APT9

Also known as: APT 9, APT9, FlowerLady, FlowerShow, Group 27, NIGHTSHADE PANDA, Nightshade Panda, Operation “Seven Pointed Dagger”, Red Pegasus

APT9 engages in cyber operations where the goal is data theft, usually focusing on the data and projects that make a particular organization competitive within its field. APT9 was historically very active in the pharmaceuticals and biotechnology industry. We have observed this actor use spearphishing, valid accounts, as well as remote services for Initial Access. On at least one occasion, Mandiant observed APT9 at two companies in the biotechnology industry and suspect that APT9 actors may have gained initial access to one of the companies by using a trusted relationship between the two companies. APT9 use a wide range of backdoors, including publicly available backdoors, as well as backdoors that are believed to be custom, but are used by multiple APT groups.

🌍 Country China
Pharmaceuticals Healthcare Construction Aerospace Defense industrial base

Targeted Victims

United States

Associated Operations

2015-05 2016-09 Chinese Actors Use ‘3102’ Malware in Attacks on US Government and EU Media During that campaign From September 2016 through late November 2016 Operation “Seven Pointed Dagger” a threat actor group used both the Trochilus RAT and a newly idenfied RAT we’ve named MoonWind to target organizations in Thailand as well as the compiler used to generate the samples. The attackers compromised two legitimate Thai websites to host the malware http://pages.arbornetworks.com/rs/082-KNA-087/images/ASERT%20Threat%20Intelligence%20Brief%202015-05%20PlugX%20Threat%20Activity%20in%20Myanmar.pdf https://news.softpedia.com/news/trochilus-rat-evades-antivirus-detection-used-for-cyber-espionage-in-south-east-asia-498776.shtml https://unit42.paloaltonetworks.com/chinese-actors-use-3102-malware-in-attacks-on-us-government-and-eu-media/ https://unit42.paloaltonetworks.com/evilgrab-delivered-by-watering-hole-attack-on-president-of-myanmars-website/ https://unit42.paloaltonetworks.com/unit42-trochilus-rat-new-moonwind-rat-used-attack-thai-utility-organizations/ including a utility organization. We chose the name ‘MoonWind’ based on debugging strings we saw within the samples the threat actor identified as Group 27 used watering hole attacks on official Myanmar government websites to infect unsuspecting users with the PlugX malware (an RAT) when accessing information on the upcoming Myanmar elections. which is a tactic this group has used in the past.

Introduction

APT9 engages in cyber operations where the goal is data theft, usually focusing on the data and projects that make a particular organization competitive within its field. APT9 was historically very active in the pharmaceuticals and biotechnology industry. We have observed this actor use spearphishing, valid accounts, as well as remote services for Initial Access. On at least one occasion, Mandiant observed APT9 at two companies in the biotechnology industry and suspect that APT9 actors may have gained initial access to one of the companies by using a trusted relationship between the two companies. APT9 use a wide range of backdoors, including publicly available backdoors, as well as backdoors that are believed to be custom, but are used by multiple APT groups.

Activities and Tactics

Targeted Sectors: Pharmaceuticals, Healthcare, Construction, Aerospace, Defense industrial base

Country of Origin: 🇨🇳 China

Suspected Victims: United States

Notable Campaigns

  • 2015-05
  • 2016-09
  • Chinese Actors Use ‘3102’ Malware in Attacks on US Government and EU Media
  • During that campaign
  • From September 2016 through late November 2016
  • Operation “Seven Pointed Dagger”
  • a threat actor group used both the Trochilus RAT and a newly idenfied RAT we’ve named MoonWind to target organizations in Thailand
  • as well as the compiler used to generate the samples. The attackers compromised two legitimate Thai websites to host the malware
  • http://pages.arbornetworks.com/rs/082-KNA-087/images/ASERT%20Threat%20Intelligence%20Brief%202015-05%20PlugX%20Threat%20Activity%20in%20Myanmar.pdf
  • https://news.softpedia.com/news/trochilus-rat-evades-antivirus-detection-used-for-cyber-espionage-in-south-east-asia-498776.shtml
  • https://unit42.paloaltonetworks.com/chinese-actors-use-3102-malware-in-attacks-on-us-government-and-eu-media/
  • https://unit42.paloaltonetworks.com/evilgrab-delivered-by-watering-hole-attack-on-president-of-myanmars-website/
  • https://unit42.paloaltonetworks.com/unit42-trochilus-rat-new-moonwind-rat-used-attack-thai-utility-organizations/
  • including a utility organization. We chose the name ‘MoonWind’ based on debugging strings we saw within the samples
  • the threat actor identified as Group 27 used watering hole attacks on official Myanmar government websites to infect unsuspecting users with the PlugX malware (an RAT) when accessing information on the upcoming Myanmar elections.
  • which is a tactic this group has used in the past.

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • Backdoor.Oldrea
  • RemoteCMD
  • CyberGate
  • Cyber Eye RAT
  • Remote Utilities
  • RemotePC
  • Trochilus RAT:
  • PlugX:
  • EvilGrab:
  • 3102 variant of 9002 RAT:
  • Poison Ivy:
  • BIGJOLT:
  • FUNRUN:
  • GH0ST:
  • HOMEUNIX:
  • JIM A:
  • PHOTO:
  • SKINNYGENE:
  • SOGU:
  • VICEROY:
  • VIPSH ELL:
  • WETHEAD:
  • XDOOR:
  • ZXSHELL:
  • 3102 RAT:
  • 9002 RAT:
  • EvilGrab RAT:
  • MoonWind RAT:

Attribution and Evidence

Country of Origin: China Additional attribution information pending cataloguing.

References

References pending cataloguing.