APT30 - Chinese Advanced Persistent Threat Group

ATP30, also known as the Naikon group is one of the most active APT groups in Asia. Since 2010, it has launched spear phishing campaigns into organizations surrounding the South China Sea, intent on harvesting geo-political intelligence from civilian and military government organizations in the Philippines, Malaysia, Cambodia, Indonesia, Vietnam, Myanmar, Singapore, Nepal, Thailand, Laos, and China. The actors speak native Chinese. Based on the choice of targets, the operating language, and the sophistication of the toolkit, there is a distinct possibility that APT30 is a Chinese state sponsored threat group.

Spear phishing campaigns begin with a lure email relevant to the victim that carries a malicious Microsoft Word document, which, according to Kaspersky Lab, actually contains “a CVE-2012–0158 exploit, an executable with a double extension, or an executable with an RTLO filename”. One of its most prolific spear phishing campaigns was the March 2014 attacks targeting organizations from countries affected by the MH370 tragedy. Upon opening/ execution, the malicious payload, an 8kb encrypted file and configuration data, is injected into the browser memory where it decrypts the ports and paths to the C2C server, a user agent string, filenames and paths to relevant components, and hash sums of the user API functions. The malicious code downloads the main malware from the C2C server over an SSL connection and then it loads it independently of the operating system functions without saving it to the hard drive by assuming control of the XS02 function and then handling the installation in memory.

…

[embed]

ABOUT -

The ArtOfTheHak project is an academic portal for asymmetric warfare research. The goal is to educate readers on the strategies, tools, tactics, and procedures used by adversarial nation-states to disrupt and impact the West and American allies. A.O.T.H. founder James Scott has spent a career as a generalist researcher, writer, and government advisor within this unique and often-overlooked space. This website offers free downloads of censored material used in Mr. Scott’s government advisory.

“Few people take time to zero in on their purpose in life and why they are on this planet. I realized I was born to disrupt the system, and help change it for the better from within.” James Scott

Over the past 17 years, Mr. Scott has advised to the White House, United States Congress, NATO, intelligence community and more than 19 international governments, his portfolio of research has been heavily regarded as the most bleeding edge in this space. Website visitors can download reports and whitepapers for citation, collaboration, presentations, academic investigation, and more.

After writing more than 50 books within this unique domain, our founder’s conviction to make information available for free has expanded the options for those with an interest in the rare topics covered here. Over the years, Mr. Scott has turned down numerous publishers in order to maintain control over the distribution rights of his material. “Money shouldn’t be an inhibitor for access to meaningful information,” says Mr. Scott, “I never intended on trying to capitalize on my books, and always made them available to anyone who wanted them.”

For the first ten years of his career, James Scott was a ghostwriter/researcher for scientists, executives within the federal agency system, political figures, and national security experts. His unique blend of research, summarization, talking points, and briefing style quickly elevated his demand in the government advisory space.

This portal is free to use. All we ask is that you cite your research properly if you use our material. To receive a calendar of ArtOfTheHak’s lectures and briefing tours, inquire on the contact page. These events are free, and tour stops are in New York City, London, Tokyo, Berlin, Los Angeles, and other select cities.

Find out more -https://artofthehak.com/apt30/