Huntress Uncovers Long-Running Intrusion Targeting Vietnamese Human Rights Nonprofit

Aug 28, 2024 · Original article ↗

Summary

Huntress investigated an intrusion at a nonprofit supporting Vietnamese human rights, suspected to span at least four years. Malware analysis revealed layered persistence, PNG-hidden payloads, and overlaps with APT32/OceanLotus.

Key points

Huntress reconstructed activity across four hosts; persistence artifacts supported a suspected intrusion lasting at least four years.
Attackers maintained access through scheduled tasks, registry run keys, COM handlers, and services, frequently masquerading as legitimate Adobe or Microsoft components.
A malicious DLL decrypted iisexpressshim.sdb using XOR 0xFF and decompressed it with LZNT1; the resulting loader extracted hidden code from logo.png and decrypted a final DLL into memory.
Additional execution chains used legitimate calibre and Dropbox executables for DLL sideloading, Java archives with embedded DLLs, and a malicious Node addon with system-specific paths.
Observed activity included WMI-based remote execution, domain and privilege discovery, attempted named-pipe privilege escalation, and an attempt to steal Chrome cookies shortly before host isolation.
HTTP response behavior and shared service banners supported identification of suspected Cobalt Strike infrastructure; passive DNS connected an active backdoor address to previously documented malware infrastructure.
Huntress identified code, persistence, infrastructure, and targeting overlaps with APT32/OceanLotus, but did not establish definitive attribution.

Article Details

Attack Vectors: Scheduled tasks and registry Run keys maintained multiple persistence mechanisms; the initial access vector was not disclosed.
Scheduled tasks invoked registry-configured COM handlers through DllHost.exe, ultimately loading a multistage backdoor.
Legitimate executables loaded malicious DLLs, including calibre-launcher.dll and goopdate.dll; malicious JAR archives and a Node addon provided additional execution paths.
Remote WMI commands and authenticated remote scheduled-task creation were used to execute implants on additional hosts.
Scripts authenticated to a remote SFTP server using a private key already on disk and downloaded additional files.
The threat actor attempted to steal Google Chrome cookies across user profiles.
Defensive Notes: Huntress identified the intrusion through infrequent administrative commands launched from an unusual process, then correlated those signals with persistent footholds.
Persistence analysis compared task names, descriptions, executable locations, COM registrations, and registry Run keys against normal activity across customer environments.
The malicious iisutil2.dll was padded beyond 50 MB, which researchers believed could evade size-constrained YARA rules and online sandbox submission limits.
A YARA match on the legitimate, signed IIS Express DLL was a false positive; subsequent analysis identified the malicious DLL and associated payload files.
The suspected Cobalt Strike servers shared distinctive HTTP response behavior and a service banner, but infrastructure attribution remained an analytical assessment.
Attribution to APT32/OceanLotus was based on malware, infrastructure, technique, and targeting overlaps rather than a confirmed attribution.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`dupbleanalytics[.]net`	Domain listed in the IOC table for the suspected Cobalt Strike infrastructure at 5.230.35[.]192.
HOSTNAME	`adobe[.]riceaub[.]com`	C2 hostname listed for the malicious DropboxUpdate execution chain, resolving to 46.183.223[.]79.
HOSTNAME	`blank[.]eatherurg[.]com`	C2 hostname listed for the malicious DropboxUpdate execution chain, resolving to 176.103.63[.]48.
HOSTNAME	`cdn[.]arlialter[.]com`	Backdoor-associated domain resolving to 185.198.57[.]184; researchers assessed the domain as likely under long-term threat actor control.
HOSTNAME	`cds55[.]lax8[.]setalz[.]com`	C2 hostname listed for the malicious DropboxUpdate execution chain, resolving to 46.183.223[.]79.
HOSTNAME	`fbcn[.]enantor[.]com`	Backdoor-associated domain resolving to 185.198.57[.]184; researchers assessed the domain as likely under long-term threat actor control.
HOSTNAME	`hx-in-f211[.]popfan[.]org`	C2 hostname listed for the malicious DropboxUpdate execution chain, resolving to 46.183.223[.]79.
HOSTNAME	`kpi[.]adcconnect[.]me`	Hostname associated with the suspected Cobalt Strike server contacted by the calibre implant on host 4.
HOSTNAME	`priv[.]manuelleake[.]com`	C2 hostname listed for the malicious DropboxUpdate execution chain, resolving to 176.103.63[.]48.
HOSTNAME	`var[.]alieras[.]com`	Backdoor-associated domain resolving to 185.198.57[.]184; researchers assessed the domain as likely under long-term threat actor control.
HOSTNAME	`ww1[.]erabend[.]com`	Backdoor-associated domain resolving to 185.198.57[.]184; researchers assessed the domain as likely under long-term threat actor control.
IPV4	`185[.]198[.]57[.]184`	Active connection destination on port 8888 from the DllHost COM-object backdoor.
IPV4	`185[.]43[.]220[.]188`	Active connection destination on port 8888 from the DllHost COM-object backdoor.
IPV4	`5[.]230[.]35[.]192`	Remote address contacted by the malicious Node addon execution chain; assessed as likely Cobalt Strike Team Server infrastructure.
IPV4	`51[.]81[.]29[.]44`	Remote address contacted by a calibre implant posing as AdobeARM.exe; researchers assessed it as likely Cobalt Strike Team Server infrastructure.
SHA256	`09f53e68e55a38c3e989841f59a9c4738c34c308e569d23315fd0e2341195856`	Encrypted iisexpressshim.sdb payload that decrypts into a DLL responsible for loading hidden code from logo.png.
SHA256	`29863f612d2da283148cb327a1d57d0a658d75c8e65f9ef4e5b19835855e981e`	Modified malicious TpmInit.exe that drops and executes a DLL using rundll32; its relationship to the principal intrusion was unknown.
SHA256	`300ef93872cc574024f2402b5b899c834908a0c7da70477a3aeeaee2e458a891`	Malicious msadobe.jar archive that loads embedded zfhqq01v.dll into memory.
SHA256	`47af8a33aac2e70ab6491a4c0a94fd7840ff8014ad43b441d01bfaf9bf6c4ab7`	Malicious iisutil2.dll loader that decrypts iisexpressshim.sdb and contains appended padding exceeding 50 MB.
SHA256	`6719175208cb6d630cf0307f31e41e0e0308988c57772f25494c9d2a2b84e2a1`	Malicious zfhqq01v.dll embedded in msadobe.jar, with a hardcoded user-specific payload path.
SHA256	`6c08a004a915ade561aee4a4bec7dc588c185bd945621ec8468575a399ab81f4`	MSSharePoint.vbs downloader that uses an on-disk private key to authenticate to a remote SFTP server and download and run cloud.bat.
SHA256	`82e94417a4c4a6a0be843ddc60f5e595733ed99bbfed6ac508a5ac6d4dd31813`	logo.png containing steganographically hidden code used by the UpdateLibrary COM-backdoor chain.
SHA256	`8e2e9e7b93f4ed67377f7b9df9523c695f1d7e768c3301db6c653948766ff4c3`	ms-adobe.bin loaded by the malicious Node addon; described as potentially encrypted shellcode or configuration.
SHA256	`a217fe01b34479c71d3a7a524cb3857809e575cd223d2dd6666cdd47bd286cd6`	Additional encrypted iisexpressshim.sdb payload found in a COM-backdoor persistence directory.
SHA256	`a79ced63bdf0ea69d84153b926450cf3119bdea4426476b37dfde2a48a6ede0a`	Malicious mi54giwp.dll embedded in adobe.jar, referencing a hardcoded adobe.png payload path.
SHA256	`b31bfa8782cb691178081d6685d8429a2a2787b1130c6620d3486b4c3e02d441`	Malicious 1lpiozkc.node addon that loads ms-adobe.bin and references the service name SrvAdobeUpd.
SHA256	`c03cc808b64645455aba526be1ea018242fcd39278acbbf5ec3df544f9cf9595`	Malicious goopdate.dll loaded through the legitimate DropboxUpdate executable to load a .bin payload.
SHA256	`c7e2dbc3df04554daa19ef125bc07a6fa52b5ea0ba010f187a082dc9fc2e97ed`	DropboxUpdate.bin, described as likely encrypted shellcode executed through malicious goopdate.dll.
SHA256	`efc373b0cda3f426d25085938cd02b7344098e773037a70404c6028c76cc16fc`	Malicious adobe.jar archive that loads embedded mi54giwp.dll into memory.
SHA256	`f8773628cdeb821bd7a1c7235bb855e9b41aa808fed1510418a7461f7b82fd6c`	logo.png containing hidden code in the Microsoft Compatibility Appraiser COM-backdoor directory.