🇨🇳

BRONZE EDGEWOOD

APT Group Information theft and espionage ETDA ✓

Also Known As 1 names

Red HariasaY

Target Countries 7

Countries highlighted in red

Indonesia Kyrgyzstan Malaysia Philippines Thailand Province of China Taiwan Vietnam

Sectors Targeted

No targeted sector recorded

Details

Origin 🇨🇳 CN

Last Updated 23 Jul 2022

MITRE ATT&CK 4

T1059.003 T1071.001 T1078.001 T1566.002

Related Zero-Days

No zero-day CVE linked to this actor

Known Names 4 entries

FunnyDream Kaspersky

Red Hariasa PWC

Bronze Edgewood SecureWorks

TAG-16 Recorded Future

Observed Target Countries 6

Based on ETDA data — countries highlighted in red

Indonesia Malaysia Philippines Taiwan Thailand Vietnam

Description

In early 2020 Kaspersky published a report based on its investigation of an ongoing attack campaign called “FunnyDream”. This Chinese-speaking actor has been active for at least a few years and possesses different implants with various capabilities. Since mid-2018, researchers at Kaspersky saw continuing high activity from this threat actor and among their targets were a number of high-level government organisations as well as some political parties from various Asian countries including the Philippines, Thailand, Vietnam, and Malaysia. The campaign comprises a number of cyber espionage tools with various capabilities. As of the latest monitoring of the global cybersecurity company, FunnyDream's espionage attacks are still ongoing.

Tools Used 12

ccf32 Chinoxy Filepak FilepakMonitor FunnyDream Keyrecord Md_client PCShare ScreenCap TcpBridge Tcp_transfer Living off the Land

Reports & References 3

https://www.digitalnewsasia.com/business/kaspersky-2019-apt-report-cyberspying-groups-hunt-intelligence-sea https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf https://go.recordedfuture.com/hubfs/reports/cta-2021-1208.pdf

ETDA Profile

FunnyDream

Origin

China

First Seen 2018

Motivation

Information theft and espionage

View on ETDA APT Groups ↗