ToneShell Malware Targets IISS Defence Summit Attendees in Suspected Espionage Campaign
Summary
Researchers analyzed an IISS summit-themed lure that drops ToneShell-related malware, establishes persistence, and communicates with suspected Mustang Panda infrastructure. The campaign’s specific objectives were not confirmed.
Key points
- Researchers found a summit-themed executable uploaded to malware-analysis platforms and assessed it as likely targeting attendees of the 2024 IISS Defence Summit in Prague.
- The lure pairs a malicious PIF file with a genuine summit agenda PDF to reduce suspicion.
- The PIF drops SFFWallpaperCore.exe and libemb.dll, then creates a scheduled task for persistence.
- The DLL contains strings associated with Mustang Panda malware; attribution to the group is suspected rather than confirmed.
- The malware communicates with a C2 server over raw TCP while mimicking TLS traffic.
- Researchers identified seven servers sharing an RDP certificate date associated with the suspected infrastructure; the C2 IP had no VirusTotal detections at the time of writing.
- The researchers could not determine the attackers’ actions after infection; they recommend verifying senders and downloads and using endpoint detection and response.
Article Details
- Attack Vectors
- A summit-themed archive contained a PIF file disguised as an agenda executable and a decoy PDF copied from a legitimate IISS document.
- The PIF acted as a dropper, placing SFFWallpaperCore.exe and libemb.dll in C:\ProgramData\FFWallpaperCore.
- The dropped executable established persistence by creating a scheduled task configured to run every six minutes.
- The malware communicated with its C2 server over raw TCP while mimicking TLS traffic.
- Defensive Notes
- Conduct regular phishing-awareness exercises and verify email senders and domain names before downloading files.
- Deploy endpoint detection and response to identify malicious execution patterns.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 057fd248e0219dd31e1044afb7bc77c5f30a7315e136adfcca55ce1593d6cf5d | SHA-256 listed for the malicious PIF dropper and its dropped executable. |
| SHA256 | 1387ec22a3391647e25d2cb722cd89e255d3ebfe586cf5f699eae22c6e008c34 | SHA-256 of the summit-themed lure archive. |
| SHA256 | 901d713d4d12afbcee5e33603459ebc638afd6b4e2b13c72480c90313b796a66 | SHA-256 of the decoy PDF distributed with the malicious files. |
| SHA256 | f8e130e5cbbc4fb85d1b41e1c5bb2d7a6d0511ff3b224eb3076a175e69909b0d | SHA-256 of libemb.dll, dropped by the malicious PIF. |
MITRE ATT&CK
T1036 · MasqueradingThe PIF file is disguised as a summit agenda executable, and the accompanying PDF is a decoy.T1053.005 · Scheduled TaskThe malware creates a scheduled task named FFWallpaperEmbCore configured to run every six minutes.T1573 · Encrypted ChannelC2 traffic uses raw TCP while mimicking TLS.
People
Threat Actors
APT-Q-27A suspected operation described in a cited April 2024 blog post; the article says it used fhbemb.exe to sideload libemb.dll and execute a modified Gh0st RAT.Dragon BreathNamed in the article as an alternative name for APT-Q-27.Earth PretaNamed in the article as an alternative name for Mustang Panda.Golden Eye DogNamed in the article as an alternative name for APT-Q-27.Mustang PandaAssociated with ToneShell and the C2 infrastructure; the article says Mustang Panda is also known as Stately Taurus and Earth Preta.Stately TaurusNamed in the article as an alternative name for Mustang Panda.
Malware
Gh0st RATAn April 2024 blog post by secrss uncovered a suspected APT-Q-27 (aka Golden Eye Dog, Dragon Breath) operation that also used ‘fhbemb.exe’ to side load ‘libemb.dll’ to execute a modified version of Gh0st RAT.PubloadThese bytes often appear in posts and reports as indicators of Toneshell and PubLoad activity.TONESHELLThe ToneShell backdoor, frequently associated with Mustang Panda (also known as Stately Taurus and Earth Preta, among other monikers), has been consistently deployed against government organizations, mainly in Southeast
Vendors
Products
ANY.RUNFile Discovery In Triage & ANY.RUNHatching TriageWhile combing through files on Hatching Triage, one name stood out, prompting us to investigate further and share our findings in this article.Microsoft WindowsIn our research, we were unable to locate information suggesting either of the above file names (fhbemb.exe and SFFWallpaperCore.exe) are legitimate Windows programs.VirusTotalFigure 6: Codesigning certificate used for the malicious PIF-fileAnalyzing the file in VirusTotal reveals the PIF-file has two aliases: fhbemb.exe and SFFWallpaperCore.exe.
Countries
Industries
Defenseand international strategy often intertwine as nations seek to infiltrate sensitive security and defense discussions to gain a strategic edge amid global conflicts, from the Russia-Ukraine war to risingGovernmentknown as Stately Taurus and Earth Preta, among other monikers), has been consistently deployed against government organizations, mainly in Southeast and East Asia, for cyber espionage.