Antlion APT linked with China

A cyberespionage campaign  of a China-linked APT group tracked as Antlion is using a custom backdoor called xPack in attacks aimed at financial organizations and manufacturing companies gone detected more years.  

xPack is a custom backdoor with a .Net loader that deployed which allowed threat actors to run WMI commands remotely and mount shares over SMB  executes AES-encrypted payloads to transfer data from C2 servers to them. The malware was also used by the attackers to browse the web, likely using it as a proxy to mask their IP address.

Attackers were exploiting CVE-2019-1458 for privilege escalation and remote scheduled tasks to execute their backdoor.

Researchers analyzed one of the attacks carried out by the APT group that remained in the compromised network of a manufacturing organization for 175 days and in another attack against a financial institution remained active for 250 days

It’s been speculated that the attackers exploited a web application or service because they noticed in one attack that threat actors were utilizing the MSSQL service to execute system commands. But not arrived at a conclusion on initial attack vectors.

Following are the custom tools used by Antlion in this campaign:

• EHAGBPSL loader – custom loader written in C++ – loaded by JpgRun loader
• JpgRun loader – customer loader written in C++ – like xPack, reads the decryption key and filename from the command line – decodes the file and executes it
• CheckID – custom loader written in C++ – based on loader used by BlackHole RAT
• NetSessionEnum – Custom SMB session enumeration tool
• ENCODE MMC – Custom bind/reverse file transfer tool
• Kerberos golden ticket tool based on the Mimikatz credentials stealer

Attackers also used legitimate versions of WinRAR appear for data exfiltration and batch scripts to automate the data collection process. In some cases, threat actors staged stolen data for further exfiltration.

The threat actors were returning periodically in the compromised network to launch xPack again and steal account credentials from the compromised organizations.

Indicators of Compromise

SHA2 hashes