APT-C-60 Attacking HR Department With Weaponized Resumes

APT-C-60 launched a phishing attack in August 2024, targeting domestic organizations with malicious emails disguised as job applications.

These emails, sent to recruitment departments, contained malware designed to compromise systems and potentially steal sensitive data. 

The attack leverages a targeted phishing email to distribute a malicious VHDX file hosted on Google Drive.

- Advertisement -

Once mounted, the VHDX file releases an LNK file, which likely executes malicious code upon interaction, compromising the victim’s system.

The LNK file triggers a malicious script that executes the legitimate git.exe to launch a downloader named SecureBootUEFI.dat, which persists on the system by hijacking a COM interface and registers itself to be executed automatically.

Analyze cyber threats with ANYRUN's powerful sandbox. Black Friday Deals : Get up to 3 Free Licenses.

SecureBootUEFI.dat malware initially contacts StatCounter to identify infected devices based on unique device information.

Subsequently, it downloads a malicious payload from Bitbucket, exploiting a unique URL path derived from device-specific data, and executes it locally.

The Service.dat malware downloads and decodes two files from a different Bitbucket repository, which are then persisted to the user’s font directory using Base64 and XOR encryption, and subsequently through COM interface hijacking. 

A backdoor named SpyGrace v3.1.6 confirms its existence through version information and matching elements like command type and encryption keys with previously reported v3.0.

Backdoor initialization begins by loading configuration data, establishing a mutex (905QD4656:H) to prevent duplicate instances, and verifying network connectivity with api.ipfy.org. 

Finally, it locates and executes specific file types (.exe, .dat, .db, and .ext) within the user’s roaming profile directory (%appdata%\Microsoft\Vault\UserProfileRoaming).

Through its execution prior to the DllMain function, the initterm function of the CRT pre-processed the initialization phase, thereby having an effect on the initial state of the DLL.

According to JPCERT, recent malware campaigns, leveraging services like Bitbucket and StatCounter, have employed COM hijacking for persistence, which, similar to those targeting East Asian nations, suggests a broader threat landscape involving sophisticated techniques and potential espionage motives.

The attack, targeting East Asia, leverages legitimate services like Bitbucket and StatCounter to deliver malicious payloads as the attack’s tactics and techniques, including the used samples and command-and-control infrastructure.

Leveraging 2024 MITRE ATT&CK Results for SME & MSP Cybersecurity Leaders – Attend Free Webinar