Operation Harvest

Also known as: Operation Harvest

(McAfee) Following a recent Incident Response, McAfee Enterprise‘s Advanced Threat Research (ATR) team worked with its Professional Services IR team to support a case that initially started as a malware incident but ultimately turned out to be a long-term cyber-attack. The diagram reflecting our outcome insinuated that ‘Emissary Panda, APT 27, LuckyMouse, Bronze Union’ and ‘APT 41’ are the most likely candidates that overlap with the (sub-)techniques we observed.

🌍 Country ["China"]

Introduction

(McAfee) Following a recent Incident Response, McAfee Enterprise‘s Advanced Threat Research (ATR) team worked with its Professional Services IR team to support a case that initially started as a malware incident but ultimately turned out to be a long-term cyber-attack. The diagram reflecting our outcome insinuated that ‘Emissary Panda, APT 27, LuckyMouse, Bronze Union’ and ‘APT 41’ are the most likely candidates that overlap with the (sub-)techniques we observed.

Activities and Tactics

Country of Origin: 🇨🇳 [“China”]

Notable Campaigns

Information pending cataloguing.

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

  • BadPotato
  • Impacket
  • Mimikatz
  • PlugX
  • ProcDump
  • PsExec
  • RottenPotato
  • SMBExec
  • WinRAR
  • Winnti
  • nbtscan
  • BadPotato:
  • Impacket:
  • Mimikatz:
  • PlugX:
  • ProcDump:
  • PsExec:
  • RottenPotato:
  • SMBExec:
  • WinRAR:
  • Winnti:
  • nbtscan:

Attribution and Evidence

Country of Origin: [“China”] Additional attribution information pending cataloguing.

References

References pending cataloguing.