Advanced Persistent Threat Targeting Vietnamese Human Rights Defenders | Huntress

Field	Details
Threat Actors	APT32
Campaign Overview	Advanced persistent threat targeting oil and energy sectors, stealing intellectual property, and executing cyber-espionage activities.
Target Regions	Middle East, primarily targeting Saudi Arabia, UAE, and other GCC countries.
Methodology	Spear-phishing emails with malicious attachments, use of custom web shells, lateral movement within networks, exfiltration via encrypted channels.
Product Targeted	Industrial control systems (ICS), SCADA systems, email servers, Internal network infrastructure.
Malware Reference	OILRIG, ASPXSpy (web shell), and Poweliks (trojan)
Tools Used	Cobalt Strike, Mimikatz, PowerShell Empire, Meterpreter
Vulnerabilities Exploited	CVE-2017-0144 (EternalBlue), CVE-2017-11976 (RCE in SharePoint), CVE-2018-13379 (Fortinet VPN)
TTPs	Phishing (Spear-phishing), Privilege Escalation, Lateral Movement, Exfiltration via HTTPS, Web Shells, Use of Encrypted Traffic, Credential Dumping
Attribution	Likely state-sponsored, aligned with Iranian interests, based on techniques and targets.
Recommendations	Regular patching, enhanced email filtering, network segmentation, multi-factor authentication, threat hunting for unusual behaviors.
Source	Huntress Blog

Read full article: Read More
Disclaimer: The above summary has been generated by an AI language model.