Threat Group-3390
Threat Group-3390 is a Chinese threat group that has extensively used strategic Web compromises to target victims.[1] The group has been active since at least 2010 and has targeted organizations in the aerospace, government, defense, technology, energy, manufacturing and gambling/betting sectors.[2][3][4]
Associated Group Descriptions
| Name | Description |
|---|---|
| Earth Smilodon | |
| TG-3390 | |
| Emissary Panda | |
| BRONZE UNION | |
| APT27 | |
| Iron Tiger | |
| LuckyMouse |
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1047 | Windows管理规范 |
A Threat Group-3390 tool can use WMI to execute a binary.[6] |
|
| Enterprise | T1555 | .005 | 从密码存储中获取凭证: Password Managers |
Threat Group-3390 obtained a KeePass database from a compromised host.[4] |
| Enterprise | T1005 | 从本地系统获取数据 |
Threat Group-3390 ran a command to compile an archive of file types of interest from the victim user's directories.[2] |
|
| Enterprise | T1195 | .002 | 供应链破坏: Compromise Software Supply Chain |
Threat Group-3390 has compromised the Able Desktop installer to gain access to victim's environments.[5] |
| Enterprise | T1199 | 信任关系 |
Threat Group-3390 has compromised third party service providers to gain access to victim's environments.[10] |
|
| Enterprise | T1112 | 修改注册表 |
A Threat Group-3390 tool has created new Registry keys under |
|
| Enterprise | T1543 | .003 | 创建或修改系统进程: Windows Service |
Threat Group-3390's malware can create a new service, sometimes naming it after the config information, to gain persistence.[6][11] |
| Enterprise | T1190 | 利用公开应用程序漏洞 |
Threat Group-3390 has exploited the Microsoft SharePoint vulnerability CVE-2019-0604 and CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in Exchange Server.[5] |
|
| Enterprise | T1574 | .001 | 劫持执行流: DLL Search Order Hijacking |
Threat Group-3390 has performed DLL search order hijacking to execute their payload.[6] |
| .002 | 劫持执行流: DLL Side-Loading |
Threat Group-3390 has used DLL side-loading, including by using legitimate Kaspersky antivirus variants as well as |
||
| Enterprise | T1140 | 反混淆/解码文件或信息 |
During execution, Threat Group-3390 malware deobfuscates and decompresses code that was encoded with Metasploit’s shikata_ga_nai encoder as well as compressed with LZNT1 compression.[3] |
|
| Enterprise | T1547 | .001 | 启动或登录自动启动执行: Registry Run Keys / Startup Folder |
Threat Group-3390's malware can add a Registry key to |
| Enterprise | T1059 | .001 | 命令与脚本解释器: PowerShell |
Threat Group-3390 has used PowerShell for execution.[2][4] |
| .003 | 命令与脚本解释器: Windows Command Shell |
Threat Group-3390 has used command-line interfaces for execution.[2][9] |
||
| Enterprise | T1133 | 外部远程服务 |
Threat Group-3390 actors look for and use VPN profiles during an operation to access the network using external VPN services.[1] Threat Group-3390 has also obtained OWA account credentials during intrusions that it subsequently used to attempt to regain access when evicted from a victim network.[2] |
|
| Enterprise | T1562 | .002 | 妨碍防御: Disable Windows Event Logging |
Threat Group-3390 has used appcmd.exe to disable logging on a victim server.[2] |
| Enterprise | T1203 | 客户端执行漏洞利用 |
Threat Group-3390 has exploited CVE-2018-0798 in Equation Editor.[5] |
|
| Enterprise | T1071 | .001 | 应用层协议: Web Protocols |
Threat Group-3390 malware has used HTTP for C2.[3] |
| Enterprise | T1560 | .002 | 归档收集数据: Archive via Library |
Threat Group-3390 has used RAR to compress, encrypt, and password-protect files prior to exfiltration.[2] |
| Enterprise | T1003 | .001 | 操作系统凭证转储: LSASS Memory |
Threat Group-3390 actors have used a modified version of Mimikatz called Wrapikatz to dump credentials. They have also dumped credentials from domain controllers.[1][2] |
| .002 | 操作系统凭证转储: Security Account Manager |
Threat Group-3390 actors have used gsecdump to dump credentials. They have also dumped credentials from domain controllers.[1][2] |
||
| .004 | 操作系统凭证转储: LSA Secrets |
Threat Group-3390 actors have used gsecdump to dump credentials. They have also dumped credentials from domain controllers.[1][2] |
||
| Enterprise | T1030 | 数据传输大小限制 |
Threat Group-3390 actors have split RAR files for exfiltration into parts.[1] |
|
| Enterprise | T1074 | .001 | 数据分段: Local Data Staging |
Threat Group-3390 has locally staged encrypted archives for later exfiltration efforts.[2] |
| .002 | 数据分段: Remote Data Staging |
Threat Group-3390 has moved staged encrypted archives to Internet-facing servers that had previously been compromised with China Chopper prior to exfiltration.[2] |
||
| Enterprise | T1608 | .001 | 暂存能力: Upload Malware |
Threat Group-3390 has hosted malicious payloads on Dropbox.[4] |
| .002 | 暂存能力: Upload Tool |
Threat Group-3390 has staged tools, including gsecdump and WCE, on previously compromised websites.[1] |
||
| .004 | 暂存能力: Drive-by Target |
Threat Group-3390 has embedded malicious code into websites to screen a potential victim's IP address and then exploit their browser if they are of interest.[8] |
||
| Enterprise | T1078 | 有效账户 |
Threat Group-3390 actors obtain legitimate credentials using a variety of methods and use them to further lateral movement on victim networks.[1] |
|
| Enterprise | T1505 | .003 | 服务器软件组件: Web Shell |
Threat Group-3390 has used a variety of Web shells.[9] |
| Enterprise | T1068 | 权限提升漏洞利用 |
Threat Group-3390 has used CVE-2014-6324 and CVE-2017-0213 to escalate privileges.[2][10] |
|
| Enterprise | T1012 | 查询注册表 |
A Threat Group-3390 tool can read and decrypt stored Registry values.[6] |
|
| Enterprise | T1189 | 浏览器攻击 |
Threat Group-3390 has extensively used strategic web compromises to target victims.[1][3] |
|
| Enterprise | T1027 | .002 | 混淆文件或信息: Software Packing |
Threat Group-3390 has packed malware and tools, including using VMProtect.[4][5] |
| .013 | 混淆文件或信息: Encrypted/Encoded File |
A Threat Group-3390 tool can encrypt payloads using XOR. Threat Group-3390 malware is also obfuscated using Metasploit’s shikata_ga_nai encoder as well as compressed with LZNT1 compression.[6][3][9] |
||
| Enterprise | T1548 | .002 | 滥用权限提升控制机制: Bypass User Account Control |
A Threat Group-3390 tool can use a public UAC bypass method to elevate privileges.[6] |
| Enterprise | T1204 | .002 | 用户执行: Malicious File |
Threat Group-3390 has lured victims into opening malicious files containing malware.[4] |
| Enterprise | T1070 | .004 | 移除指标: File Deletion |
Threat Group-3390 has deleted existing logs and exfiltrated file archives from a victim.[2][4] |
| .005 | 移除指标: Network Share Connection Removal |
Threat Group-3390 has detached network shares after exfiltrating files, likely to evade detection.[2] |
||
| Enterprise | T1033 | 系统所有者/用户发现 |
Threat Group-3390 has used |
|
| Enterprise | T1049 | 系统网络连接发现 |
Threat Group-3390 has used |
|
| Enterprise | T1016 | 系统网络配置发现 |
Threat Group-3390 actors use NBTscan to discover vulnerable systems.[1] |
|
| Enterprise | T1046 | 网络服务发现 |
Threat Group-3390 actors use the Hunter tool to conduct network service discovery for vulnerable systems.[1][9] |
|
| Enterprise | T1119 | 自动化收集 |
Threat Group-3390 ran a command to compile an archive of file types of interest from the victim user's directories.[2] |
|
| Enterprise | T1583 | .001 | 获取基础设施: Domains |
Threat Group-3390 has registered domains for C2.[11] |
| Enterprise | T1588 | .002 | 获取能力: Tool |
Threat Group-3390 has obtained and used tools such as Impacket, pwdump, Mimikatz, gsecdump, NBTscan, and Windows Credential Editor.[9][1] |
| .003 | 获取能力: Code Signing Certificates |
Threat Group-3390 has obtained stolen valid certificates, including from VMProtect and the Chinese instant messaging application Youdu, for their operations.[11] |
||
| Enterprise | T1087 | .001 | 账号发现: Local Account |
Threat Group-3390 has used |
| Enterprise | T1105 | 输入工具传输 |
Threat Group-3390 has downloaded additional malware and tools, including through the use of |
|
| Enterprise | T1056 | .001 | 输入捕获: Keylogging |
Threat Group-3390 actors installed a credential logger on Microsoft Exchange servers. Threat Group-3390 also leveraged the reconnaissance framework, ScanBox, to capture keystrokes.[1][7][3] |
| Enterprise | T1055 | .012 | 进程注入: Process Hollowing |
A Threat Group-3390 tool can spawn |
| Enterprise | T1021 | .006 | 远程服务: Windows Remote Management |
Threat Group-3390 has used WinRM to enable remote execution.[2] |
| Enterprise | T1210 | 远程服务漏洞利用 |
Threat Group-3390 has exploited MS17-010 to move laterally to other systems on the network.[9] |
|
| Enterprise | T1018 | 远程系统发现 |
Threat Group-3390 has used the |
|
| Enterprise | T1567 | .002 | 通过网络服务渗出: Exfiltration to Cloud Storage |
Threat Group-3390 has exfiltrated stolen data to Dropbox.[4] |
| Enterprise | T1566 | .001 | 钓鱼: Spearphishing Attachment |
Threat Group-3390 has used e-mail to deliver malicious attachments to victims.[4] |
| Enterprise | T1053 | .002 | 预定任务/作业: At |
Threat Group-3390 actors use at to schedule tasks to run self-extracting RAR archives, which install HTTPBrowser or PlugX on other victims on a network.[1] |
Software
References
- Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, August 5). Threat Group-3390 Targets Organizations for Cyberespionage. Retrieved August 18, 2018.
- Counter Threat Unit Research Team. (2017, June 27). BRONZE UNION Cyberespionage Persists Despite Disclosures. Retrieved July 13, 2017.
- Legezo, D. (2018, June 13). LuckyMouse hits national data center to organize country-level waterholing campaign. Retrieved August 18, 2018.
- Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.
- Lunghi, D. and Lu, K. (2021, April 9). Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware. Retrieved November 12, 2021.
- Pantazopoulos, N., Henry T. (2018, May 18). Emissary Panda – A potential new malicious tool. Retrieved June 25, 2018.
- Khandelwal, S. (2018, June 14). Chinese Hackers Carried Out Country-Level Watering Hole Attack. Retrieved August 18, 2018.
- Gallagher, S.. (2015, August 5). Newly discovered Chinese hacking group hacked 100+ websites to use as “watering holes”. Retrieved January 25, 2016.
- Falcone, R. and Lancaster, T. (2019, May 28). Emissary Panda Attacks Middle East Government Sharepoint Servers. Retrieved July 9, 2019.
- Global Threat Center, Intelligence Team. (2020, December). APT27 Turns to Ransomware. Retrieved November 12, 2021.
- Daniel Lunghi. (2023, March 1). Iron Tiger’s SysUpdate Reappears, Adds Linux Targeting. Retrieved March 20, 2023.
- Counter Threat Unit Research Team. (2019, February 27). A Peek into BRONZE UNION’s Toolbox. Retrieved September 24, 2019.
- Chen, T. and Chen, Z. (2020, February 17). CLAMBLING - A New Backdoor Base On Dropbox. Retrieved November 12, 2021.