Vicious PandaThreat actor
- SixLittleMonkeys
Check Point Research discovered a new campaign against the Mongolian public sector, which takes advantage of the current Coronavirus scare, in order to deliver a previously unknown malware implant to the target. A closer look at this campaign allowed us to tie it to other operations which were carried out by the same anonymous group, dating back to at least 2016.From MISP Galaxy
Last reported 5 months ago, by ESET WeLiveSecurity (ES)2 reports
ATT&CK techniques
6 of 36 · each with the sentence it comes from- T1005Data from Local System
“T1005”
- T1021.007Cloud Services
“T1021.007”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information: Encrypted/Encoded File”
- T1027.013Encrypted/Encoded File
“T1027.013”
- T1041Exfiltration Over C2 Channel
“T1041”
- T1053Scheduled Task/Job
“Scheduled Task/Job: Scheduled Task”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Webworm: el grupo APT evoluciona sus tácticas y se apoya en plataformas legítimas“Webworm está vinculado a otros grupos APT alineados con China, como SixLittleMonkeys y FishMonger.”
-
Webworm: New burrowing techniques“Webworm is linked to other China-aligned APT groups such as SixLittleMonkeys and FishMonger.”
Indicators in its reports
named in the reports above- wamanharipethe.s3.ap-south-1.amazonaws[.]comin 2 reports
- whpjewellers.s3.amazonaws[.]comin 2 reports
- hxxps://github[.]com/anjsdgasdf/WordPressin 2 reports
- 64.176.85[.]158in 2 reports
- socket[.]ioin 2 reports
- cb4e504333367073…3cbe8d497d98in 2 reports
- 1df40a4a31b30b62…c4408302adc7in 2 reports
- 7dcfe9ee25841dfd…67fe32141dfbin 2 reports
- 77f1970d620216c5…13fccc267217in 2 reports
- 948159a7fc2e6883…40dffc4b24d6in 2 reports
- a3c077bdf8898e61…960834adb2a9in 2 reports
- 45.77.13[.]67in 2 reports
- 104.243.23[.]43in 2 reports
- 108.61.200[.]151in 2 reports
- 144.168.60[.]233in 2 reports
Copy these 15 indicators · defanged
Thanks — we review every report.