REF2924Threat actor
A group monitored as REF2924 by Elastic Security Labs is wielding novel data-stealing malware — an HTTP listener written in C# dubbed Naplistener by the researchers — in attacks against victims operating in southern and southeast Asia.From MISP Galaxy
Last reported 20 months ago, by Elastic Security Labs7 reports
ATT&CK techniques
6 of 31 · each with the sentence it comes from- T1053.005Scheduled Task
“# Hunt for scheduled task or service from a suspicious path:”
- T1036Masquerading
“Potential Masquerading as SVCHOST”
- T1055Process Injection
“Process injection”
- T1059Command and Scripting Interpreter
“Command and Scripting Interpreter: Windows command-shell”
- T1505.003Web Shell
“Deploy web shells”
- T1543.003Windows Service
“Both Microsoft.Exchange.Entities.Content.dll and iisrehv.dll were loaded using the iissvcs module of the Windows Service Host through the execution of C:\Windows\system32\svchost.exe -k iissvcs.”
What the reports say
7 reports, newest first · the exact sentence from each-
From South America to Southeast Asia: The Fragile Web of REF7707“SIESTAGRAPH, similarly, was the first in-the-wild graph API abuse we had observed, and it (REF2924) involved an attack on a Southeast Asian nation’s Foreign Ministry.”
-
Introducing the REF5961 intrusion set“The samples in this research were discovered to be co-residents with a previously reported intrusion set, REF2924 (original reporting here and updated here).”
-
NAPLISTENER: more bad dreams from developers of SIESTAGRAPH“While continuing to monitor the REF2924 activity group, Elastic Security Labs observed that the attacker shifted priorities from data theft to persistent access using several mechanisms.”
-
REF2924: how to maintain persistence as an (advanced?) threat“REF2924: how to maintain persistence as an (advanced?) threat”
-
Not sleeping anymore: SOMNIRECORD's wake-up call“While monitoring the REF2924 activity group, Elastic Security Labs researchers identified a new malware family written in C++ that we refer to as SOMNIRECORD.”
-
Update to the REF2924 intrusion set and related campaigns“Update to the REF2924 intrusion set and related campaigns”
-
SiestaGraph: New implant uncovered in ASEAN member foreign ministry“The investigation, which we’re tracking as REF2924, began with the execution of a Powershell command used to export a user mailbox.”
Indicators in its reports
named in the reports above- 386eb7aa33c76ce6…58340081e2bdin 2 reports
- mrd0x[.]comin 1 report
- decoded.avast[.]ioin 1 report
- poster.checkponit[.]comin 1 report
- support.fortineat[.]comin 1 report
- support.vmphere[.]comin 1 report
- update.hobiter[.]comin 1 report
- checkponit[.]comin 1 report
- 9a11d6fcf76583f7…f6f959853bcfin 1 report
- 39e85de1b1121dc3…0c833e059530in 1 report
- 83406905710e52f6…1fdb2d28cc8cin 1 report
- 08331f33d196ced2…e2b1dc298cc1in 1 report
- cffca467b6ff4dee…272b683205f9in 1 report
- 6d79dfb00da88bb2…1473297617e3in 1 report
Copy these 14 indicators · defanged
Thanks — we review every report.