🇨🇳

SVCMONDR

APT Group Information theft and espionage ETDA ✓

Also Known As 3 names

G0023 APT 16 SVCMONDR

Target Countries 3

Countries highlighted in red

Japan Thailand Province of China Taiwan

Sectors Targeted

Financial Government High-Tech Media

Details

Origin 🇨🇳 CN

Last Updated 01 Jun 2022

Malware Families 1

ironhalo

MITRE ATT&CK 9

T1056 T1071 T1078 T1105 T1272 T1334 T1566.001 T1584 T1584.004

Related Zero-Days

No zero-day CVE linked to this actor

Known Names 3 entries

APT 16 Mandiant

SVCMONDR Kaspersky

G0023 MITRE

Observed Target Countries 3

Based on ETDA data — countries highlighted in red

Japan Taiwan Thailand

Description

(FireEye) Between November 26, 2015, and December 1, 2015, known and suspected China-based APT groups launched several spear-phishing attacks targeting Japanese and Taiwanese organizations in the high-tech, government services, media and financial services industries. Each campaign delivered a malicious Microsoft Word document exploiting the aforementioned EPS dict copy use-after-free vulnerability, and the local Windows privilege escalation vulnerability CVE-2015-1701. The successful exploitation of both vulnerabilities led to the delivery of either a downloader that we refer to as IRONHALO, or a backdoor that we refer to as ELMER.

Tools Used 3

ELMER IRONHALO SVCMONDR

Reports & References 2

https://securelist.com/cve-2015-2545-overview-of-current-threats/74828/ https://www.fireeye.com/blog/threat-research/2015/12/the-eps-awakens-part-two.html

ETDA Profile

APT 16, SVCMONDR

Origin

China

First Seen 2015

Motivation

Information theft and espionage

MITRE ATT&CK Groups

https://attack.mitre.org/groups/G0023/

View on ETDA APT Groups ↗