APT Activity
Report
IRAN-ALIGNED CYBERATTACKS:RISE IN DISRUPTIVE OPERATIONS
October 2023 – March 2024

(eset):research

ESET APT ACTIVITY REPORTOCTOBER 2023 - MARCH 2024 | 2

Contents
Executive summary3
Attackers and targets4
China-aligned groups 5
Mustang Panda targets the cargo shipping
industry in Europe6

Cyberespionage operation against European
governments18
Russia-Ukraine war18

Other20
SturgeonPhisher21

Activities against Taiwan7

Unlucky Kamran21

Our assessment of the I-SOON leaks7

Winter Vivern22

Middle East-aligned groups 9

About ESET23

BladedFeline10
POLONIUM10
Summary of Iran-aligned APT group activity11
Access brokering11
Impact attacks with wipers and ransomware12

North Korea-aligned groups 13
Supply-chain attacks and trojanized installers14
Evolving attackers’ toolset15

Russia-aligned groups 16
Spearphishing as initial access17

ESET APT ACTIVITY REPORT

Executive summary

Attackers and targets

China

Middle East

North Korea

RussiaOther

About ESETOCTOBER 2023 - MARCH 2024 | 3

Executive summary
Welcome to the latest issue of the ESET APT Activity Report!
This report summarizes notable activities of selected advanced

previous focus on cyberespionage and ransomware, respectively, toby Pakistan, and lastly, we describe the exploitation of a zero-day

persistent threat (APT) groups that were documented by ESET

more aggressive strategies involving access brokering and impact

vulnerability in Roundcube by Winter Vivern, a group we assess to beresearchers from October 2023 until the end of March 2024. The

attacks. Meanwhile, OilRig and Ballistic Bobcat activities saw aaligned with the interests of Belarus.

highlighted operations are representative of the broader landscape of

downturn, suggesting a strategic shift toward more noticeable, "louder"threats we investigated during this period, illustrating the key trends

operations aimed at Israel. North Korea-aligned groups continued

ESET products protect our customers’ systems from the maliciousand developments, and contain only a fraction of the cybersecurity

to target aerospace and defense companies, and the cryptocurrency

activities described in this report. Intelligence shared here is based

intelligence data provided to customers of ESET’s private APT reports.

industry, improving their tradecraft by conducting supply-chain attacks,

mostly on proprietary ESET telemetry data and has been verified bydeveloping trojanized software installers and new malware strains, and

ESET researchers, who prepare in-depth technical reports and frequent

exploiting software vulnerabilities.

activity updates detailing activities of specific APT groups. TheseIn the monitored timeframe, several China-aligned threat actors

threat intelligence analyses, known as ESET APT Reports PREMIUM,

exploited vulnerabilities in public-facing appliances, such as VPNs andfirewalls, and software, such as Confluence and Microsoft Exchange

Russia-aligned groups have focused their activities on espionage

assist organizations tasked with protecting citizens, critical national

Server, for initial access to targets in multiple verticals. Based on thewithin the European Union and attacks on Ukraine. Furthermore,

infrastructure, and high-value assets from criminal and nation-state-data leak from I-SOON (Anxun), we can confirm that this Chinese

the Operation Texonto campaign, a disinformation and psychologicaldirected cyberattacks.

contractor is indeed engaged in cyberespionage. We track a part of theoperation (PSYOP) uncovered by ESET researchers, has been spreading

company’s activities under the FishMonger group. In this report, we also

false information about Russian-election-related protests and theMore information about ESET APT Reports PREMIUM and its delivery

introduce a new China-aligned APT group, CeranaKeeper, distinguishedsituation in Ukrainian Kharkiv, fostering uncertainty among Ukrainiansof high-quality, strategic, actionable, and tactical cybersecurity threatby unique traits yet possibly sharing a digital quartermaster with thedomestically and abroad.

intelligence is available at the ESET Threat Intelligence page.

Mustang Panda group.
Additionally, we spotlight a campaign in the Middle East carried out by
Following the Hamas-led attack on Israel in October 2023, we

SturgeonPhisher, a group we believe to be aligned with the interests

detected a significant increase in activity from Iran-aligned threatof Kazakhstan. We also discuss a watering-hole attack on a regionalgroups. Specifically, MuddyWater and Agrius transitioned from theirnews website about Gilgit-Baltistan, a disputed region administered

ESET APT ACTIVITY REPORT

Executive summary

Attackers and targets

China

Middle East

North Korea

RussiaOther

About ESETOCTOBER 2023 - MARCH 2024 | 4

Attackers and targets
In Asia, the focus of the described campaigns was primarily on government

MirrorFace showed a marked persistence in its attacks on government

targeted government organizations and other verticals. The mostorganizations, non-profit entities such as Tibetan groups or dissidents,

institutions, indicating a specialized focus within this geographical area.

significant attention was directed towards Israel, suggesting a geopoliticaland the engineering and manufacturing sectors. In Japan, China-aligned

Similarly, in the Middle East, threat actors aligned with Iran primarily

motive behind the threat activity in this region.
Europe experienced a more diverse range of attacks from various threat
actors. Russia-aligned groups continued to relentlessly target Ukrainian
infrastructure, with Gamaredon standing out as the most active APT

17%

0%

group operating in Ukraine, and Sandworm focusing on Ukrainian

EuropeAsia

Government
EnergyDefence
Education
Engineering & manufacturing

Government
Engineering & manufacturing
Non-profit
Defence
Education

Americas

AfricaMiddle East

Government
Education
Healthcare
RetailEnergyTelecommunications
International organizations
Government

Government
Engineering & manufacturing
Communications
Non-profit
Educationenergy infrastructure. Russia-aligned groups also expanded their focus
on espionage in the European Union, where China-aligned threat actors
maintain a consistent presence, indicating a continuous interest in
European affairs by both Russia- and China-aligned groups.

4.8%

4.0%

7.1%
32.5%

Russia-aligned APT groups
China-aligned APT groups
Iran-aligned APT groups

12.7%

North Korea-aligned APT groups
Other Middle Eastern APT groups
Other Eastern European APT groups

14.3%

Other Asian APT groups
24.6%

Targeted countries and sectors

Attack sources

ESET APT ACTIVITY REPORT

China

Executive summary

Attackers and targets

China

Middle East

North Korea

RussiaOther

About ESETOCTOBER 2023 - MARCH 2024 | 5

ESET APT ACTIVITY REPORT

Executive summary

Attackers and targets

China

Middle East

North Korea

RussiaOther

About ESETOCTOBER 2023 - MARCH 2024 | 6

Mustang Panda CeranaKeeper Flax Typhoon Operation ChattyGoblin FishMonger I-SOON

Summary of China‑aligned
APT group activity

0

Financial services
Healthcare

Finally, we share our assessment about the I-SOON

Non-profit

between the company, FishMonger, and Operation

variety of verticals. In the campaigns we investigated,

ChattyGoblin.

these groups mostly used one-day vulnerabilities
against a variety of appliances (e.g., VPNs, firewalls) andsoftware (e.g., Confluence, Microsoft Exchange Server)
on internet-facing devices.
In Europe, the Mustang Panda group targeted thecargo shipping industry, deploying Korplug loaders
onto victim's systems. Some of these samples used
DLL search-order hijacking against an outdated version
of Nero WaveEditor and used invalid Authenticode
signatures.

Mustang Panda targets the cargoshipping industry in Europe
In the first quarter of 2024, our team identified
the presence of Mustang Panda’s Korplug loaders
on computer systems belonging to cargo shipping
companies based in Norway, Greece, and theNetherlands, including some that appeared to
be aboard the cargo ships themselves. We werealready familiar with these samples, as they have

We provide below a summary of various

been utilized in previous campaigns, suggesting thatcyberespionage campaigns carried out by China-

Mustang Panda operators are reusing samples across

25

Transportation

Taiwan.

public-facing applications for initial access, targetting a

20

Education

cyberespionage campaigns carried out by China-

leaks that occurred this February and discuss the links

15

Engineering and manufacturing

aligned APT groups against multiple different targets in

China-aligned threat actors predominantly exploit

10

Government

This section provides highlights of variousaligned APT groups tracked by ESET researchers.

5

Dissidents
Political party
Sectors targeted by China-aligned APT groups
05

Exploit of public facing application (T1190)
Replication through removable media (T1091)
Content injection (T1659)
Drive-by compromise (T1189)
Spearphishing attachment (T1566.001)
Supply-chain compromise (T1195)
Initial access techniques used by China-aligned APT groups (with MITRE ATT&CK IDs)

10

15

20

25

ESET APT ACTIVITY REPORT

Executive summary

multiple campaigns. It’s worth noting that in certain

independently, each with its own toolset. They may,

deploy the legitimate SoftEther VPN client and VPN

We believe the leak is authentic. While it’s not possible

instances, the initial dropper appears to have been

however, rely on the same digital quartermaster or

bridge, and establish a persistent VPN connection on

for us to validate every single document, we canlaunched from a USB drive and had filenames such as

have some level of information sharing, which would

compromised systems, allowing them to RDP directly

corroborate enough of the documents as authentic to

Usb Disk(29GB).exe or SONY_8GR.exe.

explain the observed similarities. We will continue toto the compromised systems.

be highly confident in this assessment.

ESET researchers also discovered two undocumented

We can also independently confirm that I-SOON
is indeed a Chinese contractor engaged inmodified version of UPX that prevented their execution.

Activities against Taiwan

Linux backdoors used by Gelsemium (a group that we
documented in a white paper on WeLiveSecurity)

cyberespionage. What we are tracking under theSome of the samples deployed at these cargo shipping

During the last six months, ESET researchers observed

against Linux servers in Taiwan, probably exploiting angroup name FishMonger corresponds to part of thenumerous campaigns carried out by China-aligned

Apache Tomcat vulnerability. One of these backdoors,

company’s activities (note that the link was also

APT groups against various targets in Taiwan, where awhich we named WolfsBane, is a Linux variant of theconfirmed by PwC analysts). While I-SOON is based inold version of Nero WaveEditor. One invalid signaturepresidential election was held this January.

Gelsevirine backdoor. The second backdoor, which we

Shanghai, most of the R&D is located in Chengdu. Thiswas copied from a binary legitimately signed by Klaas

We observed the compromise of the network of a

named FireWood, is connected to Project Wood (whichcity also hosts the infamous Chengdu 404 network

Nekeman. Another sample utilized a signature copied

Taiwanese television broadcasting company that we

we documented in a WeLiveSecurity blogpost),

company, but both should not be mixed. In Octoberfrom a binary legitimately signed by AVG Technologies

attribute with high confidence to the SparklingGoblin

previously used by Gelsemium during Operation

2023, it was revealed that the two companies are

USA, a firm specializing in computer security.

group (which we documented in several publications

TooHash, as documented by G Data.

opponents in a court case. I-SOON’s website is not

A note about the attribution of the recent

on WeLiveSecurity).

TONESHELL campaigns

Flax Typhoon, a group documented by Microsoft,

Since mid-2022, campaigns using a new toolset,

remains very active in Taiwan. During the last six

All working samples were blocked, but others were
non-functional due to them having been packed with acompanies have invalid Authenticode signatures andprobably used DLL search-order hijacking against an

including the TONESHELL backdoor, have been
attributed to Mustang Panda. However, after extensive
analysis, we have decided to track this activity as thework of a separate threat actor that we have named
CeranaKeeper. Despite some similarities, such as
the use of the same DLL hijacking targets and someshared tooling, we are tracking this as a distinct threat
actor due to organizational and technical differences.
Mustang Panda and CeranaKeeper seem to operate

Attackers and targets

Chinatrack and report on both groups.

months we observed Flax Typhoon compromisingmultiple Microsoft Exchange servers and deploying
China Chopper webshells. Even though focused
exclusively in Taiwan, Flax Typhoon’s targeting seems
opportunistic and the victimology is broad: the grouptargeted several government organizations, but alsoa consulting firm, a travel booking software company,
and the pharmaceuticals and electronics verticals.
As mentioned by Microsoft, Flax Typhoon operators

Middle East

North Korea

RussiaOther

About ESET

Finally, considering Linux malware, we observed thetentative deployment of the Linux variant of the Winnti
malware against a computer science department ofa Taiwan university. Unfortunately, since the Winnti
malware is shared among several China-aligned APTgroups, we cannot conclusively attribute this attack.

Our assessment of the
I-SOON leaks
On February 16, 2024, a leak containing internal data of
the I-SOON (Anxun) company was posted on GitHub
at https://github.com/I-S00N/I-S00N/.

OCTOBER 2023 - MARCH 2024 | 7

accessible anymore since the release of the leak, but
it was archived before it was taken offline. On thiswebsite, I-SOON publicly advertised having China’s
Ministry of Public Security as a customer and ofcarrying out offensive and defensive operations.
Interestingly, one IP address mentioned in the leakedchat logs (8.218.67[.]52) was used during Operation
ChattyGoblin – a series of attacks against Southeast
Asian gambling companies that we documented
in our Q4 2022-Q1 2023 APT activity report on
WeLiveSecurity. According to ESET telemetry, thatserver was hosting the web interfaces for the NPS and
Maisui network proxying tools in June 2022. During

ESET APT ACTIVITY REPORT

Executive summary

Attackers and targets

China

Middle East

North Korea

Russiaour research, we could not tie that activity to a known group. In the leaked

Overall, the leak offers an unprecedented view of the internals of the

I-SOON chat logs shown in Figure 1, an employee asks for access to acompany, including some of its products, its HR challenges, its customers,machine, apparently for a third party, and another employee provides theand its victims. Our analysis reveals a few global points:

credentials to log into that server. Note that this dialog also happened inJune 2022.
2022-06-13 07:39:19 user_1: Asking about personal PC accessin Yangzhou
2022-06-13 07:39:23 user_1: Can I give it now
2022-06-13 07:40:26 user_2: 8.218.67[.]52:27011 [account]】
admin [password] 88888888
Figure 1. Extract of I-SOON leaked chat logs (machine translated)

Therefore, we now attribute Operation ChattyGoblin’s activity to I-SOON,
with medium confidence.
The leak offers some interesting perspective on the motivations behindthese attacks against gambling companies. In particular, I-SOON provides
to its customers a platform to investigate gambling cases – gambling is an
illegal activity in the People’s Republic of China – named the Falcon AntiGambling Platform. That platform relies on “backend data of domestic andforeign gambling websites“, according to its leaked documentation, andallows its users to search for data on gamblers and gambling companies.
This very likely explains the purpose of Operation ChattyGoblin: to hackinto gambling companies to exfiltrate data to feed to the Falcon platform.

• I-SOON works mostly for the Chinese Ministry of Public Security(MPS), not only by providing stolen data and ready-to-use malware, butalso by training MPS employees in several provinces.

• I-SOON resells ShadowPad (internal name: SecuritySystem), Winnti

for Linux (internal name: Threadstone), and an unknown Linux implantnamed Hector.

• I-SOON also has iOS and Android implants that are probably related to
the POISON CARP group.

• The list of victims reveals the targeting of universities in Hong Kong in

2019. This is in line with our findings published on WeLiveSecurity. We
initially attributed the incident to Winnti Group but have since revised
our attribution to FishMonger.

Other

About ESETOCTOBER 2023 - MARCH 2024 | 8

ESET APT ACTIVITY REPORT

Executive summary

Attackers and targets

China

Middle East

Middle East

North Korea

RussiaOther

About ESETOCTOBER 2023 - MARCH 2024 | 9

ESET APT ACTIVITY REPORT

Executive summary

Attackers and targets

China

Middle East

North Korea

RussiaOther

About ESETOCTOBER 2023 - MARCH 2024 | 10

BladedFeline POLONIUM MuddyWater OilRig Ballistic Bobcat Agrius

Summary of Middle Eastern
APT group activity
BladedFeline
During the past two quarters, BladedFeline continued
to exploit a governmental organization from theKurdistan region of Iraq. The coding capabilities ofthis group, which has interests that align with Iran,
specifically targeting longtime rival Iraq, display abreadth of skill, deploying payloads written in Python,C#/.NET, and C++, which makes them something of an
oddity amongst Middle East-aligned (and Iran-aligned)groups. The group is also quite proficient in PowerShell
and VBScript, having deployed tools using both in what
are best characterized as well-written scripts that are anotch above other groups in the region.
The group has gone to some lengths to maintain
access to this governmental organization, having
breached it at several layers and reinforcing access byinnovating new backdoors and tunneling applications.
In addition to the governmental organization,

0

1

2

3

4

5

6

7

Government
Engineering and manufacturing
Telecommunications
Communications

BladedFeline also compromised a telecommunications
provider in Uzbekistan. We detected the attack during

Retailthis reporting period; however, the initial compromise

Non-profit

time probably dates back to May 2022. Targeting

Education

this victim is interesting in the timing, particularly if

Financial services

the links to Iran-aligned groups pan out, as Iran has

Transportation

recently been noted to be considering rapprochementwith Central Asian countries. Having followed
Middle Eastern groups for some time, we can say that

Construction
Healthcare

cyberespionage goes hand in hand with diplomaticefforts, particularly when it comes to Iran.

Sectors targeted by Middle Eastern APT groups

POLONIUM
During this reporting period, we observed POLONIUM,

0

Spearphishing link (T1566.002)

continue to be avid Python coders. In November

Fake app (T1444, MITRE ATT&CK v7)

and an exfiltrator to exploit four Israeli organizationsin the technology and social services verticals. The

2

3

Spearphishing attachment (T1566.001)

a threat actor aligned with Hezbollah’s interests,
2023, POLONIUM used a Python backdoor, MegaPy,

1

Exploit of public facing application (T1190)
Initial access techniques used by Middle Eastern APT groups (with MITRE ATT&CK IDs)

4

5

6

7

8

8

ESET APT ACTIVITY REPORT

Executive summary

backdoor uses MEGA and Nextcloud for C&C communications and, for the
exfiltrator, for data storage. An interesting feature of the exfiltrator is that
the WebDAV protocol is used, which is not something we commonly see inmalware communications.
Then in January 2024, POLONIUM deployed an update of its Python
backdoor to construction, manufacturing, and healthcare companies in
Israel. This iterative update employs encrypted payloads with per-victim,
customized content, probably to mask some of the exploit chain fromdefenders and to make tracking more difficult for researchers. During thiscampaign, POLONIUM changed the service providers used for its C&Cs:
Supabase and Backendless. Initial payload hosting was done, in one
particular case, on a typo-squatting domain: yutube.com[.]de.

Attackers and targets

China

Middle East

North Korea

RussiaOther

About ESETOCTOBER 2023 - MARCH 2024 | 11

MuddyWater OilRig Ballistic Bobcat Agrius

Summary of Iran-aligned
APT group activity
ESET researchers, while tracking Iran-aligned threats, have observed

Although, in that timeframe, we did see Ballistic Bobcat employing TTPsa sharp uptick in activity following the attack on Israel on October 7,

we associate with MuddyWater, including the use of remote access tools

2023. The increased activity has been focused on two primary pursuits:(RemCom), PowerShell scripts, and manual operator command line

access brokering, typified by access development immediately followed

execution of a variety of commands. Overall, we assess that a great manyby credential theft; and, subsequent attacks seeking to damage, destroy,

Iran-aligned threat actors have shifted focus to support efforts to attack

or otherwise harm organizations, with the occasional name-and-shame

Israel with loud attacks and have largely eschewed quieter operations.

post-impact activity on social media. Commensurate with the uptick inoperational tempo has been a marked decline in attack efficacy and overall
quality of operations and tooling (particularly with MuddyWater, which has
not historically been a powerhouse in APT circles).

Access brokering
The group doing the bulk of the yeoman’s work in this area is, perhaps
unsurprisingly, MuddyWater. The primary initial access method has

This increase in operational tempo and focus on access brokering inbeen phishing emails with maliciou link that, when clicked, download a

conjunction with impact malware has likely led to a decrease in typicalremote access tool (RAT), also referred to as a remote management andcyberespionage. We have noted a downturn in OilRig activities, beginningmonitoring (RMM) tool. A less seen but equally successful initial accessin November and culminating in December. Since then, OilRig has beentactic is a phishing email with an attached document that includes a

unusually quiet, whereas we would typically expect to see the group

malicious link that, when opened, downloads the same or similar RAT/

updating existing tooling to maintain previously established accesses

RMM. This extra step was only adopted by MuddyWater at the end of Q1and deploying new, often novel, malware to target mostly governmental

2024, probably to evade defenders from blocking the previously employed

entities in the Middle East – with a heavy focus on Israel.

method that was publicly reported by Proofpoint.

Ballistic Bobcat, which also has generally been a steady purveyor of

In addition to MuddyWater, we also observed Agrius both attempting

malware, also seemed to wind down operations in September and October.

access brokering activities and deploying impactful malware to victims inESET APT ACTIVITY REPORT

Executive summary

Attackers and targets

China

Middle East

North Korea

RussiaOther

About ESETOCTOBER 2023 - MARCH 2024 | 12

Israel. This represents a departure from typical Agrius activity, which has

pivoted on the Linux version to find a Windows variant. It is not clear to us

Bushnell as a talking point supporting Iranian interests. It follows that

historically been focused on wipers, ransomware, or some variation of thewhether any of the aforementioned access brokering was used to facilitategroups with interests aligned with Iran would also use Bushnell’s name.

two, without any credential theft endeavors.

access to victims, as we did not see any victims with ESET software

Subsequent to the initial access, MuddyWater has employed a variety

installed.

While we cannot definitively state that access broker operations wereinvolved in this last wiper attack, it does seem highly plausible based on theof tools and techniques attempting to obfuscate C&C servers. TypicalThe second occurrence took place at roughly the same time. Agrius

suddenness of the attack (carried out over two days), and the large number

RATs/RMMs include Atera, SimpleHelp, and TacticalRMM. Beyond that,

deployed a wiper to victims in Israel in the communications verticalof victims with seemingly no indicators of compromise leading up to thethough, MuddyWater operators have literally been scraping GitHub and(among others we could not identify). Palo Alto and the Israeli CERT eachwiper’s deployment.

the internet for any and all tooling they can find that offers reverse-shell-published an article about this attack. The version of the wiper observed inlike capabilities. Aside from old MuddyWater staples like Ligolo, frp, andour telemetry is a BIOS wiper based on the Red Petya wiper. Perhaps more

Venom, they have also used Bore, GoSocks5, Koblas, rathole, ReSocks,

interesting than the wiper, though, is the use of a modified version of Plink

ReSocks-5 (in C++ and Go), Revsocks, and Yamux. Many would-be victims

that Agrius used like a reverse tunnel: it requires base64-encoded runtime

received more than a handful of these tools, which were quite often

arguments. In addition, Agrius also deployed several LSASS dumpers

blocked by ESET software…leading to several comical instances of operators

to victims before deploying the wiper, likely to add access brokering forattempting to execute the same tools repeatedly.

future attacks. One additional tidbit we saw is that both Agrius (during

Finally, MuddyWater deployed additional tooling to establish persistence(occasionally) and gather credentials. For the former, MuddyWater

this incident) and Ballistic Bobcat (in previous attacks) have used the same
SQL dumping tool, perhaps indicating tool sharing across these previously

continued looking for resources on the internet, including AutodialDLL

unlinked groups.

(which was publicly reported on by Palo Alto). As to the former,

The final occurrence was in March 2024 and was perpetrated by an as-

MuddyWater deployed an LSASS dumper disguised as 7-Zip and a credential

yet-unattributed group with goals that coalesce with Iran-aligned threat

stealer masquerading as a Java update. In several cases, MuddyWater

actors. The wiper targeted at least 19 organizations in Israel over a wideused a tool, RunPEinMemory, to attempt to bypass ESET security toolingrange of verticals. The group’s TTPs align with other Iran-aligned groups,(unsuccessfully) by loading malware into memory, then executing it.

most notably MuddyWater, in that several remote access tools were used

Impact attacks with wipers and ransomware
We observed three distinct impact attacks (e.g., wipers, ransomware)
during this period. The first occurred at the end of October, which we
dubbed BiBiGun Wiper, based on the file extension that was used to
overwrite files (.bibi). Initially reported by Security Joes, we quickly1

SHA-1: C9D18D01E1EC96BE952A9D7BD78F6BBB4DD2AA2A

to drop files on victim systems, including AnyDesk, N-Able, and UltraVNC.
Additionally, the string AaronBushnell is included in all wiper samples
discovered. Aaron Bushnell was an enlisted member of the United States
Air Force prior to his self-immolation in front of the Israeli embassy inWashington, DC on February 25, 2024. In the days following his death,many pro-Iranian figures – including Ayatollah Ali Khamenei – have used

ESET APT ACTIVITY REPORT

Executive summary

Attackers and targets

China

Middle East

North Korea

North Korea

RussiaOther

About ESETOCTOBER 2023 - MARCH 2024 | 13

ESET APT ACTIVITY REPORT

Executive summary

Attackers and targets

China

Middle East

North Korea

RussiaOther

About ESETOCTOBER 2023 - MARCH 2024 | 14

Andariel Lazarus ScarCruft Kimsuky Konni

Summary of North Koreaaligned APT group activity
0

In the current reporting period period, we noticed

in December 2023. We also detected activity ofseveral interesting trends. All groups continued todifferent Kimsuky clusters worldwide.

improve their tradecraft by either developing new
malware strains or using techniques successfully usedin the past by North Korea-aligned groups.

The primary compromise vector remains spearphishing.
Lazarus continued using fake job offers in its Operation
DreamJob, whereas ScarCruft and Konni often used

Lazarus continued to target aerospace and defense

cryptocurrency, Know Your Customer, or businesscompanies, with the presumed goal of espionage.

agreement lures, to target selected individuals. Andariel

At the same time, we noticed that Lazarus appears

used several publicly disclosed vulnerabilities in web

to be putting a larger effort into targeting theapplications as the initial access vector.

cryptocurrency industry, both organizing crypto
heists and compromising developers working on
cryptocurrency projects. According to a Microsoft
report, cryptocurrency worth between $600 million
and $1 billion was stolen by North Korea-aligned threat
actors in 2023.
Both ScarCruft and Konni ran spearphishing campaigns
targeting individuals and organizations in South Korea.
In addition, Konni apparently targeted selected Russian
government employees in a campaign we investigatedSupply-chain attacks andtrojanized installers
In this period, there was a noticeable increase inbroadscale campaigns using supply-chain compromises
and trojanized software installers.
In November 2023, Microsoft uncovered a Lazarus-

1

2

3

4

5

6

7

8

1

2

3

4

5

6

7

8

Engineering and manufacturing
Defense
Education
Information and cultural industries

Sectors targeted by North Korea-aligned APT groups0

Spearphishing attachment (T1566.001)
Exploit of public facing application (T1190)
Trusted relationship (T1199)
Supply-chain compromise (T1195)

linked attack on CyberLink – a Taiwanese multimedia
software company. Attackers compromised theInitial access techniques used by North Korea-aligned APT groups (with MITRE ATT&CK IDs)

ESET APT ACTIVITY REPORT

Executive summarycompany, inserted malicious code into its software

Last but not least, Lazarus was observed uploading

people into installing them. These packages would

build and delivery process, hence any resulting binaries

trojanized JavaScript and Python packages to open-

act as downloaders for further malicious components

would be trojanized and be signed by the company’ssource package repositories like NPM and PyPI,

and were targeting three major operating systems –digital certificate and released via official channels toimitating popular package names in order to trick

Windows, Linux, and macOS.

Attackers and targets

China

Middle East

North Korea

the company’s users.

RussiaOther

About ESETOCTOBER 2023 - MARCH 2024 | 15

Evolving attackers’ toolset
Speaking of attacker’s tools and techniques, we noticed
a shift towards the use of malicious LNK (Windows
shortcut) files. ScarCruft, Konni, and Kimsuky all
started using v"very similar LNK files with artificially

In December 2023, ESET detected Kimsuky malware

inflated sizes. PowerShell emerged as the favorite

on several machines belonging to a construction-

scripting language for these threat actors – long

related entity in South Korea. The analysis of the attack

PowerShell command lines are used to extract andrevealed that the malware was downloaded anddecrypt malicious payloads embedded in the shortcut

executed, by employees, on the entity’s compromised

file itself. Previously, these actors used CHM (Compiled

servers that were running the WIZVERA VeraPort

Windows Help) files and the MSHTA engine to achieve

solution. According to our data, the attack continued

their goals.

until January 2024. Interestingly, the malware was

Lazarus developed a new backdoor that we named

available for download only in specific timeframes.

WebLogTea. We were able to analyze both macOS

Outside of these timeframes, the compromisedand Linux versions of the backdoor, which wereservers served legitimate binaries. This was confirmed

distributed via trojanized PyPI packages in February

in an AhnLab report, published in February 2024.

2024. WebLogTea was also independently analyzed andAdditionally, AhnLab estimated that the total number

described by researchers at Vipyr Security.

of afflicted machines was over 3,000, showing that this
attack had a relatively large number of victims.

In the middle of 2023, Kimsuky was observed using
AlphaSeed, which is newly developed malware written

Konni used a trojanized installer of a very niche

in Go, as well as proxy malware. Throughout the rest

application to target employees of Russian embassies

of 2023 and the beginning of 2024, Kimsuky continued

as seen in Figure 2. The same approach was also usedwith the trend of developing new malware strains in

by Lazarus in its DreamJob campaigns. Trojanized PDF

Go. In particular, various security vendors described andviewers and trojanized VNC applications were delivered

named TrollAgent, Endoor, and Nikidoor. We attributeto victims as a part of a job application process, which

all this new malware to the Kimsuky AppleSeed cluster.

served as the initial compromise vector.
Figure 2. Screenshot of the custom reporting software

ESET APT ACTIVITY REPORT

Executive summary

RussiaAttackers and targets

China

Middle East

North Korea

RussiaOther

About ESETOCTOBER 2023 - MARCH 2024 | 16

ESET APT ACTIVITY REPORT

Executive summary

Attackers and targets

China

Middle East

North Korea

RussiaOther

About ESETOCTOBER 2023 - MARCH 2024 | 17

Sandworm Gamaredon Turla Sednit

Summary of Russia-aligned
APT group activity

0

5

10

15

20

25

30

30

35

Government
EnergyDefenseOver the last six months, ESET researchers haveusing the European Council calendar as a lure. Noteconsistently monitored the operations of Russia-alignedthat the sender email address and the email’s signature

APT groups, primarily directing their activities towards

impersonate a real person who works as a press officer

Ukraine and countries within the European Union.

for the Council.

Russia-aligned threat actors predominantly relied on

Examining the victimology of the incidents, it becomes

spearphishing emails against a variety of verticals forevident that the pattern of targeting aligns with theinitial access. In a campaign we investigated, emails

modus operandi commonly associated with Sednit.

sent to targets contained either malicious links or

Callisto

malicious attachments. When successful, these were
ultimately used to harvest credentials from the targets
or directly install malicious payloads onto their systems.

Spearphishing as initial access
Since the end of February 2024, we observed a wave ofspearphishing emails targeting European governmental
entities and attempting to exploit the CVE-2024-21413
vulnerability in Outlook, aka the Moniker Link bug.
Figure 3 shows an example of one of these emails,

In December 2023, the UK government publicly

Non-profit
Education
International organization
Engineering and manufacturing
RetailTelecommunications

Sectors targeted by Russia-aligned APT groups

attributed Callisto to the FSB’s 18th Center for
Information Security of the Russian Federation,
establishing a strong link between the group and theRussian government.
In February 2024, an article was published by The

0

5

10

Spearphishing (T1566)
Spearphishing attachment (T1566.001)

Record, in which they explain how Callisto targeted

Exploit of public facing application (T1190)

Keir Giles, a well-known researcher and fellow at theTrusted relationship (T1199)

Chatham House think tank. The Callisto group primarily
uses phishing emails sent from Proton Mail addresses

Initial access techniques used by Russia-aligned APT groups (with MITRE ATT&CK IDs)

15

20

25

35

ESET APT ACTIVITY REPORT

Executive summary

Attackers and targets

China

Middle East

North Korea

Russiaand attaches a blurred PDF to entice the target to log into a fake webmail
page. We have detected similar phishing emails: see Figure 4.
Note that the attackers tried to convince the victim that they were replying
to an existing email, while both were actually created by the attackers. In
this case, Callisto impersonated James Sherr, a fellow at Chatham Houseand specialist in Soviet and Russian military matters. Note that he was

Figure 3. Body of a phishing email using the European Council calendar as a lure

Other

About ESETOCTOBER 2023 - MARCH 2024 | 18

Russia-Ukraine war
Gamaredon
Gamaredon remains the most active APT group operating in Ukraine,with thousands of daily detections, as illustrated in Figure 5 below. It uses
spearphishing emails as one of its initial access vectors. The emails containsanctioned by the Russian government in February 2024.

an XHTML file attachment that utilizes HTML smuggling to deliver a ZIP

Cyberespionage operation against European
governments

file that contains a VBScript downloader that can deliver various payloads.

In 2023, we detected two previously unknown backdoors that we call
LunarWeb and LunarMail. They were used in compromises of a European
ministry of foreign affairs and its diplomatic missions abroad.

archive containing an HTA file. This HTA file then downloads another HTA
During this period, we discovered a new version of commonly used
downloaders written in PowerShell that we call PteroPSLoad. This time
PteroPSLoad has been using the Cloudflare Tunnel client and ngrok utility inorder to communicate with its C&C servers.

Both backdoors share a loader that uses the DNS domain name fordecryption of the payload, have code overlaps, and support similarcommands, but differ in C&C communication methods. LunarWeb,
deployed on servers, uses HTTP(S) and attempts to blend in by mimicking
the traffic of legitimate services such as Windows Update. LunarMail,
deployed on workstations, piggybacks on Outlook and communicates via
email messages. The backdoors hide commands and data in images anddocuments and both have the unusual capability of being able to execute
Lua scripts.
We believe with high confidence the backdoors have been used for years– since at least 2020 and possibly earlier. Based on similarities with past
activity, we attribute the compromises to Turla with medium confidence.
Figure 4. Callisto phishing email

Figure 5. Gamaredon tool detection statistics

ESET APT ACTIVITY REPORT

Executive summary

Attackers and targets

China

Middle East

North Korea

Sandworm

RussiaOther

About ESETOCTOBER 2023 - MARCH 2024 | 19

The email was sent from info@information2024[.]com with text trying
to convince people to go vote at 17:00 instead of noon. The email content is

In December 2023, Kyivstar, a major telecommunications operator in
Ukraine, disclosed that it had fallen victim to a cyberattack. The sameprovided in Figure 6 (and see Figure 7 for the English translation).

month, the pro-Russian Telegram channel @solntsepekZ, which has been

In April 2024, we detected a new Texonto PSYOP spam wave directed

used to amplify Sandworm’s attacks, claimed that Sandworm is responsible

against people living in the Kharkiv region of Ukraine. The email content isfor the cyberattack against Kyivstar.

provided in Figure 8 (and see Figure 9 for the English translation).

In January 2024, we detected Sandworm activity directed against a regional
power supply company in Ukraine.
In March 2024, the same Telegram channel announced a cyberattack

Figure 8. Email body (original version in Ukrainian)against four small internet providers in Ukraine. SentinelLabs analyzed
AcidPour, a Linux wiper, which might have been used in this cyberattack.
Note that in addition to Sandworm, we have detected the group UAC-0099
targeting energy companies in Ukraine in the last few months. This, along

Figure 6. Email body (original version in Russian)with the ongoing physical destruction of Ukrainian energy infrastructurewith missile barrages, underscores the energy vertical as one of the
primary targets for Russia.
Operation Texonto
In February 2024, we published a blogpost about a disinformation andpsychological operation (PSYOP) campaign we named Operation Texonto.
This campaign is trying to raise doubts in the minds of Ukrainians andUkrainian speakers abroad. Attackers primarily use emails as the main
distribution method for their PSYOP messages.
In March 2024, we observed new Operation Texonto activity directedagainst various individuals in Russia, most likely Russian dissidents.
Attackers were trying to impersonate Alexey Navalny’s team in order
to disorganize the noon voting protest of Navalny’s supporters during
Russia’s 2024 presidential election.

Figure 7. Email body (machine translation from Russian to English)

Figure 9. Email body (machine translation from Ukrainian to English)

ESET APT ACTIVITY REPORT

Executive summary

Other

Attackers and targets

China

Middle East

North Korea

RussiaOther

About ESETOCTOBER 2023 - MARCH 2024 | 20

ESET APT ACTIVITY REPORT

Executive summary

Attackers and targets

China

Middle East

North Korea

RussiaOther

About ESETOCTOBER 2023 - MARCH 2024 | 21

SturgeonPhisher Unlucky Kamran Winter Vivern

Other notable APT activities
Unlucky KamranIn this section, we review notable activities from groups with as yet
unknown alignments.

In activity reported in November 2023, ESET researchers have identified a

ESET researchers also track campaigns from lesser-known groups. In thiswatering-hole attack on a regional news website that delivers news about

section, we highlight a recent SturgeonPhisher campaign in the Middle

Gilgit-Baltistan, a disputed region administered by Pakistan. When opened

East, a watering-hole attack on a regional news website that delivers news

on a mobile device, the Urdu version of the Hunza News website offers

about Gilgit-Baltistan (a disputed region administered by Pakistan), and the
exploitation of a zero-day vulnerability in Roundcube by Winter Vivern.

SturgeonPhisher
SturgeonPhisher (also known as YoroTrooper) is a cyberespionage groupthat we believe is aligned with the interests of Kazakhstan. The groupmainly targets governments in Central Asia, but campaigns in recent
months suggest that they are also tasked with intelligence gathering
operations worldwide.
In particular, we noticed that in November 2023, a month after the startof the armed conflict between Israel and Hamas, SturgeonPhisher createdphishing websites targeting ministries of foreign affairs in Iran and Yemen.
It is the first time that we have noticed any Middle Eastern countries to beof interest to the group.
Figure 10 shows an Axigen WebMail phishing page hosted at
mail.mofa.middleast-gov[.]com.

Figure 10. Axigen WebMail phishing page

We believe that a spearphishing email, with a link to the fake webmail
page, was sent to the targets leading them to believe that they need
to authenticate to view a document. After the victim is enticed into
submitting credentials, a PDF is displayed (see Figure 11). This document isabout alleged crimes during Israel's occupancy of Palestine.
Figure 11. Palestine_MOFA.pdf

ESET APT ACTIVITY REPORT

Executive summary

readers the possibility to download the Hunza News Android app directlyfrom the website, but the app has malicious espionage capabilities.
The developer certificate of the malicious app was issued on January 10,2023 and the app appeared on the website sometime between January 7
and March 21 that year. During that time, protests were being held in GilgitBaltistan for various reasons encompassing land rights, taxation concerns,
prolonged power outages, and a decline in subsidized wheat provisions. The
region, shown in the map in Figure 12, is under Pakistan’s administrative
governance, consisting of the northern portion of the larger Kashmir region,

Attackers and targets

China

Middle East

North Korea

Winter Vivern
In October 2023, ESET researchers discovered a zero-day vulnerability
used in the wild by Winter Vivern, a cyberespionage group that we believe
is aligned with the interests of Belarus.
Exploitation of the XSS vulnerability, assigned CVE-2023-5631, can be done
remotely by sending a specially crafted email message. In this Winter Vivern
campaign, the emails were sent from team.managment@outlook[.]com
and had the subject Get started in your Outlook.

which has been the subject of a dispute between India and Pakistan since
1947, and between India and China since 1959.
The Kamran spyware automatically gathers sensitive user data, including
SMS messages, the contacts list, call logs, calendar events, device location,
list of installed applications, and images.

Figure 12. Gilgit-Baltistan region

RussiaFigure 13. Email sample exploiting CVE-2023-5631

Other

About ESETOCTOBER 2023 - MARCH 2024 | 22

ESET APT ACTIVITY REPORT

Executive summary

Attackers and targets

China

Middle East

North Korea

RussiaOther

About ESETOCTOBER 2023 - MARCH 2024 | 23

About ESET
ESET® provides cutting-edge digital security to prevent attacks before

ESET Threat Intelligence

they happen. By combining the power of AI and human expertise, ESETESET Threat Reports and APT Activity Reports

stays ahead of known and emerging cyberthreats — securing businesses,
critical infrastructure, and individuals. Whether it’s endpoint, cloud, or
mobile protection, our AI-native, cloud-first solutions and services remain
highly effective and easy to use. ESET technology includes robust detection

ESET GitHub@ESETresearch
WeLiveSecurity.com

and response, ultra-secure encryption, and multifactor authentication.
With 24/7 real-time defense and strong local support, we keep users safeand businesses running without interruption. An ever-evolving digitallandscape demands a progressive approach to security: ESET is committed
to world-class research and powerful threat intelligence, backed by R&D
centers and a strong global partner network. For more information, visit
www.eset.com or follow us on LinkedIn, Facebook, and X.

© 2024 ESET, spol. s r.o. - All rights reserved.
Trademarks used herein are trademarks or registered trademarks of ESET, spol. s r.o.
All other names and brands are registered trademarks of their respective companies.

(eset):research