as %USERPROFILE%\BoostPC\BoostPC.db

17

Macnica Net works Corp. and Team T5, Inc.

APT Threat Landscape in Japan 2020

The feature of “smssr.exe”, which is downloaded and registered as a scheduled task is to change the fileextensions of files in specific locations, such as “%USERPROFILE%\BoostPC¥”, from db to exe (BoostPC.db ->BoostPC.exe) and makes the above-mentioned registered tasks to run properly.

Figure 17. Smssr.exe code changing file extension

Unfortunately, we could not obtain another file “BootPC.db” at the time of investigating and have not beenable to grasp the whole picture of this attack.

Attribution
We attribute this attack to DarkHotel with low confidence. The first reason is that such this unique techniqueof creating and coordinating multiple tasks was observed in past case which is related with DarkHotel.13

13 https://insight-jp.nttsecurity.com/post/102fmlc/untitled18

Macnica Net works Corp. and Team T5, Inc.

APT Threat Landscape in Japan 2020

Figure 18. Scheduled tasks which was used in 2019 case (possible DarkHotel) and in 2020 caseAlso, one of the destinations in this case, the IP address 111.90.144[.]164, which was associated withnano.toyota-rnd[.]com domain, was managed by a Malaysian VPS operator often used by DarkHotel as its
infrastructure in the past.

Figure 19. DarkHotel infrastructure

Another reason is that national security domain is the one of the targets of DarkHotel.

19

Macnica Net works Corp. and Team T5, Inc.

APT Threat Landscape in Japan 2020

Cooperation among threat actors based in China (Sanyo, Tick, Winnti Group)
ShadowPad
ShadowPad is a modular architecture backdoor that implements functions such as installing, configurationand communication processing in module units. In 2017, Kaspersky discovered ShadowPad embedded in asoftware package of the software vendor NetSarang.14 Initially ShadowPad was thought to be a tool
exclusive to the Winnti group, but from around 2019, it has been observed to be used in activities by otherthreat actors nexus to Chinese-speaking regions, and it is now thought that ShadowPad is a shared tool inthe same way as PlugX15 and Royal Road RTF Weaponizer.16 At the time of writing this report, threat actors
observed to be using ShadowPad are Winnti Group, Sanyo (Tonto Team), an actor using IceFog, Tropic
Trooper (KeyBoy), and Tick.17 ShadowPad execution flow is shown below.

Injection to process memory orother process memory(Process Hollowing)

Legitimate
executable

1 Run

4 Decrypt Root module2
Shellcode

Root

Load
5 Decrypt othermodules
DLL（Loader）

3 Decrypt
Shellcode

InstallConfig

Pulgins

Online

TCP

HTTP

DNS

MemoryShadwowPad Modules

Figure 20. ShadowPad execution flow

ShadowPad is usually encrypted and embedded inside a DLL file. A legitimate executable file is also placedin the same directory where the DLL is. This is a very commonly used defense evasion technique called DLL
Side-Loading. A malicious DLL file is loaded by a legitimate execution file and finally ShadowPad isdecrypted and executed on the memory.

14 https://securelist.com/shadowpad-in-corporate-networks/81432/
15 https://www.blackhat.com/docs/asia-14/materials/Haruyama/Asia-14-Haruyama-I-Know-You-Want-Me-Unplugging-PlugX.pdf
16 https://www.virusbulletin.com/virusbulletin/2020/03/vb2019-paper-attribution-object-using-rtf-object-dimensions-track-apt-phishing-weaponizers/
17 https://www.welivesecurity.com/2020/12/10/luckymouse-ta428-compromise-able-desktop/

20

Macnica Net works Corp. and Team T5, Inc.

APT Threat Landscape in Japan 2020

We described one case in which ShadowPad was used by Tick in our joint report regarding cyberespionages targeting Japan in 2019.1 In 2020, we found ShadowPad in an organization network in Japanand we attribute this ShadowPad to Sanyo (Tonto Team). We describe the details later. As ShadowPad
variants have been observed in other cases, we think it is one of the adversaries’ tools we should be vigilant
of.

Loader Analysis
As the use of ShadowPad has been observed in attacks by several threat actors, it is difficult to determine
who was concerned with the attack only from the obtained samples. On the other hand, there are somecases in which a loader which loads ShadowPad or other RAT on the memory is specific to a threat actor.
This report describes two loaders we are tracking as “OAED Loader” and “Casper”.
1) OAED Loader
This loader is attributed to Sanyo (Tonto Team) and has the following characteristics.
・ Complicates code analysis by meaningless arithmetic operations using instructions such as “add” and“imul”.
・Decoding embedded RAT by single-byte XOR.
・Copies itself into a designated directory and creates persistence (performing service registration or
addition of a RUN registry key depending on an administrator privilege) in first execution.
・Creates and executes a batch file for self-deletion.
・Adds junk code to itself to expand its file size to several dozen megabytes (Binary Padding)・Spawns a legitimate process (such as svchost.exe or iexplorer.exe) and injects RAT code.

Figure 21. Decoding RAT code by XOR

21Macnica Net works Corp. and Team T5, Inc.

APT Threat Landscape in Japan 2020

We observed the OAED loader was used to load ShadowPad to compromise a Japanese organization in
August 2020.
OAED Loader (ShadowPad x64)
SHA256: 8504c06360f82b01b27aa1c484455e8a6ce9c332d38fe841325521d249514bfa
The shellcode decoded on memory contains common anti-assembly technique which calls JMP
instructions, which target the same location consecutively. This is one of ShadowPad’s characteristics incode level.

Figure 22. Anti-disassembly technique

A module of ShdowPad can be added or removed dynamically from remote C2 server. The following
modules were pre-installed in this ShdowPad sample.

22

Macnica Net works Corp. and Team T5, Inc.

APT Threat Landscape in Japan 2020

Table 4. Pre-installed Modules of the ShadowPad
ID

ModuleTime stamp (UTC)

Description

100

Root

Thu 7 May 2020 06:27:45

Initial processing

101

Plugins

Thu 7 May 2020 06:26:13

Module cooperation

102

ConfigThu 7 May 2020 06:26:20

Encrypted string management

103

Install

Thu 7 May 2020 06:27:08

Persistence processing

104

OnlineThu 7 May 2020 06:26:27

C2 server communication processing

200

TCP

Thu 7 May 2020 06:24:09

TCP communication management

201

HTTP

Thu 7 May 2020 06:24:16

HTTP communication processing

202

UDP

Thu 7 May 2020 06:24:22

UDP communication processing

In February 2021, we found the OAED Loader that loads Bisonal, one of the RATs used by Sanyo.
OAED Loader (Bisonal x86)
SHA256: 7db25164885066f32cd8b523a0b0ee9e6bb65e4381352735f618c8ce8ea24004

Figure 23. OAED Loader XOR decoding Bisonal

23

Macnica Net works Corp. and Team T5, Inc.

APT Threat Landscape in Japan 2020

C2 servers domain and port number of Bisonal are encoded by an algorithm using PostScript Type1, which is
described in a published report18.

Figure 24. Bisonal Decoding Algorithm

This Bisonal runs ping command to “mail.ru” for wait timer purpose and disguises dropped files as software
files of Russian security vendor, Dr.Web. This suggests that this Bisonal was probably developed to be used in
Russian speaking regions. Furthermore, this sampled was uploaded to public malware repository from
Lithuania and we think Sanyo used this sample for targeting Lithuanian organizations or individuals.

Figure 25. Wait Timer using ping command

18 https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_3_takai_jp.pdf

24

Macnica Net works Corp. and Team T5, Inc.

APT Threat Landscape in Japan 2020

Figure 26. Files disguised as a Dr.Web-related files

The OAED Loader that loads the RAT Netboy19 used by Tick after infiltrating the internal network of thetargeted organization has also been confirmed. Because of the distinctive debug message left in thesample, we call this RAT “Excute”.
OAED Loader (Excute x86)
SHA256: f32f8ca082b53db965eb91576c3566a7e0ad41f21c79a5a9b54c5be473d9aa5c
Excute is a RAT with rich featured remote commands, such as file manipulation and remote arbitrary
command execution, which has been used since 2008 and continues to be used with version updates.

19 https://gsec.hitb.org/materials/sg2019/D1 COMMSEC - Tick Group - Activities Of The Tick Cyber Espionage Group In East Asia Over The Last 10 Years- Cha Minseok.pdf

25

Macnica Net works Corp. and Team T5, Inc.

APT Threat Landscape in Japan 2020

2)CasperCasper is a loader that is attributed to the Tick. Its code is much simpler than OAED loader because
persistence features like service registration or creating registry key are implemented in the dropper ofCasper. It decrypts embedded code using XOR and bit shift operation (Figure 27).

Figure 27. Casper decryption code

26

Macnica Net works Corp. and Team T5, Inc.

APT Threat Landscape in Japan 2020

Casper (ShadowPad x86)
SHA256: a77b04b1c809c837eafaa44b8457c230fdddd680c88990035439fc9ed2493804
Casper is dropped along with a legitimate file from a separate dropper and is executed by the DLL
Side-Loading technique.
Casper dropper (runcasper)
SHA256: e4ac9f5e4ab6b324e4dbb70feff4a17351c29ebce637d39d5a5197f07dd02b18

Figure 28. Casper (ShadowPad x86) processing flow

This dropper contains the same program database (PDB) path which is described in a published report20
regarding Tick.

Figure 29. PDB (debugging information file) path

20 https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf

27

Macnica Net works Corp. and Team T5, Inc.

APT Threat Landscape in Japan 2020

Thus far, we have described two loaders, OAED Loader and Casper. We think that OAED Loader is shared
between Sanyo and Tick at least. There are published reports regarding the relationships between them.
One is the sharing of C2 servers in 201921 and the another is a common string encryption algorithm in the
ShadowPads used by Tick and Sanyo in 2020, which suggests that the ShadowPad builder is being shared.22
In the past, Sanyo and Tick carried out their activities independently as two separate groups, but now it
appears that they are either working closely together or have reorganized into one group.

BisonalSanyo

Shared by
Sanyo and Tick
ShadowPad

Same
Encryption
Algorithm

OAED Loader

Excute(NetBoy)

Tick

Original
Developer？

ShadowPad

CasperWinntiGroup

Figure 30. Relationships among threat groups from Loaders and loaded RATs perspective

21 https://www.datanet.co.kr/news/articleView.html?idxno=133346
22 https://vb2020.vblocalhost.com/conference/presentations/tonto-team-exploring-the-ttps-of-an-advanced-threat-actor-operating-a-large-infrastructure/

28

Macnica Net works Corp. and Team T5, Inc.

APT Threat Landscape in Japan 2020

LODEINFO evolving cyber espionage campaign
Improving techniques and tools
In 2020, there emerged a campaign targeting media companies and think tanks that deal with mattersrelated to national security and foreign policy with the RAT known as LODEINFO. This activity continues to beobserved in 2021.
The technique used for initial intrusion is to deliver a document file containing a malicious macro by sending
spear phishing email to the target organization, thereby infecting the device that receives the email withLODEINFO.
While continuing to use the conventional tactic of spear phishing, an actor actively continues to improve
defense evasion techniques, such as by setting a password on the document file to evade detection bysandbox products. Other technique is writing a malicious macro which needs human operation to activate
a malicious code (Several buttons need to be pressed after macro is enabled).

Please enter password

Please follow the procedure, that the document bar tells
to see the content of old version of Exel file and press[Modify] and [Next] button.

Figure 31. Evasion techniques to circumvent SandBox detection

An actor also continues to improve the method to launch LODEINFO from the macro. It is thought that this isintended to evade detection by EDR products that detect suspicious processes from the process
parent-child relationships and parameters.

29

Macnica Net works Corp. and Team T5, Inc.

APT Threat Landscape in Japan 2020

Figure 32. Change of the command line for launching LODEINFOThe RAT LODEINFO itself is being actively developed. The version of the sample we observed first was “0.1.2”.
The latest version was “0.4.8” we observed in February 2020.

Figure 33. “ver” command output of LODEINFO v0.4.8

New remote command has been added over the version upgrades.

30

Macnica Net works Corp. and Team T5, Inc.

APT Threat Landscape in Japan 2020

Figure 34. Remote commands for each version

While new remote commands continue to be implemented, there has been a no big change in the C2server protocol. HTTP User-Agent and POST key name are embedded in the sample, which can be used as
network indicators.

Figure 35. User-Agent and POST key name of LODEINFO

31

Macnica Net works Corp. and Team T5, Inc.

APT Threat Landscape in Japan 2020

Operation Assessment
After compromising the device with LODEINFO, the threat actor conducted internal reconnaissance andinformation theft. Because the post-infection activities themselves are performed manually by theoperators, it is possible to minimize the impact by detecting the execution of a malicious macro
immediately, based on a report from the recipient or by an endpoint security product, log monitoring, andquarantining the compromised device from the network. Our analysis of the operators’ activities showedthat the time frame in which communication with the C2 server was established and operators’ activities
was observed. It was mainly between 9:00 and 19:00 (JST, UTC + 9). We think that the operators stop the C2server program outside of the designated hours to prevent its existence from being exposed by external
network scans such as SHODAN and Censys as much as possible. This suggests it is highly likely that theoperators’ base of activities is a region in a time zone just 1 hour behind Japan (UTC + 8).
Although the techniques and skills of threat actor that uses LODEINFO are not so high, they are extremely
active and are continually improving their techniques. The actor using LODEINFO is one of the threat actors
we must be vigilant against in 2021. We think the actor using LODEINFO has relationship with APT10 like its
sub-group as well as A41APT campaign based on our analysis and target industries, malware code
similarities.

32

Macnica Net works Corp. and Team T5, Inc.

APT Threat Landscape in Japan 2020

Threat actors assessment
APT10
menuPass (a.k.a. APT10, Stone Panda) ranked top as the primary threat actor for Japan before the US
indictment23. After that, their fierce and bold attacks stop, but the silent and hidden intrusions remain.
There are two significant campaigns that have high possibility to link to the group:
LODEINFO
Back in early 2020, a campaign abusing LODEINFO was found in Japan. The serial attacks concentrate on
Japan and Taiwan, which matches the target scope of menuPass. Actors behind have been launchingattacks with different version of LODEINFO or combing with other open-source backdoors.
A41APT
A41APT is a China-nexus threat group. In the past two years, the actors have relied on its exclusive malware,
SodaMaster, to attack big corporations in developed countries. The actors of A41APT would carefully
penetrate defending mechanisms by adopting advanced DLL-hijacking skills and setting C2 servers intargeted country. Moreover, based on our further investigation, A41APT has a strong connection to thenotorious Chinese APT group, menuPass.

Kimsuky
The widely acknowledged Kimsuky is also called CloudDragon by us. The group has a broader target scopethan its siblings KimDragon. The group has been observed attacking countries worldwide, including South
Korea, United States, Japan, and several countries in Europe. Moreover, they favor not only government andmilitary industry, but private sectors such as financial institutions and high-tech companies.
CloudDragon owns abundant resource for weapons development. We consider this APT group to be highly
dangerous. In our observations, the group is capable of launching supply chain attack and is developing
malware on other platforms as well.

Figure 36. The relationship between Kimsuky and CloudDragon

23 https://www.fbi.gov/wanted/cyber/apt-10-group

33

Macnica Net works Corp. and Team T5, Inc.

APT Threat Landscape in Japan 2020

Threat actors’ TTPs (Tactics, Techniques, and Procedures)
The TTPs and targeted organizations of each of the threat actors we observed in 2020 are broadly laid out inthe table below. The attack numbers of attack frameworks are listed in MITRE ATT&CK. Please check whether
the product you are using can detect.
*This table was created based on the MITRE ATT&CK framework version 8.24

Attack TTPs

Threat actor
APT10 (LODEINFO)

Targeted organizations

Characteristics of malware delivery:

Media, think tanks

Email attachment file (Office macro)
Exploitation: N/A
Tools/malware used: LODEINFO
C2 communication characteristics:
Fixed User-Agent (same as regular Google Chrome for Windows 10)
ATT&CK:
Phishing: Spearphishing Attachment (T1566.001)
Boot or Logon Autostart Execution:
Registry Run Keys / Startup Folder (T1547.001)
addition to the registry to be executed automaticallyafter the device is rebooted
User Execution:
Malicious File (T1204.002) direction to enable an Office file macro
Signed Binary Proxy Execution: Rundll32 (T1218.011)
Executing a malicious DLL’s file code using a regular file’s rundd32
Application Layer Protocol: Web Protocols (T1071.001)
Communication of encrypted data over the HTTP protocol

APT10 (A41APT)

Intrusion route (exploitation)：SSL-VPN

Manufacturing,Tools/malware used: DES_Loader,SodaMaster,P8RAT,CobaltStrike,xRAT

IT services

C2 communication characteristics: IP address
ATT&CK:
Initial Access External Remote Services (T1133):
intrusion via SSL-VPN vulnerability or stolen accountExecution Command and Scripting Interpreter:
PowerShell (T1059.001) event log deletion
Windows Management Instrumentation (T1047):
collection of services and security products through WMI
Persistence Scheduled Task/Job: Scheduled Task (T1053.005):
residence in the scheduler
Software Discovery: Security Software Discovery (T1518.001)
Privilege Escalation Hijack Execution Flow:DLL Search Order Hijacking (T1574.001): DLL side-loading
Hijack Execution Flow: DLL Search Order Hijacking (T1574.001)
Defense Evasion Deobfuscate/Decode Files or information (T1140)

24 https://attack.mitre.org/versions/v8/

34Macnica Net works Corp. and Team T5, Inc.

APT Threat Landscape in Japan 2020

Indicator Removal on Host: Clear Windows Event Logs (T1070.001):
event log deletion
Credential Access OS Credential Dumping:
Security Account Manager (T1003.002): credential theft
OS Credential Dumping: NTDS (T1003.003)
Discovery Account Discovery: Domain Account (T1087.002)
Domain Trust Discovery (T1482)
Lateral Movement Remote Services: RDP (T1021.001)
Collection Archive Collected Data:
Archive via Utility (T1560.001): data archiving via WinRAR

DarkHotel

Characteristics of malware delivery:

N/A

URL link in email, email attachment file (Office macro)
Exploitation: N/A
Tools/malware used: PowerShell, nameless downloader
C2 communication characteristic: Fixed User-Agent
ATT&CK:
Phishing: Spearphishing Attachment (T1566.001):
spear phishing email, attached Office file containing macro
User Execution:
Malicious File (T1204.002) direction to enable an Office file macro
Scheduled Task/Job: At (Windows) (T1053.002)
Registration of a task to regularly run a malicious file
Process Injection: Process Hollowing (T1055.012)
Running the Word process, writing powershell.exe code on the memory,and downloading external files from the Word process
Application Layer Protocol: Web Protocols (T1071.001)
Communication of encrypted data over the HTTP protocol

Sanyo

Characteristics of malware delivery: N/A

Manufacturing

Exploitation: N/A
Tools/malware used: OAED Loader, Bisonal, ShadowPad
C2 communication characteristics:
Support of various communication protocols such as DNS and HTTP(S)by ShadowPad to make detection by signature difficult
ATT&CK:
Obfuscated Files or Information (T1027)
Extraction of ShadowPad’s loader (DLL) and a legitimate executable
file to load it from own resources
Hijack Execution Flow: DLL Side-Loading (T1574.002)
Installation of ShadowPad’s loader (DLL) and a legitimate
executable file to load it in the device

35

Macnica Net works Corp. and Team T5, Inc.

APT Threat Landscape in Japan 2020

Masquerading: Match Legitimate Name or Location T1036.005
Installation of ShadowPad’s loader (DLL) and a regular execution file
to load it in the same location as legitimate programs
Create or Modify System Process: Windows Service (T1543.003)
Service registration of an executable file to load ShadowPad’s
loader (DLL) so that it continues to be run even after rebooting
Process Injection: Process Hollowing (T1055.012)
Injection of ShadowPad into a legitimate process such as svchost.exe
Application Layer Protocol (T1071)
Communication with C2 with the protocols and port numbers of HTTP(S),DNS, etc.

36

Macnica Net works Corp. and Team T5, Inc.

APT Threat Landscape in Japan 2020

Detection & Mitigation Approach
Malware delivery / Intrusion
In regard to malware delivery, APT10 attack group has in most cases been observed to use a Word file with amacro as an email attachment when delivering LOADINFO malware. Cases of users within companies
actually utilizing macros in Word or PowerPoint files seem to be extremely rare, and so it may be advisable todisable macro settings on all Office products within an organization, other than Excel and Access, etc., via
GPO (Office macro setting via GPO 25). In fact, the number of organizations doing so is increasing.
In regard to intrusion from SSL-VPN devices, which along with spear phishing email, has been seen often insevere breaches. As well as paying attention to vulnerability information distributed by vendors and taking
care to apply appropriate security patches, in cases where intrusion was made when vulnerabilities whereleft remaining, subsequent care thereafter is also necessary. It is thought that when attackers intrude a
device while it is in a state of vulnerability, they also steal information from the device such as credentials
that can be logged on to via SSL-VPN and logon condition settings, and it has been verified that they cancontinue to gain entry even after applying a security patch. For this reason, as well as changing passwords,
it is considered necessary to also change the conditions for multi-factor authentication. Additionally,
because the host of an attacker that has gained entry via an SSL-VPN is not one that belongs to thebreached organization, the host cannot be directly monitored by EDR, etc. It is necessary for organizations
to take appropriate measures with their hosts and networks to enable the detection of any remoteconnections from suspicious hosts and any hosts not managed on the network, etc. Because there have notyet been any observed cases of attackers intruded into an organization by using a host name similar to oneof the organization's own device names, it is thought to be effective to perform monitoring of SSL-VPN device
logon and Windows logon activity to verify whether or not there has been any logon from a remote hostname that is not a host name used by the company (for example, logon from a host such as DESTOP10,
when the company host names are serial numbers starting from JP-00001). If monitoring is being outsourced
to another company, such as an SOC vendor, it may be wise to consider asking if the vendor can perform
this kind of monitoring.
Besides network equipment such as SSL-VPN devices, intrusion from vulnerable servers in a DMZ has also
been observed. Cases of intrusion of overseas group companies where there are no security personnel areespecially noticeable. Among the public assets of overseas offices, there is often use of OS or middleware forwhich support has expired, and many careless port openings, such as RDP (3389/tcp), can be found. It has
become a common practice of attack groups to target the overseas offices of companies because they
are easier to intrude than the headquarters that have implemented security measures above a certain
level. We recommend that companies with many overseas offices, in particular, should take an inventory of
the public assets (network equipment and servers) of all business sites. This includes the process of sorting out
what items from the inventory need to be dealt with, implementing provisional measures (e.g., removal,
patch application, setting changes), and then performing vulnerability diagnosis as necessary (Attack
Surface Management).

25 https://wizsafe.iij.ad.jp/2020/09/1044/

37

Macnica Net works Corp. and Team T5, Inc.

APT Threat Landscape in Japan 2020

Installation / Command & Control (C2)
LODEINFO, A41APT attack campaign samples (SodaMaster, P8RAT, CobaltStrike) and ShadowPad are run by
DLL side-loading, which is loaded together with a legitimate execution file. The DLL file used for side-loading
decrypts encrypted payload within the data section of the DLL file or within a separate file and run it on
memory. Currently, this type of attack can be detected by performing a direct scan of the memory on
which the payload is operating, and technology for diagnosing infection is also advancing. One methodfor detecting targeted attacks is Forensic State Analysis (FSA). Some of the FSA tools are excellent for
detecting payloads on memory, and unlike monitoring with EDR (described below), FSA makes it possible toimmediately identify and understand any intrusion from the current conditions. In APT10’s A41APT attack
campaign, different C2 server IP addresses were observed on each infected host, which is thought to havemade it is not easy to detect on networks.

Lateral Movement and Exfiltration
Currently, the essence of targeted attacks using RATs to steal intellectual property is the operation ofprograms (such as RATs or the WMI tools described in this document) that execute commands remotely, andlegitimate commands will certainly come. The ability to record those commands is a characteristic ofproducts categorized as EDR. With an experts’ monitoring or EDR logs, it is possible to identify remote
operations from the execution status of legitimate commands. Even if the delivery, installation, and C2 TTPs
described in the previous paragraphs are altered, the command execution by remote operation remains
the same, and so not only having records kept by EDR but also having them monitored by experts is
considered an effective security measure.
As there have been many observed cases of the A41APT attack campaign in Japan intruded from theiroverseas offices, it is considered necessary to carry out preparations so that overseas offices can detectattacks with the same security standards as the headquarters in Japan. In lateral movement phase, it ispossible to make early detection of intrusion into Japanese offices from overseas offices via the internal
network by implementing log monitoring of suspicious remote logon and visualization of network
communications by NTA at the Japanese offices. On the other hand, it is also necessary to increase thesecurity level itself in overseas offices and detect attacks at an early stage. It is considered to prompt
overseas offices to take action by presenting recommended measures, performing compromise assessment
using the previously-mentioned FSA, and accelerating the implementation of security measures.

38

Macnica Net works Corp. and Team T5, Inc.

APT Threat Landscape in Japan 2020

Indicators of Compromise
APT10（A41APT）
Indicator

Type

Notes

08eaef6be41244bce8fdc908bee03ec7549197f4fcd7dd0da90a5c14f67e4c4b

SHA256

DES_Loader

2926b7faaac641086e979ee8a6de747ed3afcc184a44fa3d621919f19780b2ad

SHA256csdev

09e90c178870e72860401300a91a5a12ae84b0bdb639d7d08fc2ff09706460f2

SHA256

WMI

88.198.101[.]58

C2

DarkHotel
Indicator

Type

Notes

9233133a60362d5507dfe84a491ecf29b9b7a8d5c3fab52e1d9accf2f4a678fb

SHA256

Malicious
document
file6089b071f3dddb7ae85fc9b835f1fa10594c29a583c3154597a11c9b7bd38783

SHA256Filedownloaded
from externalsource505606e9b6c3e2d05336a95dee0735ea707bb55162ca99177eec359f85a132e6

SHA256

wp.hitominote[.]com

C2nano.toyota-rnd[.]com

C2

Mozila/5.0 (Windows NT 6.1; Win64; x64; rv:72.0) Gecko/20191232 FireFox/72.0

User-AgentFiledownloaded
from externalsource

Fixed

Sanyo
Indicator

Type

8504c06360f82b01b27aa1c484455e8a6ce9c332d38fe841325521d249514bfa

SHA256101.78.177[.]244:443

C2

7db25164885066f32cd8b523a0b0ee9e6bb65e4381352735f618c8ce8ea24004

SHA256

intra.rolesnews[.]com

C2

extra.rolesnews[.]com

C2

39

Notes
ShadowPad x64(OAED Loader)

Bisonal(OAED Loader)

Macnica Net works Corp. and Team T5, Inc.

APT Threat Landscape in Japan 2020

Tick
Indicator

Type

Notes

f32f8ca082b53db965eb91576c3566a7e0ad41f21c79a5a9b54c5be473d9aa5c

SHA256

Excute/Netboy(OAED Loader)

a77b04b1c809c837eafaa44b8457c230fdddd680c88990035439fc9ed2493804

SHA256

ShadowPad x86(Casper)

e4ac9f5e4ab6b324e4dbb70feff4a17351c29ebce637d39d5a5197f07dd02b18

SHA256

Dropper154.223.179[.]14:443

C2

APT10 (LODEINFO)
Indicator

Type

Notes

1cc809788663e6491fce42c758ca3e52e35177b83c6f3d1b3ab0d319a350d77d

SHA256LODEINFO v0.3.2

641d1e752250d27556de774dbb3692d24c4236595ee0e26cc055d4ab5e9cdbe0

SHA256

Document thatdrops LODEINFO
v0.3.58c062fef5a04f34f4553b5db57cd1a56df8a667260d6ff741f67583aed0d4701

SHA256LODEINFO v0.3.5

73470ea496126133fd025cfa9b3599bea9550abe2c8d065de11afb6f7aa6b5df

SHA256

Document thatdrops LODEINFO
v0.3.665433fd59c87acb8d55ea4f90a47e07fea86222795d015fe03fba18717700849

SHA256LODEINFO v0.3.6

3fda6fd600b4892bda1d28c1835811a139615db41c99a37747954dcccaebff6e

SHA256LODEINFO v0.4.6

172.105.232[.]89

C2

130.130.121[.]44

C2

118.107.11[.]135

C2

103.140.187[.]183

C2

103.27.184[.]27

C2

172.105.230[.]196

C2

172.105.232[.]89

C2

139.180.192[.]19

C2

www.amebaoor[.]net

C2

www.evonzae[.]com

C2

167.179.65[.]11

C2

40

Macnica Net works Corp. and Team T5, Inc.

APT Threat Landscape in Japan 2020

CloudDragon
Indicator

Type

2fb6cf5003543cb0355eba8f4242f2e34d61106c813b7bfeb5816de0e0d508f1

SHA256rolls-royce-love.890m[.]com

C2

Notes

DarkSeoul
Indicator

Type

Notes

eb846bb491bea698b99eab80d58fd1f2530b0c1ee5588f7ea02ce0ce209ddb60

SHA256

VSinglehttp[:]//toysbagonline[.]com/reviews

C2

http[:]//purewatertokyo[.]com/list

C2

http[:]//pinkgoat[.]com/input

C2

http[:]//yellowlion[.]com/remove

C2

http[:]//salmonrabbit[.]com/findC2

http[:]//bluecow[.]com/input

C2

41

Macnica Net works Corp. and Team T5, Inc.

Macnica Networks is Value-added distributor in partnership with many
world’s leading companies and providing best cutting-edge
technology solutions with intelligence through experience andresearch over 15 years.
Our portfolio is cyber security, network, AI, DX, etc. and many use
cases of government, academia, enterprises from design tooperational support.
We established Security Research Center and engaged in research
regarding cyber attack, especially targeting Japan and measuresaiming to contribute to cyber security.

TeamT5 is a world-leading malware research team and the bestsolution provider of cyber espionage in Asia Pacific. We monitor,
analyze and track cyber threats, supporting clients to secure theirsystem and network while cyber threats strike. In addition, we also
provide threat intelligence and research reports, cyber espionage
solutions, threat analysis services and incident response / investigation
services.
Our members are frequent speakers in the world's top security conferences,including Black Hat, Kaspersky Security Analyst Summit, Syscan, CodeBlue/AVTokyo, Troopers, Codegate, VXCON/DragonCon, Power ofCommunity (Korea), Hack in the Box, FIRST, etc.

Macnica Networks Corp.
Headquarters
Macnica Building No.2 1-5-5
Shin-Yokohama, Kouhoku-ku, Yokohama, 222-8562 JAPANTEL: +81-45-476-2010
West JapanSales OfficeOsaka Mitsui Bussan Bldg., 2-3-33
Nakanoshima, Kita-ku, Osaka, 530 - 0005 JAPAN
TEL:+81-6-6227-6916
Macnica Networks USA, Inc.
303 Almaden Blvd. Suite 140, San Jose, California 95110
TEL: +1-408 205 7141

May 2021© Macnica Networks Corp.

All other company names and product names mentioned in this report aretrademarks or registered trademarks of the respective companies.

This report is the copyrighted material of Macnica Networks Corp.
Reproducing or copying this document, including images, texts, is prohibited without the express written consent of the copyright holder.