Dynamite Panda is a name for APT18. MITRE ATT&CK says this threat group has operated since at least 2009. This post describes it as a Chinese state-sponsored actor. It targets health, telecommunications, defense and high-tech organizations and human rights groups. Most of its targets are in the United States. Its tools include phishing emails, Flash 0-day exploits and Pisloader malware.
Who is Dynamite Panda (APT18)?
| Country | |
| Sponsor | State-sponsored (this post’s assessment) |
| First Seen | 2009 |
| Motivation | Information theft & Espionage |
| Methods | Flash 0-days, Malware, Phishing Email |
The threat group APT18, operating since 2009, is referenced by various security providers with the following names.
- APT18
- Wekby
- Dynamite Panda
- Scandium
Although not sure, we thought the APT18 might be related to Night Dragon and/or Covert Grove groups.
Vision, Mission, and Motivation
This post describes APT18 as a Chinese state-sponsored threat actor active globally since 2009. MITRE ATT&CK does not name a sponsor. Treat the sponsor as the post’s own assessment.
APT18 has been active for years. It targets the health, telecommunications, defense and high technology sectors, and human rights groups. The group is also known for information theft and espionage in these sectors.
Which countries does APT18 target?
APT18 has focused its activities on the United States (USA).
Which industries does Dynamite Panda target?
APT18 ran a Community Health Systems campaign that resulted in a data breach. Turning to medical espionage, APT18 seized patient data. It used this to target intelligence on medical device development.
APT18 has campaigned for the telecommunications, defense, and high-tech industries serving the United States. APT18 used the Flash 0-day exploit and HTTPBrowser malware in these campaigns.
What operations has Dynamite Panda carried out?
2014
- Community Health Systems Data Breach
APT18 has managed to steal information from vulnerable health systems. This includes patient information, medical device information, and intellectual property rights. The stolen material could be used to reach high international standards in various industries. It could also be used for China’s profit.
2015-16
- Phishing Campaign for Organizations in the United States
APT18 has attacked many US-based organizations. It spread the Flash 0-day exploit, HTTPBrowser and Pisloader malware via phishing emails and URLs.
- Also known as
- Dynamite Panda, TG-0416 (MITRE ATT&CK)
- Active
- At least since 2009 (MITRE ATT&CK)
- Sectors named by MITRE
- Technology, manufacturing, human rights groups, government, medical
- Malware in this post
- Pisloader, HTTPBrowser
- Initial access
- Phishing emails and stolen credentials on remote services
Mitre ATT&CK Threat Matrix
It defines the techniques, tactics, and procedures identified in attacks by the APT18 threat group.
| Tactic ID | Tactic Name | Technique ID | Technique Name |
| TA0001 | Initial Access | T1133 | External Remote Services Phishing |
| TA0002 | Execution | T1059.003 | Command and Scripting Interpreter: Windows Command Shell Scheduled Task/Job: At |
| TA0003 | Persistence | T1547 | Boot or Logon Autostart Execution Valid Accounts |
| TA0005 | Defense Evasion | T1070.004 | Indicator Removal on Host: File Deletion Obfuscated Files or Information |
| TA0007 | Discovery | T1083 | File and Directory Discovery System Information Discovery |
| TA0011 | Command and Control | T1071.001 | Application Layer Protocol: Web Protocols Application Layer Protocol: DNS Ingress Tool Transfer |
External Remote Services
Phishing credentials are the next best option when APT18 fails its malware campaigns. APT18 uses these credentials against resources that provide remote network access. Examples are Open Terminal Service / RDP, Web / SSL VPN, and Citrix/Moka5/VNC.
Phishing
APT18 used phishing emails containing malicious URL links with the theme “Flash Update” in some of its campaigns.
Command and Scripting Interpreter: Windows Command Shell
APT18 takes advantage of the Windows Command Shell (cmd.exe) feature to execute commands on the target machine. For example;
cmd.exe /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v lsm /t reg_sz /d “%appdata%\lsm.exe” /f
Scheduled Task/Job: At
The threat actor used scheduled tasks via the at.exe application to move horizontally within the target infrastructure. In an example scenario, two files are created for the job at about the same time, as follows.
C:\Windows\System32\Tasks\At1
C:\Windows\Tasks\At1.job
The first file is an XML file. It can be opened and viewed in a text editor to use the scheduled task. The second file is binary.
Boot or Logon Autostart Execution
APT18 uses the following registry key to ensure persistence on the target system.
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
When the first stage malware (dropper) runs, the name of the executable file that provides persistence is written to this registry path.
Valid Accounts
APT18 uses compromised account information to access services that provide remote network access. Threat actors usually obtain this account information through phishing attacks. They may also get it from data leaked from breached systems.
Indicator Removal on Host: File Deletion
Tools and scripts run by tasks scheduled by APT18 are deleted from the target system. However, even if it deletes the used files afterward, remnants of the functionality remain on the target system. This reduces the chances of the threat actor staying hidden.
Obfuscated Files or Information
APT18 has hidden the additional payload data in the Pisloader malware used in its campaigns. It does this with the Return-Oriented-Programming (ROP) technique. This process uses garbage assembly instructions that will not affect the program flow. It also uses PUSH/RET assembly instructions. These jump to the location of the malicious code that will run.
File and Directory Discovery
The Pisloader malware used by APT18 supports a command called list. This command can list file information for specific directories. For example, listing the contents of the C:\ directory gives an output like the one below.
[+] Sending Command: list C:\ | Encoded: CNRUXG5BAIM5FY
[+] Raw Data Received: QKTUMGAGLAGB6CIUTFMN4WG3DFFZBGS3T4GIYDCNJPGAZS6MRW
[+] Raw Data Received: EKNPMGAGL0EAYTIORUGA5DKN34GB6DEMS6
[+] Raw Data Received: RKMAMGAGLAGF6GC5LUN5SXQZLDFZRGC5D4GIYDAOJPGA3C6MJQ
[+] Raw Data Received: NMSIMGAGL0EAZDCORUGI5DEMD4GI2HYMZSLY
[+] Raw Data Received: OHRWMGAGLAGB6EE33POR6DEMBRGUXTAMZPGI3CAMJWHIZDIORQ
[+] Raw Data Received: DPDUMGAGL0GJ6DA7BSGJPA
[+] Raw Data Received: WIKGMGAGLAGF6GE33PORWWO4T4GIYDCNBPGA3C6MRYEAYDAORS
* Truncated*
[+] Decoded Data Received: 0|$Recycle.Bin|2015/03/26 14:40:57|0|22^1|autoexec.bat|2009/06/10 21:42:20|24|32^0|Boot|2015/03/26 16:24:02|0|22^1|bootmgr|2014/06/28 00:21:34|391640|39^1|BOOTSECT.BAK|2015/03/26 16:35:39|8192|39^1|config.sys|2009/06/10 21:42:20|10|32^0|Documents and Settings|2009/07/14 04:53:55|0|9238^1|Example.log|2016/02/09 20:17:55|0|32^1|pagefile.sys|2016/04/25 14:09:20|1660411904|38^0|PerfLogs|2009/07/14 02:37:05|0|16^0|Program Files|2016/02/29 15:59:43|0|17^0|ProgramData|2016/02/02 17:28:04|0|8210^0|Python27|2016/02/25 16:39:37|0|16^0|Recovery|2015/03/26 14:39:57|0|8214^0|System Volume Information|2016/02/29 16:00:19|0|22^0|Users|2015/03/26 14:39:58|0|17^0|Windows|2016/02/12 10:20:21|0|16^^end^
System Information Discovery
The Pisloader malware used by APT18 supports a command called sifo. This command can collect system information from the target machine. For example;
[+] Sending Command: sifo | Encoded: CONUWM3Y
[+] Raw Data Received: FUBWMGAGIANQ6TCNZSFYYTMLRRFYYTKMZGMM6VOSKOFVGEUTCW
[+] Raw Data Received: PGHRMGAGIBGJHEWSKPJNICAW2KN5ZWQICHOJ2W46TXMVUWOXJG
[+] Raw Data Received: MMAZMGAGI0N46TMLBRFQZTE
[+] Decoded Data Received: l=172.16.1.153&c=WIN-LJLV2NKIOKP [Josh Grunzweig]&o=6,1,32
Application Layer Protocol: Web Protocols & DNS
APT18 can use HTTP and DNS protocols to communicate with C2 servers while extracting the captured information from the target system. DNS as C2 allows Pisloader malware to get around certain security products. These products do not correctly control this traffic.
The DNS TXT record is used to exchange commands to be executed on the target system between the malware and C2.
Ingress Tool Transfer
The Pisloader malware used by APT18 supports a command called upload. The threat actor can install additional files on the target machine with this command.
Conclusion & Recommendations
Now you have detailed information about the Chinese state-backed threat actor APT18. This covers its toolkits, malware, techniques, tactics and procedures, targeted countries, and sectors. Check the information in the report to see whether you are among its potential targets.
The report shows what types of interactions you should look for. These range from initial access to actions taken on compromised systems.
- PhishingEmails or links with a Flash Update themeTechnique T1566 (MITRE ATT&CK, opens in a new tab)
- Command shellcmd.exe runs commands on the targetTechnique T1059.003 (MITRE ATT&CK, opens in a new tab)
- PersistenceRun registry key keeps the malwareTechnique T1547 (MITRE ATT&CK, opens in a new tab)
- DNS command and controlTXT records carry commands to PisloaderTechnique T1071.004 (MITRE ATT&CK, opens in a new tab)
- Tool transferThe upload command installs more filesTechnique T1105 (MITRE ATT&CK, opens in a new tab)
- Network Intrusion Prevention systems use network signatures to identify traffic from attacking malware. They can help reduce network-level malware activities.
- You can filter DNS requests for unknown, untrusted, or known bad domains and resources. Resolving DNS requests can also detect attempts to hide data within DNS packets.
- You might consider blocking code execution on a system through application control and/or script blocking.
- Disable or block any remotely available services that may be unnecessary.
- You can restrict access to remote services through VPN and other remote access systems.
- Consider using strong two-factor or multi-factor authentication to reduce the threat actor’s ability to use stolen credentials.
- You can prevent direct remote access to internal systems using proxy, gateway, and firewalls.
- You can monitor the commands and arguments executed for actions that can be used to unlink, rename, or delete files.
Brandefense now keeps a full APT18 threat group profile in the Knowledge Hub. It follows the public record from MITRE ATT&CK and a US health sector briefing. It states attribution as those sources give it.