IronHusky

Also known as: BBCY-TA1, IronHusky, Operation “MysterySnail”

IronHusky is a Chinese-based threat actor first attributed in July 2017 targeting Russian and Mongolian governments, as well as aviation companies and research institutes. Since their initial attacks ceased in 2018, they have been working on a new remote access trojan dubbed MysterySnail.

🌍 Country China

Associated Operations

2021-08 In late August and early September 2021 Kaspersky technologies detected attacks with the use of an elevation of privilege exploit on multiple Microsoft Windows servers. Operation “MysterySnail” https://securelist.com/mysterysnail-attacks-with-windows-zero-day/104509/

Introduction

IronHusky is a Chinese-based threat actor first attributed in July 2017 targeting Russian and Mongolian governments, as well as aviation companies and research institutes. Since their initial attacks ceased in 2018, they have been working on a new remote access trojan dubbed MysterySnail.

Activities and Tactics

Country of Origin: 🇨🇳 China

Notable Campaigns

  • 2021-08
  • In late August and early September 2021
  • Kaspersky technologies detected attacks with the use of an elevation of privilege exploit on multiple Microsoft Windows servers.
  • Operation “MysterySnail”
  • https://securelist.com/mysterysnail-attacks-with-windows-zero-day/104509/

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • Trojan.Karagany
  • RemoteCMD
  • Trojan.Mebromi
  • Remote Utilities
  • RemotePC
  • MysterySnail:
  • CVE-2021-40449:
  • MysterySnail RAT:
  • PlugX:
  • Poison Ivy:

Attribution and Evidence

Country of Origin: China Additional attribution information pending cataloguing.

References

References pending cataloguing.