# MA-892.112022: MyCERT Alert - IOCs and TTPs Associated with APT40

**Date:** 18 Nov 2022  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-892.112022  
**Advisory ID:** MA-892.112022

---

**1.0 Introduction**
MyCERT observed the APT40—aka BRONZE MOHAWK, FEVERDREAM, G0065, Gadolinium, GreenCrash, Hellsing, Kryptonite Panda, Leviathan, MUDCARP, Periscope, Temp.Periscope, and Temp.Jumper, has been active since at least 2009. The APT40 has targeted governmental organisations, companies, and universities in a wide range of industries including biomedical, robotics, and maritime research, targeting countries such as Cambodia, Belgium, Germany, Hong Kong, Philippines, Norway, Saudi Arabia, Switzerland, the United States, the United Kingdom andMalaysia.
**2.0 General Tactic, Technique and Procedure (TTP)**
It always started with a **spear-phishing email** pretending to be a journalist, an individual from a trade publication, or someone from a relevant military organisation or non-governmental organisation (NGO). Sometimes, the group has leveraged previously compromised email addresses to send spear-phishing emails.  APT40 typically utilises short and targeted campaigns.
The motives are usually data theft and exfiltration. The group's operations **target government-sponsored projects** and take large amounts of information specific to such projects, including proposals, meetings, financial data, shipping information, plans and drawings, and raw data.
APT40 is associated with malware from 51 different variants. Out of the 51 variants, 37 are non-public. At least 7 of these non-public tools (BADSIGN, FIELDGOAL, FINDLOCK, PHOTO, SCANBOX, SOGU, and WIDETONE) are shared with other suspected China-nexus operators.
*Figure 1: APT40 attack lifecycle*3.0 Indicators of Compromise (IoC)**
DadJoke Malware was first used in the wild in January 2019 and has undergone constant development. This malware has been used in several active campaigns since January 2019, all targeting government, military, and diplomatic entities in the Southeast Asia region. The latest campaign was conducted on August 29, 2019, and seems to have targeted only a few individuals working for a military organisation.
**Kill Chain**
- **Reconnaissance**: The group has leveraged previously compromised email addresses or impersonation of emails to send spear-phishing emails
- **Delivery**: Send spear-phishing emails with malicious attachments, although Google Drive has been observed. This includes pretending to be a journalist, an individual from a trade publication, or someone from a relevant military or non-governmental organisation (NGO).
- **Weaponisation**: Microsoft document with enabling macro that extracts malicious exe to download loader.
- **Exploitation**:
- CVE-2014-6352: Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allow remote attackers to execute arbitrary code via a crafted OLE object, as exploited in the wild in October 2014 with a crafted PowerPoint document.
- CVE-2017-0199: Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API.
- **Installation**:
- Utilises unique “iShape” names benign exe, loader dll, and hidden content
- Facilitates extraction and execution of main payload primarily in memory
- Load order hijacking using benign Windows Defender exe
- Contains an encrypted config block and LZMA compressed as the main payload.
- **Command and Control**: Beacon + download and execute stage 2. The Beacon is also encrypted and looks like png.
- **Actions on Objectives**: Data theft and exfiltration. The group's operations target government-sponsored projects and take large amounts of information specific to such projects, including proposals, meetings, financial data, shipping information, plans and drawings, and raw data.
*Figure 2 - Sample of Encrypted PNG*URL**
A total of 8 campaigns with 8 URLs were detected.
*Figure 3 - List of dotm templates hosted*IP Addresses**
1.            108[.]61[.]223[.]27
2.            139[.]162[.]23[.]6
3.            139[.]162[.]44[.]81
4.            139[.]59[.]66[.]229
5.            149[.]28[.]151[.]144
6.            152[.]89[.]161[.]5
7.            157[.]230[.]34[.]7
8.            159[.]65[.]197[.]248
9.            167[.]99[.]72[.]82
10.          195[.]12[.]50[.]168
11.          207[.]148[.]79[.]152
12.          45[.]32[.]123[.]142
13.          45[.]77[.]241[.]33
####
**Domains**
1.            byfleur[.]myftp[.]org
2.            dynamics[.]ddnsking[.]com
3.            accountsx[.]bounceme[.]net
4.            vvavesltd[.]servebeer[.]com
5.            capitana[.]onthewifi[.]com
6.            kulkarni.bounceme[.]net
7.            thestar[.]serveblog[.]net
8.            invoke[.]ml
**Hashes**
1. A827d521181462a45a7077ae3c20c9b5
2. F744481A4C4A7C811FFC7DEE3B58B1FF
3. Fe1247780b31bbb9f54a65d3ba17058f
4. ae342bf6b1bd0401a42aae374f961fc6
5. b427c7253451268ca97de38be04bf59a
6. cf94796a07b6082b9e348eef934de97a
7. d81db8c4485f79b4b85226cab4f5b8f9
8. fe1247780b31bbb9f54a65d3ba17058f
9. 01b5276fdfda2043980cbce19117aaa0
10. 3c43eb86d40ae78037c29bc94b3819b7
11. 3ca84fe6cec9bf2e2abac5a8f1e0a8d2
12. 3cb38f7574e8ea97db53d3857830fcc4
13. 4c47ca6ecf04cfe312eb276022a0c381
14. 4c89d5d8016581060d9781433cfb0bb5
15. 5fe8dcdfe9e3c4e56e004b2eebf50ab3
16. 6e9f0c3f64cd134ad9dfa173e4474399
17. 8a133a382499e08811dceadcbe07357e
18. 89a81ea2b9ee9dd65d0a82b094099b43
19. 6889c7905df000b874bfc2d782512877
20. 7233ad2ba31d98ff5dd47db1b5a9fe7c
21. 4114857f9bc888122b53ad0b56d03496
22. 3ca84fe6cec9bf2e2abac5a8f1e0a8d2
**4.0 Recommendations**
Based on past incidents that affected some entities in the South East Asia region, we advise System Administrators to be vigilant of any possible current attacks from the APT40. We advise System Administrators to pay attention to the TTP shared in this Advisory, which can be used for network monitoring and threat-hunting purposes in organisations.
MyCERT highly suggests the following as preventive measures against possible threats by APT40:
- Follow and implement security policies, guidelines and best practices in the organisation.
- Ensure systems, applications and third-party add-ons are updated with the latest upgrades and security patches.
- If using older versions of operating systems or software, ensure they are upgraded to the latest versions, as older versions may have some vulnerabilities that intruders can manipulate. Aside from that, please make specific web-based applications, and network-based appliances are patched accordingly.
- Refer to respective vendors' websites for the latest patches, service packs and upgrades. Otherwise, you may also refer to MyCERT’s website for the latest advisories on software vulnerabilities with pointers to patches, service packs and upgrades.
- Ensure the Anti-virus software deployed on hosts and email gateways is updated with the latest signature files and is enabled to scan all files.
- Ensure systems are configured appropriately to avoid incidents such as information disclosure and directory listing caused by system misconfiguration.
- Ensure systems logging is always enabled, especially for critical systems.
- Perform regular backups of all critical information to limit the impact of data loss or destruction and help expedite recovery. Ideally, the backup must be done daily, on independent media and stored offline at an alternate site.
- Organisations are recommended to apply a defence-in-depth strategy in protecting networks. Firewalls, intrusion prevention systems (IPS), and network and host-based intrusion detection systems (IDS) can prevent malicious activities by blocking and dropping if it does occur and keeping track of most of the generic attacks.
- To block and set rules in the firewall, IDS or IPS of the IOC found.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours)  
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
1. <https://www.fireeye.com/blog/threat-research/2019/03/apt40-examining-a-china-nexus-espionage-actor.html>
2. [https://medium.com/insomniacs/on-27-march-2019-we-notice-a-twitter-post-by-clearsky- cyber-security-on-having-a-sample-named-951ec7896d3](https://medium.com/insomniacs/on-27-march-2019-we-notice-a-twitter-post-by-clearsky-%20cyber-security-on-having-a-sample-named-951ec7896d3)
3. <https://wemp.app/posts/80ab2b2d-4e0e-4960-94b7-4d452a06fd38?utm_source=latest-posts>