Mofang

Executive Summary

Mofang is a likely China-based cyber espionage group targeting government, critical infrastructure, defense sectors in the US, Germany, South Korea, India, and others. They have been active since at least May 2012 and primarily use spearphishing techniques with malicious files and links to gain access to sensitive information.

Goals & Targeting

Mofang's strategic objectives involve gathering intelligence from government and critical infrastructure sectors through targeted attacks. They likely aim to support Chinese interests by compromising defense capabilities and technological innovations in the US, Germany, South Korea, and India, reflecting a focus on geopolitical competition.

Mofang is a sophisticated cyber espionage group, likely based in China, known for mimicking victim infrastructure during attacks. Since 2012, they have targeted government and critical infrastructure organizations globally, including Myanmar, the US, Germany, South Korea, India, and others. Using tactics such as spearphishing with malicious attachments and links, they seek to collect sensitive information from military, automobile, and weapons industries. Their operations demonstrate a focus on high-value targets to support strategic espionage objectives.

Key Capabilities

• Spearphishing via attachments and links
• Distribution of malicious files
• Use of encrypted/encoded payloads
• Compression techniques for hiding malware
• Custom RAT (ShimRat)

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Mofang has shown persistent activity since 2012, targeting multiple countries and sectors. Their campaigns often involve spearphishing attacks to infiltrate high-value targets. Notable operations include attacks against Myanmar's government and various global critical infrastructure entities.

IOC Patterns

• Spear-phishing emails with malicious attachments or links
• Encrypted/Encoded files in email attachments
• Compression of malicious files for delivery
• Malicious domain generation via standard protocols

Recommended Actions

• Implement multi-layered email security to detect spearphishing attempts.
• Monitor and decrypt compressed files to identify potential threats.
• Deploy endpoint detection and response tools to detect ShimRat and similar malware.
• Segment networks to limit lateral movement post-compromise.
• Conduct regular security audits focusing on critical sectors.

Suggested Tags