Unit 42 Details Suspected China-Nexus Espionage Campaign Targeting Southeast Asian Military
Summary
Unit 42 describes CL-STA-1087, a suspected China-nexus espionage cluster targeting Southeast Asian military organizations since at least 2020, and analyzes its AppleChris and MemFun backdoors, Getpass credential harvester, and evasion methods.
Key points
- Unit 42 assesses CL-STA-1087 as a suspected state-sponsored, China-nexus cluster active since at least 2020; the initial infection vector remains unknown.
- The operators maintained dormant access for months and selectively sought military records on capabilities, organizational structures, and cooperation with Western armed forces.
- AppleChris and MemFun used custom command-and-control mechanisms, including dead drop resolvers hosted through Pastebin and Dropbox.
- AppleChris spread through WMI and .NET commands and supported remote shell use, file transfers, and proxy tunneling.
- MemFun used process hollowing and reflective loading to run payloads in memory; its dropper also used timestomping and erased PE headers.
- The Getpass tool, a modified Mimikatz variant, attempted to extract passwords, NTLM hashes, and other authentication data from LSASS memory.
Article Details
- Attack Vectors
- The initial infection vector was undetermined; attackers maintained access through a compromised unmanaged endpoint.
- PowerShell scripts executed remotely from the unmanaged endpoint, slept for six hours, and then opened reverse shells to C2 servers.
- Attackers used WMI and native Windows .NET commands to deploy malware to additional endpoints and move laterally.
- AppleChris and MemFun backdoors used Pastebin and, for one AppleChris variant, an attacker-controlled Dropbox account to resolve C2 infrastructure.
- Attackers established persistence through a new service and by registering a malicious DLL for loading by a shadow copy service.
- MemFun used process hollowing and reflective loading to execute payloads in memory; its dropper also changed its file timestamp to match the Windows System directory.
- Getpass targeted Windows authentication packages and attempted to extract passwords, NTLM hashes, and other authentication data from lsass.exe.
- The attackers searched for and collected selected files concerning military capabilities, organizational structures, and joint military activities.
- Defensive Notes
- The article recommends using its published indicators and analysis to strengthen detection and protection against this activity.
- Cortex XDR and XSIAM are described as helping prevent the threats through the Malware Prevention Engine.
- Advanced WildFire is reported to identify the AppleChris and MemFun samples as malicious; Advanced URL Filtering and Advanced DNS Security identify known network indicators as malicious.
- Monitor for suspicious PowerShell activity, WMI-based deployment, service creation, DLL hijacking, and unusual access to lsass.exe, all of which were observed in the campaign.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 109[.]248[.]24[.]177 | C2 server contacted by the attackers' PowerShell reverse-shell scripts. |
| IPV4 | 116[.]63[.]177[.]49 | C2 server address identified in the article's infrastructure indicators. |
| IPV4 | 118[.]194[.]238[.]51 | C2 server address identified in the article's infrastructure indicators. |
| IPV4 | 154[.]39[.]137[.]203 | C2 server contacted by the attackers' PowerShell reverse-shell scripts. |
| IPV4 | 154[.]39[.]142[.]177 | C2 server contacted by the attackers' PowerShell reverse-shell scripts. |
| IPV4 | 8[.]212[.]169[.]27 | C2 server contacted by the attackers' PowerShell reverse-shell scripts. |
| IPV4 | 8[.]220[.]135[.]151 | C2 server address identified in the article's infrastructure indicators. |
| IPV4 | 8[.]220[.]177[.]252 | C2 server address identified in the article's infrastructure indicators. |
| IPV4 | 8[.]220[.]184[.]177 | C2 server address identified in the article's infrastructure indicators. |
| SHA256 | 0e255b4b04f5064ff97da214050da81a823b3d99bce60cdd9ee90d913cc4a952 | SHA256 hash of an AppleChris Tunneler variant. |
| SHA256 | 2ee667c0ddd4aa341adf8d85b54fbb2fce8cc14aa88967a5cb99babb08a10fae | SHA256 hash of an AppleChris Dropbox variant. |
| SHA256 | 413daa580db74a38397d09979090b291f916f0bb26a68e7e0b03b4390c1b472f | SHA256 hash of an AppleChris Dropbox variant. |
| SHA256 | 5a6ba08efcef32f5f38df544c319d1983adc35f3db64f77fa5b51b44d0e5052c | SHA256 hash of an AppleChris Tunneler variant. |
| SHA256 | 9e44a460196cc92fa6c6c8a12d74fb73a55955045733719e3966a7b8ced6c500 | SHA256 hash of an AppleChris Tunneler variant. |
| SHA256 | ad25b40315dad0bda5916854e1925c1514f8f8b94e4ee09a43375cc1e77422ad | SHA256 hash of a MemFun sample. |
| SHA256 | ee4d4b7340b3fa70387050cd139b43ecc65d0cfd9e3c7dcb94562f5c9c91f58f | SHA256 hash of a Getpass sample. |
MITRE ATT&CK
T1003 · OS Credential DumpingGetpass attempted to extract plaintext passwords, NTLM hashes, and authentication data from lsass.exe memory.T1041 · Exfiltration Over C2 ChannelAppleChris supported uploading files from compromised systems to the C2 server.T1047 · Windows Management InstrumentationWMI was used with native .NET commands to deploy malware to additional endpoints.T1055.001 · Dynamic-link Library InjectionThe MemFun shellcode performed reflective DLL loading to execute the backdoor in memory.T1055.012 · Process HollowingThe MemFun dropper injected decrypted shellcode into a suspended dllhost.exe process.T1059.001 · PowerShellPowerShell scripts were used to execute malicious commands remotely and establish reverse shells.T1070.006 · TimestompThe MemFun dropper set its creation timestamp to match the Windows System directory.T1071.001 · Web ProtocolsThe backdoors communicated with C2 over HTTP using custom request verbs.T1090 · ProxyThe AppleChris Tunneler variant could create a reverse TCP tunnel for network pivoting.T1102 · Web ServicePastebin and an attacker-controlled Dropbox account were used as dead-drop resolvers for C2 addresses.T1134 · Access Token ManipulationThe MemFun downloader impersonated logged-on user credentials to inherit proxy settings.T1497 · Virtualization/Sandbox EvasionAppleChris and MemFun used sleep delays to evade automated monitoring and analysis.T1543.003 · Windows ServiceAttackers created a new Windows service to facilitate payload execution and persistence.T1574.001 · DLLA malicious AppleChris DLL was placed in system32 and registered to load through a shadow copy service.
Threat Actors
Malware
AppleChrisThe actors deployed custom backdoors AppleChris and MemFun, a Mimikatz-derived credential harvester Getpass, and used Dead Drop Resolvers via Pastebin and Dropbox for resilient C2 infrastructure.GetpassThe actors deployed custom backdoors AppleChris and MemFun, a Mimikatz-derived credential harvester Getpass, and used Dead Drop Resolvers via Pastebin and Dropbox for resilient C2 infrastructure.MemFunThe actors deployed custom backdoors AppleChris and MemFun, a Mimikatz-derived credential harvester Getpass, and used Dead Drop Resolvers via Pastebin and Dropbox for resilient C2 infrastructure.
Vendors
Products
Cortex XDRThe investigation began after Cortex XDR agents, newly deployed across the environment, detected suspicious PowerShell activity indicating an existing compromise.Microsoft WindowsInitial spread and lateral movement leveraged Windows Management Instrumentation (WMI) and .NET commands, targeting domain controllers, web servers, workstations and executive assets.XSIAMCortex XDR and XSIAM help to prevent the threats described above, by employing the Malware Prevention Engine.