Mocha Manakin

Executive Summary

Mocha Manakin, an APT28 activity cluster, uses a sophisticated paste‑and‑run social engineering technique to launch obfuscated PowerShell commands that download and deploy a NodeJS backdoor (NodeInitRAT). The actor achieves persistence via registry Run keys (e.g., ChromeUpdater), performs extensive network and host reconnaissance, and channels command & control traffic through Cloudflare tunnels. While their primary motive is financial gain, they target a wide spectrum of sectors across the globe.

Goals & Targeting

Mocha Manakin’s strategic objectives revolve around maximizing illicit revenue streams by compromising a diverse set of industries—financial services, healthcare, critical infrastructure, defense, and more—across geopolitically significant regions. By employing low‑cost social engineering vectors (paste‑and‑run) combined with sophisticated persistence mechanisms, the actor maintains long‑term footholds while collecting credential and network data for potential sell‑off or further exploitation. The inclusion of the Interlock ransomware family in their toolset indicates a readiness to capitalize on exploitative opportunities should the opportunity arise.

Key Capabilities

• custom NodeJS backdoor (NodeInitRAT)
• registry Run key persistence (ChromeUpdater)
• PowerShell loader downloading and executing node.exe zip
• arbitrary command execution via nltest, net.exe, setspn.exe for domain enumeration
• C2 over HTTP using Cloudflare tunnels with XOR‑encoded GZIP payloads
• Network ARP neighbor discovery
• Process and service discovery
• privilege level detection via PowerShell
• execution of arbitrary EXE/DLL/CMD/JS (including .LOG renamed JS) files
• DLL execution via rundll32.exe
• Paste‑and‑run technique using clipboard PowerShell commands
• PowerShell invoke-expression/invoke-restmethod for remote content download
• NodeJS process spawn of cmd.exe to add registry persistence keys
• drop additional executables/DLLs onto disk for persistence
• trycloudflare.com domains/ips for C2 communication
• email spoofing and phishing campaigns targeting state bodies
• exploiting zero‑day vulnerability CVE-2022-30190

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

The actor’s campaigns exhibit a blend of opportunistic phishing, social engineering copy‑paste lures, and zero‑day exploitation, with evidence dating to at least 2022. Their operations are largely low‑profile, leveraging generic services (Cloudflare) for C&C, yet they persistently target high-value sectors across dozens of countries. Past incidents include a targeted phishing wave against Ukrainian state bodies in 2023 and the deployment of CredoMap via a CVE-2022-30190 exploit in mid‑2022. While direct ransomware delivery (Interlock) has not been confirmed, the threat landscape suggests readiness to pivot toward more aggressive extortion if viable targets present themselves.

IOC Patterns

• PowerShell invoke-expression/invoke-restmethod commands pointing to trycloudflare.com or IP addresses
• obfuscated PowerShell code copied via clipboard and executed with Run dialog (paste‑and‑run)
• registry HKCU\Software\Microsoft\Windows\CurrentVersion\Run entry named "ChromeUpdater"
• zip file containing node.exe downloaded at runtime
• ARP discovery command output for local network enumeration
• renamed .LOG extension used to masquerade JavaScript files
• rundll32.exe invocation with DLL path pattern
• file path \\AppData\\Roaming\\[a-z0-9]{8}.log
• trycloudflare.com domains referenced in command lines
• IP addresses embedded in RAT command lines
• DNS queries for Cloudflare C2 hostnames
• malicious attachment distribution leveraging CVE‑2022‑30190

Recommended Actions

• Educate users to avoid executing paste‑and‑run lures and verify unknown PowerShell scripts before running.
• Implement PowerShell execution policies and monitor for suspicious invoke-expression or invoke-restmethod usage.
• Block or filter outbound HTTP traffic to Cloudflare domains or trycloudflare.com used as C2 intermediaries.
• Deploy EDR solutions that flag registry Run key persistence (especially ChromeUpdater), node.exe runtime executions, and unusual domain enumeration commands.
• Monitor and restrict modifications to Windows Registry Run Keys; enforce GPOs preventing unauthorized entries.
• Enable detailed PowerShell logging for Get-Process, Get-Service, Get‑PSDrive, etc., and alert on execution of rundll32.exe for DLL loading.
• Implement a policy disabling hotkeys that trigger the Run dialog (e.g., Win+R) to mitigate paste‑and‑run attacks.
• Provide user training on risks of copy‑paste malicious commands and spearphishing emails.
• Terminate suspicious node.exe processes, delete associated files and registry keys, and remove dropped DLLs from disk.
• Use firewall or DNS sinkhole rules to block trycloudflare.com domains and any known C2 IP addresses.
• Deploy network monitoring for ARP broadcast floods and unsolicited outbound HTTP connections to obscure C2 infrastructure.
• Apply patch management rigorously to remediate CVE‑2022‑30190 and other exploitable vulnerabilities.

Suggested Tags