APTs-Adversary-Simulation/Chinese APT/Mustang Panda

Mustang Panda APT Adversary Simulation

This is a simulation of attack by (Mustang Panda) APT group targeting government entities in Southeast Asia, the attack campaign was active from late September 2023, The attack chain starts with abuse of Visual Studio Code's reverse shell to execute arbitrary code and deliver additional payloads. To abuse Visual Studio Code for malicious purposes, an attacker can use the portable version of code.exe (the executable file for Visual Studio Code), or an already installed version of the software. By running the command code.exe tunnel, an attacker receives a link that requires them to log into GitHub with their own account, I relied on paloalto to figure out the details to make this simulation: https://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/

This attack included several stages including redirect to a Visual Studio Code web environment that is connected to the compromised machine. They are then permitted to execute commands and scripts, and to create new files on the infected machine, Stately Taurus used this technique to deliver malware to infected environments, perform reconnaissance and exfiltrate sensitive data. To establish constant access to the reverse shell, the attacker created persistence for a script named (startcode.bat) using a scheduled task that is responsible for starting the shell.

1. Use Visual Studio Code's reverse shell to execute arbitrary code and deliver additional payloads.

2. used ToneShell to archive files for exfiltration, protecting the RAR archives with a unique password.

The first stage (delivery technique)

To abuse Visual Studio Code for malicious purposes, an attacker can use the portable version of code.exe (the executable file for Visual Studio Code), or an already installed version of the software. By running the command code.exe tunnel, an attacker receives a link that requires them to log into GitHub with their own account, One of the novel techniques Stately Taurus used to bypass security protections leverages Visual Studio Code’s embedded reverse shell feature to execute arbitrary code and deliver additional payloads. Truvis Thornton described this technique in a Medium post: https://medium.com/@truvis.thornton/visual-studio-code-embedded-reverse-shell-and-how-to-block-create-sentinel-detection-and-add-e864ebafaf6d

In the beginning i downloaded VScode on Windows Target Machine, then I logged in to my GitHub account in the browser, and through it I logged in to my VScode account.

---

---

To complete the process of linking the account you got with the VS code, I open CMD in Windows and write the command code tunnel so that the terminal gives us the link that we will use to complete the authentication process.

---

---

---

---

After that, the link will appear in the CMD, which i will use and open from the attacker browser to gain control over the victim VSCode through the attacker browser.

---

Now I have control over the target machine through my browser in Kali Linux.

---

The second stage (ToneShell Backdoor)

Upon logging in, the attacker is directed to a Visual Studio Code web environment linked to the compromised machine, where they are granted the ability to run commands, execute scripts, and create new files on the infected system.

Stately Taurus employed this method to deploy malware in compromised environments, carry out reconnaissance, and extract sensitive data. To ensure ongoing access to the reverse shell, the attacker set up persistence for a script called startcode.bat using a scheduled task that launches the shell.

If you need know more about ToneShell Backdoor: https://hunt.io/blog/toneshell-backdoor-used-to-target-attendees-of-the-iiss-defence-summit

To create a payload similar to the ToneShell backdoor and incorporate the functionality described, I need to ensure several aspects are covered:

1. Proper Functionality: Implement SetupAndEnumWindowProps to allocate memory, set up function pointers, and enumerate window properties.

2. Password Handling: Implement logic to handle a password-protected RAR archive.

3. 64-bit Compatibility: Ensure that the code is suitable for 64-bit Windows systems.

ToneShell Backdoor initializes data and dynamically allocates memory for a function pointer (PROPENUMPROCEXW), using it to enumerate window properties. It includes functions for dummy data handling, debug message output, and simulating file archiving with a password (without actual implementation). Key operations include:

1.Data Handling: Obtains and processes dummy data.

2.Memory Management: Allocates memory for executing function pointers.

3.Window Enumeration: Uses EnumPropsExW() to list window properties.

4.Debugging: Outputs static messages for diagnostics.

manual compile: x86_64-w64-mingw32-gcc -o ToneShellBackdoor.exe ToneShellBackdoor.c -lwinhttp

The third stage (execution technique)

Validate and process data

Now I will use the terminal and start the execut the payload after I uploaded it through another feature on the web page that controls the VScode.

The fourth stage (Data Exfiltration) over Dropbox API C2 Channe

The attackers used the Dropbox C2 (Command and Control) API as a means to establish a communication channel between their payload and the attacker's server. By using Dropbox as a C2 server, attackers can hide their malicious activities among the legitimate traffic to Dropbox, making it harder for security teams to detect the threat. First, we need to create a Dropbox account and activate its permissions, as shown in the following figure.

After that, we will go to the settings menu to generate the access token for the Dropbox account, and this is what we will use in Dropbox C2.

In simulating this attack, I used the third profile found in BEAR-C2. https://github.com/S3N4T0R-0X0/BEAR

Example: Upload a file to Dropbox

The fifth stage (Dump-Lsass by Mimikatz)

After this I uploaded the Mimikatz.exe to dump for lsass credentials

MITRE ATT&CK Techniques

Technique ID	Technique	Implementation
T1204.002	User Execution: Malicious File	Requires the victim to execute the portable Visual Studio Code binary to initiate the attack chain.
T1059	Command and Scripting Interpreter	Executes attacker-issued commands through the established reverse shell.
T1219	Remote Access Software	Abuses Visual Studio Code Remote Tunnel as legitimate remote access software for persistence and remote administration.
T1071.001	Application Layer Protocol: Web Protocols	Uses HTTPS to communicate with the Visual Studio Code tunnel infrastructure.
T1105	Ingress Tool Transfer	Downloads additional payloads and tools from attacker-controlled infrastructure after initial access.
T1102.001	Web Service: Dead Drop Resolver	Uses GitHub authentication and Microsoft-hosted VS Code services to blend C2 traffic with legitimate cloud services.
T1027	Obfuscated Files or Information	Obfuscates payload components to reduce detection by static analysis.
T1082	System Information Discovery	Collects basic host information before establishing the remote session.
T1057	Process Discovery	Enumerates running processes to gather situational awareness on the compromised host.
T1041	Exfiltration Over C2 Channel	Returns command output and collected data through the established encrypted tunnel.