🇨🇳

Mofang

APT Group Information theft and espionage ETDA ✓

Also Known As 2 names

BRONZE WALKER Superman

Target Countries 7

Countries highlighted in red

Canada Germany India Republic of Korea Myanmar Singapore United States

Sectors Targeted

Critical infrastructure Media Automotive Telecommunications weapon industries Business, Professional, Labor, Political, and Similar Organizations 8139 Healthcare Government Defense Internet Publishing and Broadcasting and Web Search Portals 51913 Engineering

Details

Origin 🇨🇳 CN

Last Updated 01 Jun 2022

Malware Families 1

zhmimikatz

MITRE ATT&CK 23

T1003 T1003.001 T1027 T1027.013 T1027.015 T1036 T1036.005 T1059 T1068 T1071.001 T1078.001 T1105 T1204 T1204.001 T1204.002 T1210 T1566 T1566.001 T1566.002 T1574 T1574.001 T1588 T1588.002

Related Zero-Days

No zero-day CVE linked to this actor

Known Names 9 entries

Whitefly Symantec

Mofang Fox-IT

TEMP.Mimic FireEye

Bronze Walker SecureWorks

ATK 83 Thales

SectorM04 ThreatRecon

Superman ?

G0103 MITRE

G0107 MITRE

Observed Target Countries 7

Based on ETDA data — countries highlighted in red

Canada Germany India Myanmar Singapore South Korea USA

Description

(Fox-IT) Mofang is a threat actor that almost certainly operates out of China and is probably government-affiliated. It is highly likely that Mofang’s targets are selected based on involvement with investments, or technological advances that could be perceived as a threat to the Chinese sphere of influence. This is most clearly the case in a campaign focusing on government and critical infrastructure of Myanmar that is described in this report. Chances are about even, though, that Mofang is a relevant threat actor to any organization that invests in Myanmar or is otherwise politically involved. In addition to the campaign in Myanmar, Mofang has been observed to attack targets across multiple sectors (government, military, critical infrastructure and the automotive and weapon industries) in multiple countries.

Tools Used 6

Mimikatz Nibatad ShimRAT Termite Vcrodat Living off the Land

Operations 1

2018-07 Breach of SingHealth https://www.reuters.com/article/us-singapore-cyberattack/cyberattack-on-singapore-health-database-steals-details-of-1-5-million-including-pm-idUSKBN1KA14J https://redalert.nshc.net/2019/03/19/sectorm04-targeting-singapore-custom-malware-analysis/

Reports & References 2

https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf https://www.symantec.com/blogs/threat-intelligence/whitefly-espionage-singapore

ETDA Profile

Whitefly, Mofang

Origin

[Unknown]

First Seen 2012

Motivation

Information theft and espionage

MITRE ATT&CK Groups

https://attack.mitre.org/groups/G0103/ https://attack.mitre.org/groups/G0107/

View on ETDA APT Groups ↗