# MA-737.072019: MyCERT Advisory - Operation Soft Cell Campaign Alert

**Date:** 31 Jul 2019  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-737.072019  
**Advisory ID:** MA-737.072019

---

**1.0 Introduction**
Operation Soft Cell Campaign is identified as an advanced persistent attack targeting global telecommunications providers carried out by a threat actor using tools and techniques commonly associated with Chinese-affiliated threat actors, such as APT10.
**2.0 Impact**
This multi-wave attacks focused on obtaining data of specific, high-value targets and resulted in a complete takeover of the network. The attack was aiming to obtain Call Detail Record (CDR) of a large telecommunications provider, attempting to steal all data stored in the active directory, compromising every single username and password in the organization, along with other personally identifiable information, billing data, call detail records, credentials, email servers, geo-location of users, and more.
**3.0 Affected Products**
Since multiple Windows built-in tools were used by this campaign for various tasks, including whoami, net.exe, ipconfig, netstat, portqry, and more. Thus, the malware targeting Windows machine from the campaign. This campaign also use supporting tools including HTRAN, Mimikatz, PoisonIvy, China Chopper, and Nbtscan as techniques used throughout these attack.
**4.0 Known Indicator of Compromises (IOC)**
The following list are known MD5 hashes for malware samples and its component:
| --- | **MD5 Hashes** | e435b961048c2fecc2e8e697dc9bd666  89d0cdd3617c118c6ba1a720e9f9bd62  fb8c172c964e6740963eb223407a917c |
The following list are known hosts use by malware campaign for communication:
| --- | **Network Activity** | sz2016rose.ddns.net  rosaf112.ddns.net  hotkillmail9sddcc.ddns.net  dffwescwer4325.myftp.biz  cvdfhjh12311.ddns.net  cvdfhjh1231.myftp.biz  asyspy256.ddns.net |
**4.0 Recommendations**
MyCERT highly recommended users and administrators to :
- Add an additional security layer for web servers. For example, use Web Application Firewall (WAF) to prevent trivial attacks on Internet-facing web servers.
- Expose as few systems or ports to the Internet as possible. Make sure that all web servers and web services that are exposed are patched.
- Use an Endpoint Detection and Response (EDR) tool to give visibility and immediate response capabilities when high severity incidents are detected.
- Update software and operating systems with the latest patches. Outdated applications and operating systems are the target of most attacks.
- Never click on links or open attachments in unsolicited emails.
- Backup data on a regular basis. Keep it on a separate device and store it offline.
In addition, we also recommends that organizations employ the following best practices:
- Restrict users’ permissions to install and run software applications, and apply the principle of “least privilege” to all systems and services. Restricting these privileges may prevent malware from running or limit its capability to spread through a network.
- Use application whitelisting to allow only approved programs to run on a network.
- Enable strong spam filters to prevent phishing emails from reaching the end users and authenticate inbound email to prevent email spoofing.
- Scan all incoming and outgoing emails to detect threats and filter executable files from reaching end users.
- Configure firewalls to block access to known malicious domains and IP addresses.
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection#e2819b808790dbdbdba2819b80879091878197908b969bcc8f9b) or [[email protected]](/cdn-cgi/l/email-protection#711c0812140305311c08121403055f1e03165f1c08)
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 89453442
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 -18:00 MYT
Web: <http://www.mycert.org.my>
Twitter: <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps: [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0    References**
1. <https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers>