Intelligence gathering is likely motive in campaign targeting a variety of sectors.
A previously unknown advanced persistent threat (APT) group used custom malware and multiple publicly available tools to target a number of organizations in the manufacturing, IT, and biomedical sectors in Taiwan.
A government agency located in the Pacific Islands, as well as organizations in Vietnam and the U.S., also appear to have been hit as part of this campaign. This activity began in February 2023 and continued until at least May 2023.
The Symantec Threat Hunter Team, part of Broadcom, has attributed this activity to a new group we are calling Grayling. This activity stood out due to the use by Grayling of a distinctive DLL sideloading technique that uses a custom decryptor to deploy payloads. The motivation driving this activity appears to be intelligence gathering.
Attacker Activity
There are indications that Grayling may exploit public facing infrastructure for initial access to victim machines. Web shell deployment was observed on some victim computers prior to DLL sideloading activity taking place. DLL sideloading is used to load a variety of payloads, including Cobalt Strike, NetSpy, and the Havoc framework.
The attackers take various actions once they gain initial access to victims’ computers, including escalating privileges, network scanning, and using downloaders.
Tactics, techniques, and procedures (TTPs) used by the attackers included:
- Havoc: An open-source post-exploitation command-and-control framework that attackers began using towards the start of 2023, seemingly as an alternative to Cobalt Strike and similar tools. Havoc is able to carry out a variety of activities including executing commands, managing processes, downloading additional payloads, manipulating Windows tokens, and executing shellcode. Havoc is also notable for being cross-platform.
- Cobalt Strike: An off-the-shelf tool that can be used to execute commands, inject other processes, elevate current processes, or impersonate other processes, and upload and download files. It ostensibly has legitimate uses as a penetration-testing tool but is invariably exploited by malicious actors.
- NetSpy: A publicly available spyware tool.
- Exploitation of CVE-2019-0803: An elevation of privilege vulnerability that exists in Windows when the Win32k component fails to properly handle objects in memory.
- Active Directory discovery: Used to query Active Directory and help map the network.
- Mimikatz: Publicly available credential-dumping tool.
- Kill processes
- Downloaders
- Unknown payload downloaded from imfsb.ini
The typical attack chain in this activity appears to be DLL sideloading through exported API SbieDll_Hook. This leads to the loading of various tools, including a Cobalt Strike Stager that leads to Cobalt Strike Beacon, the Havoc framework, and NetSpy. The attackers were also seen loading and decrypting an unknown payload from imfsb.ini. An exploit for CVE-2019-0803 was also used in the course of this activity, while shellcode was also downloaded and executed.
Other post-exploitation activity performed by these attackers includes using kill processes to kill all processes listed in a file called processlist.txt, and downloading the publicly available credential-dumping tool Mimikatz.
Motivation
While we do not see data being exfiltrated from victim machines, the activity we do see and the tools deployed point to the motivation behind this activity being intelligence gathering. The sectors the victims operate in – manufacturing, IT, biomedical, and government – are also sectors that are most likely to be targeted for intelligence gathering rather than for financial reasons.
The use of custom techniques combined with publicly available tools is typical of the activity we see from APT groups these days, with threat actors often using publicly available or living-off-the-land tools in attempts to bypass security software and help their activity stay under the radar of defenders. Tools like Havoc and Cobalt Strike are also frequently used by attackers due to their wide array of capabilities. It is often easier for even skilled attackers to use existing tools like this than to develop custom tools of their own with similar capabilities. The use of publicly available tools can also make attribution of activity more difficult for investigators. The steps taken by the attackers, such as killing processes etc., also indicate that keeping this activity hidden was a priority for them.
We have not been able to definitively link Grayling to a specific geography, but the heavy targeting of Taiwanese organizations does indicate that they likely operate from a region with a strategic interest in Taiwan.
– Symantec
