TA428

Also known as: BRONZE DUDLEY, Colourful Panda, Operation “LagTime IT”, Operation “StealthyTrident”, Panda, TA428, ThunderCats

Proofpoint researchers have identified a targeted APT campaign that utilized malicious RTF documents to deliver custom malware to unsuspecting victims. We dubbed this campaign “Operation LagTime IT” based on entities that were targeted and the distinctive domains registered to C&C IP infrastructure. Beginning in early 2019, these threat actors targeted a number of government agencies in East Asia overseeing government information technology, domestic affairs, foreign affairs, economic development, and political processes. We determined that the infection vector observed in this campaign was spear phishing, with emails originating from both free email accounts and compromised user accounts. Attackers relied on Microsoft Equation Editor exploit CVE-2018-0798 to deliver a custom malware that Proofpoint researchers have dubbed Cotx RAT. Additionally, this APT group utilizes Poison Ivy payloads that share overlapping command and control (C&C) infrastructure with the newly identified Cotx campaigns. Based on infrastructure overlaps, post-exploitation techniques, and historic TTPs utilized in this operation, Proofpoint analysts attribute this activity to the Chinese APT group tracked internally as TA428. Researchers believe that this activity has an operational and tactical resemblance to the Maudi Surveillance Operation which was previously reported in 2013.

🌍 Country China
📅 Activity 2020 — 2020
2020
2020

Associated Operations

2019-03 2020-06 2020-12 2021-05 2022-01 Additionally Attackers relied on Microsoft Equation Editor exploit CVE-2018-0798 to deliver a custom malware that Proofpoint researchers have dubbed Cotx RAT. China-linked TA428 Continues to Target Russia and Mongolia IT Companies ESET researchers discovered that chat software called Able Desktop Operation “LagTime IT” Operation “StealthyTrident” Targeted attack on industrial enterprises and public institutions ThunderCats Hack the FSB https://blog.group-ib.com/task https://decoded.avast.io/luigicamastra/apt-group-targeting-governmental-agencies-in-east-asia/ https://insight-jp.nttsecurity.com/post/102gi9b/pandas-new-arsenal-part-1-tmanger https://labs.sentinelone.com/thundercats-hack-the-fsb-your-taxes-didnt-pay-for-this-op/ https://securelist.com/targeted-attack-on-industrial-enterprises-and-public-institutions/107054/ https://www.proofpoint.com/us/threat-insight/post/chinese-apt-operation-lagtime-it-targets-government-information-technology https://www.recordedfuture.com/china-linked-ta428-threat-group/ https://www.welivesecurity.com/2020/12/10/luckymouse-ta428-compromise-able-desktop/ part of a business management suite popular in Mongolia and used by 430 government agencies in Mongolia. this APT group utilizes Poison Ivy payloads that share overlapping command and control (C&C) infrastructure with the newly identified Cotx campaigns.

Introduction

Proofpoint researchers have identified a targeted APT campaign that utilized malicious RTF documents to deliver custom malware to unsuspecting victims. We dubbed this campaign “Operation LagTime IT” based on entities that were targeted and the distinctive domains registered to C&C IP infrastructure. Beginning in early 2019, these threat actors targeted a number of government agencies in East Asia overseeing government information technology, domestic affairs, foreign affairs, economic development, and political processes. We determined that the infection vector observed in this campaign was spear phishing, with emails originating from both free email accounts and compromised user accounts. Attackers relied on Microsoft Equation Editor exploit CVE-2018-0798 to deliver a custom malware that Proofpoint researchers have dubbed Cotx RAT. Additionally, this APT group utilizes Poison Ivy payloads that share overlapping command and control (C&C) infrastructure with the newly identified Cotx campaigns. Based on infrastructure overlaps, post-exploitation techniques, and historic TTPs utilized in this operation, Proofpoint analysts attribute this activity to the Chinese APT group tracked internally as TA428. Researchers believe that this activity has an operational and tactical resemblance to the Maudi Surveillance Operation which was previously reported in 2013.

Activities and Tactics

Country of Origin: 🇨🇳 China

First Seen: 2020

Last Activity: 2020

Notable Campaigns

  • 2019-03
  • 2020-06
  • 2020-12
  • 2021-05
  • 2022-01
  • Additionally
  • Attackers relied on Microsoft Equation Editor exploit CVE-2018-0798 to deliver a custom malware that Proofpoint researchers have dubbed Cotx RAT.
  • China-linked TA428 Continues to Target Russia and Mongolia IT Companies
  • ESET researchers discovered that chat software called Able Desktop
  • Operation “LagTime IT”
  • Operation “StealthyTrident”
  • Targeted attack on industrial enterprises and public institutions
  • ThunderCats Hack the FSB
  • https://blog.group-ib.com/task
  • https://decoded.avast.io/luigicamastra/apt-group-targeting-governmental-agencies-in-east-asia/
  • https://insight-jp.nttsecurity.com/post/102gi9b/pandas-new-arsenal-part-1-tmanger
  • https://labs.sentinelone.com/thundercats-hack-the-fsb-your-taxes-didnt-pay-for-this-op/
  • https://securelist.com/targeted-attack-on-industrial-enterprises-and-public-institutions/107054/
  • https://www.proofpoint.com/us/threat-insight/post/chinese-apt-operation-lagtime-it-targets-government-information-technology
  • https://www.recordedfuture.com/china-linked-ta428-threat-group/
  • https://www.welivesecurity.com/2020/12/10/luckymouse-ta428-compromise-able-desktop/
  • part of a business management suite popular in Mongolia and used by 430 government agencies in Mongolia.
  • this APT group utilizes Poison Ivy payloads that share overlapping command and control (C&C) infrastructure with the newly identified Cotx campaigns.

Tactics, Techniques, and Procedures (TTPs)

Information pending cataloguing.

Notable Indicators of Compromise (IOCs)

No atomic indicators are listed in this profile. The APTnotes snapshot indexes 1 public reports that may contain IOCs; see Source Attribution for dataset links.

Malware and Tools

  • PoisonIvy
  • Xploit
  • Archelaus Beta
  • 8.t Dropper:
  • Albaniiutas:
  • Cotx RAT:
  • CoughingDown:
  • PhantomNet:
  • PlugX:
  • Poison Ivy:
  • TManger:

Attribution and Evidence

Country of Origin: China Additional attribution information pending cataloguing.

References

References pending cataloguing.