FireEye APT30

FLASHFLOOD searches for interesting files (either a default or customized set of file extensions) on the local system. FLASHFLOOD will scan the My Recent Documents, Desktop, Temporary Internet Files, and TEMP directories. FLASHFLOOD also collects information stored in the Windows Address Book.

NETEAGLE will attempt to detect if the infected host is configured to a proxy. If so, NETEAGLE will send beacons via an HTTP POST request; otherwise it will send beacons via UDP/6000.

BACKSPACE is capable of enumerating and making modifications to an infected system's Registry.

FLASHFLOOD searches for interesting files (either a default or customized set of file extensions) on removable media and copies them to a staging area. The default file types copied would include data copied to the drive by SPACESHIP.

NETEAGLE is capable of reading files over the C2 channel.

Adversaries can direct BACKSPACE to upload files to the C2 Server.

SPACESHIP copies staged data to removable drives when they are inserted into the system.

NETEAGLE can send process listings over the C2 channel.

BACKSPACE may collect information about running processes.

NETEAGLE allows adversaries to execute shell commands on the infected host.

Adversaries can direct BACKSPACE to execute from the command line on infected hosts, or have BACKSPACE create a reverse shell.

NETEAGLE will attempt to detect if the infected host is configured to a proxy. If so, NETEAGLE will send beacons via an HTTP POST request. NETEAGLE will also use HTTP to download resources that contain an IP address and Port Number pair to connect to for further C2.

BACKSPACE uses HTTP as a transport to communicate with its command server.

FLASHFLOOD stages data it copies from the local system or removable drives in the "%WINDIR%\$NtUninstallKB885884$\" directory.

SPACESHIP identifies files with certain extensions and copies them to a directory in the user's profile.

During its initial execution, BACKSPACE extracts operating system information from the infected host.

NETEAGLE allows adversaries to enumerate and modify the infected host's file system. It supports searching for directories, creating directories, listing directory contents, reading and writing to files, retrieving file attributes, and retrieving volume information.

FLASHFLOOD searches for interesting files (either a default or customized set of file extensions) on the local system and removable media.

SPACESHIP identifies files and directories for collection by searching for specific file extensions or file modification time.

BACKSPACE allows adversaries to search for files.

The "ZJ" variant of BACKSPACE allows "ZJ link" infections with Internet access to relay traffic from "ZJ listen" to a command server.

APT30 may have used the SHIPSHAPE malware to move onto air-gapped networks. SHIPSHAPE targets removable drives to spread to other systems by modifying the drive to use Autorun to execute or by hiding legitimate document files and copying an executable to the folder with the same name as the legitimate document.

If NETEAGLE does not detect a proxy configured on the infected machine, it will send beacons via UDP/6000. Also, after retrieving a C2 IP address and Port Number, NETEAGLE will initiate a TCP connection to this socket. The ensuing connection is a plaintext C2 channel in which commands are specified by DWORDs.

BACKSPACE attempts to avoid detection by checking a first stage command and control server to determine if it should connect to the second stage server, which performs "louder" interactions with the malware.

BACKSPACE is capable of deleting Registry keys, sub-keys, and values on a victim system.

Newer variants of BACKSPACE will encode C2 communications with a custom system.

APT30 has relied on users to execute malicious file attachments delivered via spearphishing emails.

SHIPSHAPE achieves persistence by creating a shortcut in the Startup folder.

BACKSPACE achieves persistence by creating a shortcut to itself in the CSIDL_STARTUP directory.

FLASHFLOOD achieves persistence by making an entry in the Registry's Run key.

The "SCOUT" variant of NETEAGLE achieves persistence by adding itself to the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key.

SPACESHIP achieves persistence by creating a shortcut in the current user's Startup folder.

SHIPSHAPE achieves persistence by creating a shortcut in the Startup folder.

SPACESHIP achieves persistence by creating a shortcut in the current user's Startup folder.

BACKSPACE achieves persistence by creating a shortcut to itself in the CSIDL_STARTUP directory.

FLASHFLOOD employs the same encoding scheme as SPACESHIP for data it stages. Data is compressed with zlib, and bytes are rotated four times before being XOR'ed with 0x23.

Data SPACESHIP copies to the staging area is compressed with zlib. Bytes are rotated by four positions and XOR'ed with 0x23.

APT30 has used spearphishing emails with malicious DOC attachments.

NETEAGLE can use HTTP to download resources that contain an IP address and port number pair to connect to for C2.

NETEAGLE will decrypt resources it downloads with HTTP requests by using RC4 with the key "ScoutEagle."

The "ZR" variant of BACKSPACE will check to see if known host-based firewalls are installed on the infected systems. BACKSPACE will attempt to establish a C2 channel, then will examine open windows to identify a pop-up from the firewall software and will simulate a mouse-click to allow the connection to proceed.