CleverSoar x China & Vietnam users

Subject: CleverSoar x China & Vietnam users

Tactics: TA0001 Initial Access

Technique: T1195 Supply Chain Compromise

Procedure:

Adversaries are modifying legitimate installers of the CleverSoar application to deliver malware. This specific campaign targets Chinese and Vietnamese users. The exact malware payload and its functionalities are unknown at this time, but it likely grants the attackers initial access to victim systems.

Vulnerability: EAV0002 When adversaries interact with the environment or personas, they are vulnerable to collecting, or in some way interacting with, manipulated or decoy data. In those cases the data may increase their tolerance for imperfections in the environment and improve the overall believability of the ruse.

Engagement Opportunity:

This incident presents an opportunity to engage with the adversary by setting up a controlled environment with decoy systems. These systems could appear as typical users in the targeted demographics, with appropriate language settings and software commonly used by Chinese and Vietnamese users. By deploying instrumented versions of the CleverSoar installer on these decoy systems, we can observe the adversary’s actions, gather intelligence on the malware payload, and potentially identify the attackers’ infrastructure.

Threat Actor: Unknown (potentially an APT group targeting Chinese and Vietnamese individuals)

Threat Objective:

The objective is currently unknown but could range from espionage and data theft to financial gain or disruption. The targeting of specific demographics suggests a focused campaign with potential political or economic motivations.

Deception Opportunity:

In addition to the instrumented installers, we can plant decoy documents and files related to topics of interest to the suspected threat actor on the decoy systems. This could misdirect the adversary, leading them to exfiltrate false information and revealing their collection priorities.

Sensor Data Placement: Application

Observable Level: Core to Adversary-Brought Tool

Scoring Rationale:

The primary observable here is the modified CleverSoar installer. This is “Core to Adversary-Brought Tool” because it is essential for delivering the malware payload. The sensor data placement would likely involve monitoring application activity (CleverSoar installation) and user-mode events (process execution, file system changes) triggered by the malware. While the installer itself may be modified, the techniques it uses to achieve persistence or communicate with a C2 server might reveal more fundamental observables.

Link to Report:

Link to Report II.:

Additional Comments:

It is crucial to analyze the malware payload delivered by the modified installer to gain a deeper understanding of the adversary’s TTPs and objectives. This analysis will enable more effective engagement and deception strategies.

Possible elements:

MSG (Pseudocode):

# Malicious Sub-Graph Standard

# Node Format:
# [Node ID]: [Tactic] - [Technique] - [Procedure] ([Observable Level])

# Edge Format:
# [Source Node ID] --> [Destination Node ID] ([Exploited Vulnerability])

# CleverSoar Attack Graph

[1]: Initial Access - Supply Chain Compromise (T1195) - Modify CleverSoar installer to deliver malware (Core to Adversary-Brought Tool)
[2]: Execution - User Execution (T1204) - User executes the trojanized installer (Core to Pre-Existing Tool)
[3]: Persistence - TBD - Persistence mechanism employed by the malware (TBD)
[4]: Command and Control - TBD - C2 communication channel used by the malware (TBD)
[5]: Action on Objectives - TBD - Actions taken by the malware (e.g., data exfiltration, system manipulation) (TBD)

1 --> 2 (Lack of Supply Chain Security (EAV-002))
2 --> 3 (Lack of System Monitoring)
3 --> 4 (Lack of Network Monitoring)
4 --> 5 (Lack of Network Segmentation)

# Pseudocode Standard

# Function Format:
# function [Tactic]_[Technique]([Input]):
# [Procedure]
# return [Output]

# CleverSoar Attack Pseudocode

function Initial_Access_Supply_Chain_Compromise():
# Obtain legitimate CleverSoar installer
# Inject malware payload into the installer
# Distribute modified installer to targets
return trojanized_installer

function Execution_User_Execution(trojanized_installer):
# User downloads and executes the trojanized installer
return malware_payload

function Persistence_TBD(malware_payload):
# Execute malware payload
# Establish persistence (specific method unknown)
return persistent_malware

function Command_and_Control_TBD(persistent_malware):
# Establish C2 communication channel (specific method unknown)
# Receive commands and execute actions
return action_on_objectives_result

function Action_on_Objectives_TBD(action_on_objectives_result):
# Perform actions based on attacker objectives (e.g., data exfiltration, system manipulation)
return outcome