TA428Threat actor
- bronze dudley
- colourful panda
Proofpoint researchers have identified a targeted APT campaign that utilized malicious RTF documents to deliver custom malware to unsuspecting victims. We dubbed this campaign “Operation LagTime IT” based on entities that were targeted and the distinctive domains registered to C&C IP infrastructure.From MISP Galaxy
Last reported 3 years ago, by Elastic Security Labs4 reports
ATT&CK techniques
6 of 27 · each with the sentence it comes from- T1027Obfuscated Files or Information
“T1027 Obfuscated Files or Information”
- T1041Exfiltration Over C2 Channel
“T1041 Exfiltration Over C2 Channel”
- T1059Command and Scripting Interpreter
“T1059.003 Command and Scripting Interpreter: Windows Command Shell”
- T1001Data Obfuscation
“T1001 Data Obfuscation”
- T1005Data from Local System
“Data from Local System”
- T1016System Network Configuration Discovery
“T1016 System Network Configuration Discovery”
What the reports say
4 reports, newest first · the exact sentence from each-
Introducing the REF5961 intrusion set“SManager/PhantomNet has been attributed to TA428 (Colourful Panda, BRONZE DUDLEY), a threat actor likely sponsored by the Chinese government.”
-
Hunting Rituals #1: Threat hunting for DLL side-loading“Read on to find out how APTs such as TA428 and Dark Pink have leveraged DLL side-loading in known attacks.”
-
Nice Try Tonto Team“Group-IB experts have previously warned about threats from TaskMasters and TA428, other Chinese nation-state cyber threat actors.”
-
The Art of Cyberwarfare“Mail-O was deemed to be linked to the Chinese hacker group TA428.”
Indicators in its reports
named in the reports above- decoded.avast[.]ioin 1 report
- hxxp://president[.]mn/en/ebooksheets.phpin 1 report
- president[.]mnin 1 report
- www.president[.]mnin 1 report
- datacenter.gov[.]mnin 1 report
- hxxps://intranet.gov[.]mn/upload.phpin 1 report
- intranet.gov[.]mnin 1 report
- 45.90.58[.]103in 1 report
- 185.195.237[.]123in 1 report
- 185.82.217[.]164in 1 report
- 195.123.245[.]79in 1 report
- paper.hosted-by-bay[.]netin 1 report
- news.hosted-by-bay[.]netin 1 report
- hosted-by-bay[.]netin 1 report
- 45.133.194[.]106in 1 report
- paypal.goodspaypal[.]comin 1 report
- d218680140ad2c6e…41c02d889a59in 1 report
- redacted[.]mnin 1 report
Copy these 18 indicators · defanged
Thanks — we review every report.