G0082: APT38

APT38 has used Hermes ransomware to encrypt files with AES256.[2]

APT38 has injected malicious payloads into the `explorer.exe` process.Citation1 - appv APT38 has also injected malicious binaries directly into memory on compromised hosts.[5]

APT38 has identified primary users, currently logged in users, sets of users that commonly use a system, or inactive users.[1] APT38 has run malware to enumerate the current user on compromised hosts.[6][7]

APT38 has conducted cryptocurrency theft.CitationMicrosoft CYBERWARCON NOV 2024

APT38 uses a tool called CLEANTOAD that has the capability to modify Registry keys.[2]

APT38 has named malicious payloads as benign-looking executables to blend in the environment including Run keys, npm packages, and JavaScript utilities often using names mirroring Apple, Windows, or other native system files.[5][7][6]

APT38 has poisoned npm packages with fake runtime dependencies to trigger execution of malicious payloads on developer endpoints or continuous integration and continuous delivery (CI/CD) systems during npm installation or update.[5][7]

APT38 installed a port monitoring tool, MAPMAKER, to print the active TCP connections on the local system.[2]

APT38 has used a utility called CLOSESHAVE that can securely delete a file from the system. APT38 has also removed malware, tools, scripts, or other non-native files used during the intrusion to reduce their footprint or as part of the post-intrusion cleanup process.[2][1][6][5]

APT38 has put several spaces before a file extension to avoid detection and suspicion.Citation1 - appv

APT38 has uploaded malware to cloud storage services for download by targeted victims.[7]

APT38 used a Trojan called KEYLIME to capture keystrokes from the victim’s machine.[2]

APT38 has leveraged a fictitious native macOS password dialog prompt to entice victims to enter credentials.[7]

APT38 has identified security software, configurations, defensive tools, and sensors installed on a compromised system.[1]Citation1 - appv APT38 has also executed malware implants to enumerate all installed applications on Windows hosts including installed security products.[7]

APT38 has installed a new Windows service to establish persistence.[1] APT38 has gained persistence on compromised systems independent of user logon by creating a background service using `sc create scdev binPath= "c:\windows\system32\svchost.exe -k scdev".[7]

APT38 has used remote access tools that run AppleScript using ` nohup osascript` to ignore hangup signals.[5]

APT38 has copied Apple Notes database from its application container and staged for upload.[6]

APT38 has used the legitimate application `ieinstal.exe` to bypass UAC.Citation1 - appv

APT38 has delayed C2 beaconing to longer intervals on network failures.[7]

APT38 has conducted watering holes schemes to gain initial access to victims.[2][1]

APT38 has created fictitious profiles on social media utilizing fake photos and personas to entice users to engage in the schemes.CitationMicrosoft CYBERWARCON NOV 2024

APT38 has used a multiplatform implant that can write to `~/.config/systemd/nvmconf/` to gain persistence on Linux hosts.[7]

APT38 has enumerated files and directories, or searched in specific locations within a compromised host.[1][5][6]

APT38 has gathered Telegram Desktop messaging data from the applications data directories stored on the victim device to include cryptographic key material, and session mapping files that can recreate a compromised user’s Telegram session on another system.[6]

APT38 has executed scripts to delete the PowerShell command history file.[7]

APT38 has used a command-line tunneler, NACHOCHEESE, to give them shell access to a victim’s machine.[2] Additionally, APT38 has used batch scripts.Citation1 - appv[7] APT38 has also executed scripts to launch `cmd.exe` to POST stolen data to actor-controlled domains.[5]

APT38 has used the RC4 algorithm to decrypt configuration data. Citation1 - appv APT38 has decocoded Base64 encoded PowerShell scripts prior to execution.[7]

APT38 has sent Mac users.scpt files to trigger malicious downloads.CitationMicrosoft CYBERWARCON NOV 2024 APT38 has targeted macOS uses with native script stagers leading to malicious paylaods.[5] APT38 has also used an AppleScript-based credential harvesting component.[6]

APT38 has displayed a fake “system update complete” dialog to the user following successful deployment of malicious payloads.[6]

APT38 has set up anonymous emails to use in publishing poisoned software packages such as sergey2016@tutamail[.]com.[7]

APT38 has used VBScript to execute commands and other operational tasks.[1]Citation1 - appv APT38 has sent Windows victims Visual Basic script stagers leading to malicious downloads.CitationMicrosoft CYBERWARCON NOV 2024[5] APT38 has also used VBScript to execute scripts for data exfiltration.[5]

APT38 has staged files in a central location prior to exfiltration.[6][7]

APT38 has used professional platforms such as LinkedIn to contact potential victims.CitationMicrosoft CYBERWARCON NOV 2024[5][6][7]

APT38 has compressed its malicious payloads in ZIP files for delivery to victims.[6]

APT38 has used a custom MBR wiper named BOOTWRECK, which will initiate a system reboot after wiping the victim's MBR.[2]

APT38 has used links to execute a malicious Visual Basic script.Citation1 - appv APT38 has directed users to navigate to a website under adversary control through the sharing of links in messages.CitationMicrosoft CYBERWARCON NOV 2024[7][5]

APT38 used a backdoor, QUICKRIDE, to communicate to the C2 server over HTTP and HTTPS.[2] APT38 has also configured malicious payloads to communicate with C2 using HTTP POST requests that blend in with common traffic.[5][6]

APT38 used a backdoor, NESTEGG, that has the capability to download and upload files to and from a victim’s machine.[2] Additionally, APT38 has downloaded other payloads onto a victim’s machine.Citation1 - appv APT38 has also injected npm packages with malicious dependencies that download second-stage payloads to victim machines.[5][7]

APT38 has unhooked DLLs to disable endpoint detection and response (EDR) or anti-virus (AV) tools.Citation1 - appv

APT38 has used OneDrive and GoogleDrive to host malicious files.[5][7]

APT38 has run node.js malware to query the Registry to discover installed software.[7]

APT38 has used several code packing methods such as Themida, Enigma, VMProtect, and Obsidium, to pack their implants.[2]

APT38 has collected browser bookmark information to learn more about compromised hosts, obtain personal information about users, and acquire details about internal network resources.[1] APT38 has also used malware capable of enumerating 166 unique cryptocurrency wallets, browser extensions, and browser history.[7]

APT38 clears Window Event logs and Sysmon logs from the system.[2]

APT38 has impersonated recruiters and venture capitalists to lure victims into connecting to malicious skills assessments or online business meetings.CitationMicrosoft CYBERWARCON NOV 2024

APT38 has used social media sites such as LinkedIn to send malicious links to potential vicitims.[5][7]

APT38 has used Python versions of its remote access tools on Linux targets.[5]

APT38 has executed a multiplatform implant that placed launch agents in ~/Library/NodePackages/ to establish persistence on macOS.[7]

APT38 has used a renamed version of `mshta.exe` to execute malicious HTML files.Citation1 - appv

APT38 has modified data timestamps to mimic files that are in the same folder on a compromised host.[1]

APT38 have created firewall exemptions on specific ports, including ports 443, 6443, 8443, and 9443.[1]

APT38 has leveraged file discovery actions to determine if a predetermined file is present prior to execution to prevent redundant execution on a compromised device.[6]

APT38 has used virtual private server (VPS) providers to host C2 infrastructure including Hostwinds.[7]

APT38 has used a custom secure delete function to make deleted files unrecoverable.[2]

APT38 has used brute force techniques to attempt account access when passwords are unknown or when password hashes are unavailable.[1]

APT38 has run malware to discover the system time on compromised hosts.[6]

APT38 has run malicious payloads using Linux and Unix shells. APT38 has also executed Unix commands sequentially using `&&` and in the background with `&`.[5] [6]

APT38 has enumerated network shares on a compromised host.[1][6]

APT38 has used ISO and VHD files to deploy malware and to bypass Mark-of-the-Web (MOTW) security measures.Citation1 - appv

APT38 has exfiltrated stolen credentials to actor-controlled infrastructure leveraging Telegram Bot API.[7]

APT38 has attempted to get detailed information about a compromised host, including the operating system, version, patches, hotfixes, and service packs.[1] APT38 has executed malware to collect current user, host name, system time, and operating system install date from targeted systems.[5][6][7]

APT38 has injected malicious dependencies into software packages such as Axios and Mastra npm packages.[5][7]

APT38 has utilized Base64 encoded HTTP POST communications to C2.[7]

APT38 has used DYEPACK to manipulate SWIFT messages en route to a printer.[2]

APT38 has exfiltrated victim device and user details contained in a POST request to register the compromised system with C2 infrastructure.[6][7]

APT38 have created firewall exemptions on specific ports, including ports 443, 6443, 8443, and 9443. [1]

APT38 has used a custom MBR wiper named BOOTWRECK to render systems inoperable.[2]

APT38 has renamed system utilities, such as `rundll32.exe` and `mshta.exe`, to avoid detection.Citation1 - appv

APT38 has prepended a space to all of their terminal commands to operate without leaving traces in the HISTCONTROL environment.[1] APT38 has prevented logging and muted error logs through the use of `/dev/null 2>&1 &`. [5][6] APT38 has also executed scripts to delete the PowerShell command history file and to prevent future history recording using `-Force Set-PSReadLineOption -HistorySaveStyle SaveNothing`.[7]

APT38 has configured malware to rename malicious payloads with naming conventions that reduce a chance of detection to include renaming “package.md” to “package.json”.[5]

APT38 has used Task Scheduler to run programs at system startup or on a scheduled basis for persistence.[1] Additionally, APT38 has used living-off-the-land scripts to execute a malicious script via a scheduled task.Citation1 - appv

APT38 has gathered cryptographic key data related to cryptocurrency wallets, SSH keys, and messaging applications to include Telegram.[6]

APT38 has obtained and used open-source tools such as Mimikatz.CitationESET Lazarus KillDisk April 2018

APT38 has used web shells for persistence or to ensure redundant access.[1]

APT38 has gathered data and credentials stored in Shell History.[7]

APT38 used a Trojan called KEYLIME to collect data from the clipboard.[2]

APT38 has gathered Web browser data to include saved credentials, cookies, bookmarks, autofill data, and extension-specific storage. APT38 has also sought cryptocurrency wallet extensions.[6][7]