RemyMalware
- WINDSHIELD
WINDSHIELD is a signature backdoor used by APT32.From MITRE ATT&CK
Last reported 4 months ago, by ESET WeLiveSecurity (ES)2 reports
ATT&CK techniques
6 of 18 · each with the sentence it comes from- T1021Remote Services
“T1021”
- T1027Obfuscated Files or Information
“T1027”
- T1036Masquerading
“T1036”
- T1041Exfiltration Over C2 Channel
“T1041”
- T1055Process Injection
“T1055”
- T1059Command and Scripting Interpreter
“T1059”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
OceanLotus: del espionaje exterior al foco en objetivos en Vietnam“… que implementa tunelización DNS para comunicaciones de C&C; PHOREAL, que utiliza el protocolo ICMP para comunicaciones de C&C; WINDSHIELD, que incorpora un interesante mecanismo de evasión de proxy; y su backdoor más reciente, SPECTRALVIPER, que incluye capa…”
-
OceanLotus: From external espionage to domestic targeting“…(aka SOUNDBITE), implementing DNS tunneling for C&C communications; PHOREAL, which leverages the ICMP protocol for C&C communications; WINDSHIELD, which features an interesting proxy bypass mechanism; and its latest backdoor, SPECTRALVIPER, which includes orchestration capabiliti…”
Indicators in its reports
named in the reports above- metakit.fireant[.]vnin 2 reports
- hxxp://metakit.fireant[.]vn/Software/version.xmlin 2 reports
- 139.162.11[.]152in 2 reports
- 142.91.98[.]77in 2 reports
- hxxps://financemachinelearning[.]com/apparatus/wind/twig/statement.htmlin 2 reports
- financemachinelearning[.]comin 2 reports
- gatewayrvcenter[.]comin 2 reports
- 139.180.128[.]42in 2 reports
- coachcybersecurity[.]comin 2 reports
- 139.99.33[.]239in 2 reports
- mxprodesign[.]comin 2 reports
- 166.88.77[.]186in 2 reports
- power-sync-services[.]comin 2 reports
- 103.119.47[.]104in 2 reports
- 511b77459673ec42…1d233b6c39fbin 2 reports
- 59a8553a4f8130f5…0be4d4da0e98in 2 reports
- 9ca1a5c7f79882db…26bcdcb9f6ddin 2 reports
- a8e2bbbfcb865003…12755ab0c165in 2 reports
- f74f1feb62b662cd…27824e55acb9in 2 reports
- f8f8209987ca7f13…e21bd2ae93a9in 2 reports
Copy these 20 indicators · defanged
Thanks — we review every report.