🇨🇳

Nightshade Panda

APT Group Information theft and espionage Financial gain ETDA ✓

Also Known As 7 names

FlowerLady FlowerShow Nightshade Panda Group 27 Red Pegasus APT 9 APT9

Target Countries 17

Countries highlighted in red

Belgium France Hungary India Italy Japan Republic of Korea Myanmar Mongolia Malaysia Russian Federation Singapore Thailand Turkey Province of China Taiwan Ukraine United States

Sectors Targeted

Space Research and Technology 927 Educational Services 61 Gambling Industries 7132 Information 51 Utilities 22 Arts, Entertainment, and Recreation 71 Other Services (except Public Administration) 81 Publishing Industries (except Internet) 511 Utilities Construction 23 Aircraft Manufacturing 336411 NAICS:31 31 Chemical Manufacturing 325 Other Information Services 519 National Security and International Affairs 928 Public Administration 92 Air Transportation 481 Health Care and Social Assistance 62 Media Energy Government Professional, Scientific, and Technical Services 54 Telecommunications 517 Finance and Insurance 52 Insurance Carriers and Related Activities 524

Details

Origin 🇨🇳 CN

Last Updated 01 Jun 2022

Malware Families 1

sorgu

MITRE ATT&CK 5

T1003 T1071.001 T1078 T1210 T1566.001

Related Zero-Days

No zero-day CVE linked to this actor

Known Names 5 entries

Nightshade Panda CrowdStrike

APT 9 Mandiant

Group 27 ASERT

FlowerLady Context

FlowerShow Context

Observed Target Countries 4

Based on ETDA data — countries highlighted in red

Myanmar Thailand USA Europe

Description

(Softpedia) Arbor’s ASERT team is now reporting that, after looking deeper at that particular campaign, and by exposing a new trail in the group’s activities, they managed to identify a new RAT that was undetectable at that time by most antivirus vendors. Named Trochilus, this new RAT was part of Group 27’s malware portfolio that included six other malware strains, all served together or in different combinations, based on the data that needed to be stolen from each victim. This collection of malware, dubbed the Seven Pointed Dagger by ASERT experts, included two different PlugX versions, two different Trochilus RAT versions, one version of the 3012 variant of the 9002 RAT, one EvilGrab RAT version, and one unknown piece of malware, which the team has not entirely decloaked just yet.

Tools Used 7

3102 RAT 9002 RAT EvilGrab RAT MoonWind RAT PlugX Poison Ivy Trochilus RAT

Operations 3

2015-05 Operation “Seven Pointed Dagger” During that campaign, the threat actor identified as Group 27 used watering hole attacks on official Myanmar government websites to infect unsuspecting users with the PlugX malware (an RAT) when accessing information on the upcoming Myanmar elections. https://news.softpedia.com/news/trochilus-rat-evades-antivirus-detection-used-for-cyber-espionage-in-south-east-asia-498776.shtml https://unit42.paloaltonetworks.com/evilgrab-delivered-by-watering-hole-attack-on-president-of-myanmars-website/ http://pages.arbornetworks.com/rs/082-KNA-087/images/ASERT%20Threat%20Intelligence%20Brief%202015-05%20PlugX%20Threat%20Activity%20in%20Myanmar.pdf

2015-05 Chinese Actors Use ‘3102’ Malware in Attacks on US Government and EU Media https://unit42.paloaltonetworks.com/chinese-actors-use-3102-malware-in-attacks-on-us-government-and-eu-media/

2016-09 From September 2016 through late November 2016, a threat actor group used both the Trochilus RAT and a newly idenfied RAT we’ve named MoonWind to target organizations in Thailand, including a utility organization. We chose the name ‘MoonWind’ based on debugging strings we saw within the samples, as well as the compiler used to generate the samples. The attackers compromised two legitimate Thai websites to host the malware, which is a tactic this group has used in the past. https://unit42.paloaltonetworks.com/unit42-trochilus-rat-new-moonwind-rat-used-attack-thai-utility-organizations/

ETDA Profile

Nightshade Panda, APT 9, Group 27

Origin

China

First Seen 2013

Motivation

Information theft and espionage

View on ETDA APT Groups ↗