Cyberespionage group Mustang Panda is responsible for the threat exploiting the invasion of Ukraine and targeting government entities and NGOs in Europe, Africa and Asia
Researchers of ESET, a global cybersecurity market leader based in the European Union, announced the discovery of a cyberespionage campaign – dating back to August 2021 and still ongoing – using a never-before-documented Korplug variant originating from the Mustang Panda APT group. The current campaign exploits the war in Ukraine and other European news topics. Known victims include research institutions, internet service providers (ISPs) and European diplomatic missions, mostly located in East and Southeast Asia. ESET researchers named this new variant Korplug Hodur due to its similarity to the THOR variant documented in 2020. In Norse mythology, Hodur is Thor's blind half-brother.
Victims of this campaign are likely lured by phishing documents that exploit events such as Russia's invasion of Ukraine which, according to the UNHCR (United Nations High Commissioner for Refugees), resulted in the exodus of more than three million residents fleeing war in neighboring countries, giving rise to an unprecedented crisis on Ukraine's borders. One of the names assigned to the files relating to this campaign, in fact, is "Situation at the EU borders with Ukraine.exe".
Other ongoing phishing campaigns mention updated COVID-19 travel restrictions, an approved local aid map for Greece, and a European Parliament and Council regulation. In the latter case, the final bait is a real document available on the European Council website. This shows that the APT group responsible for this campaign follows current events and is able to act successfully and quickly.
"Based on code similarities and many commonalities in tactics, techniques, and procedures, ESET researchers most likely attribute this campaign to Mustang Panda, also known as TA416, RedDelta, or PKPLUG. This is a cyberespionage group that primarily targets government entities and NGOs," he explains Alexandre Côté Cyr, malware researcher at ESET who discovered Hodur. Mustang Panda victims are mostly, but not exclusively, located in eastern and southeastern Asia, with a notable concentration in Mongolia. The group is also known for its campaign against the Vatican in 2020.
Although ESET researchers have not yet been able to identify the sectors of all the victims, this campaign appears to have the same targeting objectives as other Mustang Panda campaigns. Following typical APT victimology, most of the targets are located in East and Southeast Asia, along with some in European and African countries. According to ESET telemetry, the vast majority of targets are located in Mongolia and Vietnam, followed by Myanmar, with only a few cases in Greece, Cyprus, Russia, South Sudan and South Africa. Sectors identified include diplomatic missions, research institutions and ISPs.
Mustang Panda campaigns often use custom loaders to share malware, including Cobalt Strike, Poison Ivy, and Korplug (also known as PlugX). The group is also known for creating variations of Korplug. “Compared to other campaigns using Korplug, each stage of the distribution process uses anti-analysis and control flow obfuscation techniques, to make the investigation more difficult for us malware researchers,” concludes Côté Cyr.
More information at this link
