🇨🇳

FunnyDream

APT Group Information theft and espionage 1 zero-day CVE ETDA ✓

Also Known As

No alias recorded

Target Countries 11

Countries highlighted in red

United Kingdom Indonesia India Kyrgyzstan Malaysia Philippines Slovakia Thailand Province of China Taiwan Uzbekistan Vietnam

Sectors Targeted

Public Administration 92 Government

Details

Origin 🇨🇳 CN

Last Updated 11 May 2024

MITRE ATT&CK 15

T1003 - OS Credential Dumping T1010 - Application Window Discovery T1012 - Query Registry T1021 - Remote Services T1027 - Obfuscated Files or Information T1047 T1059.001 T1071.001 T1105 T1106 - Native API T1140 - Deobfuscate/Decode Files or Information T1204 T1218 - Signed Binary Proxy Execution T1547 - Boot or Logon Autostart Execution T1566.001

Related Zero-Days 1

CVE-2017-0147

Known Names 4 entries

FunnyDream Kaspersky

Red Hariasa PWC

Bronze Edgewood SecureWorks

TAG-16 Recorded Future

Observed Target Countries 6

Based on ETDA data — countries highlighted in red

Indonesia Malaysia Philippines Taiwan Thailand Vietnam

Description

In early 2020 Kaspersky published a report based on its investigation of an ongoing attack campaign called “FunnyDream”. This Chinese-speaking actor has been active for at least a few years and possesses different implants with various capabilities. Since mid-2018, researchers at Kaspersky saw continuing high activity from this threat actor and among their targets were a number of high-level government organisations as well as some political parties from various Asian countries including the Philippines, Thailand, Vietnam, and Malaysia. The campaign comprises a number of cyber espionage tools with various capabilities. As of the latest monitoring of the global cybersecurity company, FunnyDream's espionage attacks are still ongoing.

Tools Used 12

ccf32 Chinoxy Filepak FilepakMonitor FunnyDream Keyrecord Md_client PCShare ScreenCap TcpBridge Tcp_transfer Living off the Land

Reports & References 3

https://www.digitalnewsasia.com/business/kaspersky-2019-apt-report-cyberspying-groups-hunt-intelligence-sea https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf https://go.recordedfuture.com/hubfs/reports/cta-2021-1208.pdf

ETDA Profile

FunnyDream

Origin

China

First Seen 2018

Motivation

Information theft and espionage

View on ETDA APT Groups ↗