Mustang Panda Targets Myanmar With StarProxy, EDR Bypass, and TONESHELL Updates

The China-linked risk actor referred to as Mustang Panda has been attributed to a cyber assault focusing on an unspecified group in Myanmar with beforehand unreported tooling, highlighting continued effort by the risk actors to extend the sophistication and effectiveness of their malware.

This contains up to date variations of a recognized backdoor known as TONESHELL, in addition to a brand new lateral motion software dubbed StarProxy, two keyloggers codenamed PAKLOG, CorKLOG, and an Endpoint Detection and Response (EDR) evasion driver known as SplatCloak.

“TONESHELL, a backdoor utilized by Mustang Panda, has been up to date with modifications to its FakeTLS command-and-control (C2) communication protocol in addition to to the strategies for creating and storing consumer identifiers,” Zscaler ThreatLabz researcher Sudeep Singh mentioned in a two-part evaluation.

Mustang Panda, also referred to as BASIN, Bronze President, Camaro Dragon, Earth Preta, HoneyMyte, and RedDelta, is a China-aligned state-sponsored risk actor lively since at the very least 2012.

Recognized for its assaults on governments, navy entities, minority teams, and non-governmental organizations (NGOs) primarily in nations situated in East Asia, and to a lesser extent in Europe, the group has a historical past of leveraging DLL side-loading strategies to ship the PlugX malware.

Nonetheless, since late 2022, campaigns orchestrated by Mustang Panda have begun to steadily ship a bespoke malware household known as TONESHELL, which is designed to obtain next-stage payloads.

Zscaler mentioned it found three new variants of the malware that include various ranges of sophistication –

• Variant 1, which acts as a easy reverse shell
• Variant 2, which incorporates performance to obtain DLLs from the C2 and execute them by injecting the DLL into legit processes (e.g., svchost.exe)
• Variant 3, which incorporates performance to obtain recordsdata and create a sub-process to execute instructions obtained from a distant server through a customized TCP-based protocol

A brand new piece of software program related to Mustang Panda is StarProxy, which is launched through DLL side-loading and is designed to benefit from FakeTLS protocol to proxy site visitors and facilitate attacker communications.

“As soon as lively, StarProxy permits attackers to proxy site visitors between contaminated units and their C2 servers. StarProxy achieves this by using TCP sockets to speak with the C2 server through the FakeTLS protocol, encrypting all exchanged information with a customized XOR-based encryption algorithm,” Singh mentioned.

“Moreover, the software makes use of command-line arguments to specify the IP tackle and port for communication, enabling attackers to relay information by compromised machines.”

StarProxy exercise

It is believed that StarProxy is deployed as a post-compromise software to entry inside workstations inside a community that aren’t instantly uncovered to the web.

Additionally recognized are two new keyloggers, PAKLOG and CorKLOG, which are used to watch keystrokes and clipboard information. The first distinction between the 2 is that the latter shops the captured information in an encrypted file utilizing a 48-character RC4 key and implements persistence mechanisms by creating companies or scheduled duties.

Each the keyloggers lack information exfiltration capabilities of their very own, which means they solely exist to gather the keystroke information and write them to a particular location and that the risk actor makes use of different strategies to transmit them to their infrastructure.

Capping off the brand new additions to the Mustang Panda’s malware arsenal is SplatCloak, a Home windows kernel driver deployed by SplatDropper that is geared up to disable EDR-related routines applied by Home windows Defender and Kaspersky, thereby permitting it to fly below the radar.

“Mustang Panda demonstrates a calculated strategy to attaining their goals,” Singh mentioned. “Steady updates, new tooling, and layered obfuscation prolongs the group’s operational safety and improves the efficacy of assaults.”

UNC5221 Drops New Variations of BRICKSTORM Focusing on Home windows

The disclosure comes because the China-nexus cyber espionage cluster named UNC5221 has been related to make use of of a brand new model of the BRICKSTORM malware in assaults geared toward Home windows environments in Europe since at the very least 2022, in accordance with Belgian cybersecurity agency NVISO.

BRICKSTORM, first documented final yr in reference to the zero-day exploitation of Ivanti Join Safe zero-day vulnerabilities (CVE-2023-46805 and CVE-2024-21887) towards the MITRE Company, is a Golang backdoor deployed on Linux servers operating VMware vCenter.

“It helps the flexibility to set itself up as an online server, carry out file system and listing manipulation, carry out file operations similar to add/obtain, run shell instructions, and carry out SOCKS relaying,” Google Mandiant mentioned in April 2024. “BRICKSTORM communicates over WebSockets to a hard-coded C2.”

The newly recognized Home windows artifacts, additionally written in Go, present attackers with file supervisor and community tunneling capabilities by a panel, enabling them to browse the file system, create or delete recordsdata, and tunnel community connections for lateral motion.

Additionally they resolve C2 servers by DNS-over-HTTPS (DoH), and are engineered to evade network-level defenses like DNS monitoring, TLS inspection, and geo-blocking.

“The Home windows samples [..] are usually not geared up with command execution capabilities,” NVISO mentioned. “As a substitute, adversaries have been noticed utilizing community tunneling capabilities together with legitimate credentials to abuse well-known protocols similar to RDP or SMB, thus attaining comparable command execution.”