Moshen Dragon

Executive Summary

Moshen Dragon is a Chinese-aligned cyberespionage threat actor targeting Central Asia, primarily focusing on the telecommunication sector. They employ advanced tactics such as DLL search order hijacking, LSA notification packages, and passive backdoors like GUNTERS. Their activities include deploying malware triads and leveraging tools like PlugX and ShadowPad for long-term access.

Goals & Targeting

Moshen Dragon's strategic objectives appear to revolve around cyberespionage and potentially disruptive activities in the telecommunication sector, likely to bolster Chinese geopolitical interests in Central Asia. The targeting of this specific sector suggests a focus on gaining access to critical infrastructure and sensitive communications data. Their victims are primarily located in regions aligned with or adjacent to China's Belt and Road Initiative, indicating a geostrategic targeting approach.

Moshen Dragon operates with a high level of sophistication, aligning their activities with Chinese-state interests in the Central Asian region. The threat actor has demonstrated a persistent and targeted approach to compromising telecommunication infrastructure, likely aiming to gather sensitive information or disrupt critical services. Their toolkit includes malicious software such as ShadowPad and PlugX, which are known for their persistence and data exfiltration capabilities. Moshen Dragon's tactics involveDLL search order hijacking to sideload these tools, indicating a preference for stealthy and reliable infection methods. The actor also utilizes LSA notification packages and a passive backdoor named GUNTERS, showcasing their ability to maintain long-term access to victim systems. Their use of Impacket for lateral movement underscores their capability to navigate across networks effectively.

Key Capabilities

• DLL search order hijacking for malware deployment
• Use of ShadowPad and PlugX malware variants
• LSA notification package exploitation
• Passive backdoor creation (GUNTERS)
• Leveraging Impacket for lateral movement and data exfiltration

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Moshen Dragon has been active in Central Asia, conducting targeted campaigns against telecom entities. Their operations demonstrate a patient and methodical approach, often utilizing off-the-shelf tools and frameworks like Impacket for both persistence and lateral movement. The actor's campaigns are likely linked to broader Chinese state-sponsored espionage efforts.

IOC Patterns

• Spear-phishing emails with malicious .LNK files ormacro-laced Office documents
• DLL search order hijacking for fileless malware delivery
• Unusual network traffic indicative of C2 communication using known ports
• Use of LSA notification packages in system processes

Recommended Actions

• Implement strong perimeter and endpoint detection mechanisms to detect DLL injection and .NET Remoting activity.
• Monitor for unusual process behavior and network anomalies associated with Impacket usage.
• Enhance logging capabilities to track LSA notifications and identify unauthorized backdoor activities.
• Conduct regular patch management to mitigate vulnerabilities exploited by Moshen Dragon's tools.
• Educate employees about phishing tactics and implement email filtering to block malicious payloads.

Suggested Tags