Authored by: Tara Gould and Rory Gould
- Spearphishing emails are targeting the manufacturing industry in Taiwan and South Korea to spread malware.
- Anomali Threat Research assesses with moderate confidence that this campaign is being conducted by the threat group, Aggah.
Anomali Threat Research discovered a spearphishing campaign that appears to have begun in early July 2021, targeting the manufacturing industry throughout Asia. The tactics, techniques, and procedures (TTPs) identified in this campaign align with the Aggah threat group. Our analysis found multiple PowerPoint files that contained malicious macros that used MSHTA to execute a script utilizing PowerShell to load hex-encoded payloads. Based on the TTPs of this campaign, we assess with moderate confidence this is Aggah.
Aggah is an information-motivated threat group that was first identified in March 2019 by researchers from Unit 42. The researchers initially believed the activity was a campaign targeting entities in the United Arab Emirates (UAE). Further investigation by the same team revealed it to be a global phishing campaign designed to deliver RevengeRat.
Unit 42 first assessed, due to shared high level TTPs as well as the use of RevengeRat, Aggah was associated with the Gorgon Group, a Pakistani group known for targeting Western governments. However, there were prominent Gorgon Group indicators not observed during that investigation, and therefore Unit 42 was unable to formally associate Aggah with the Gorgon Group. Other researchers agree that Aggah is an Urdu speaking Pakistani group due to the use of Urdu words written in Latin script, but stress this does not mean they are the Gorgon Group.
Aggah has been consistently active since 2019, generally using the same identifiable TTPs, in 2020 the group conducted a campaign targeting the Italian manufacturing sector. Later that same year, Aggah were observed likely selling or loaning malware to lower-level Nigerian actors. Historically the group has used Internet Archive, Pastebin and Blogspot to host malicious scripts and payloads, usually RevengeRAT. The move to using compromised sites is likely due to fact the Internet Archive hosted files are being taken down much quicker and is a notable change for Aggah.
The infection process began with a custom spearphishing email masquerading as “FoodHub.co.uk”, an online food delivery service based in the United Kingdom. The body of the email contained order and shipping information along with an attached PowerPoint file named “Purchase order 4500061977,pdf.ppam”. The email in Figure 1 below was sent on July 8, 2021 to Fon-star International Technology, a Taiwan-based manufacturing company. Other spearphishing emails were sent to CSE group, a Taiwanese manufacturing company, FomoTech, a Taiwanese engineering company, and to Hyundai Electric, a Korean power company. Spoofed business-to-business (B2B) email addresses against the targeted industry is activity consistent with Aggah.
Figure 1 - Spoofed Spearphishing Email Sent to Fon Star
File name Purchase order 4500061977,pdf.ppam
Figure 2 - Macro
Hoteloscar.in is the legitimate website for a hotel in India that has been compromised to host malicious scripts. Throughout this campaign, we observed legitimate websites being used to host the malicious scripts, most of which appeared to be WordPress sites, indicating the group may have exploited a WordPress vulnerability.
Figure 4 - “mshta http://dlsc.af/wp-admin/buy/5.html”
Once directed to “dlsc.af” an obfuscated script (Figure 5) created a PowerShell process to execute another PowerShell file hosted on dlsc.af, “party.txt”.
Figure 5 - Obfuscated HTA Script
Figure 6 - Script to Download AV Checks File
Party.txt, shown in Figure 7, was a PowerShell file that checked for the antivirus status. Four conditions were checked:
- Windows Defender status
- ESET status
- If Windows Defender is stopped
- If neither are running
Based on these criteria, a PowerShell file is downloaded depending on the antivirus status, which contained a hex encoded loader and payload. Based on these checks, a different loader was used to inject the Warzone payload into various legitimate processes.
Figure 7 - Party.txt
For the purposes of this reporting this analysis will focus on the infection chain when Windows Defender was running on a targeted system. With Windows Defender running, “wd.txt” a Powershell file, was downloaded and executed. The infection chain was largely similar against the other antivirus statuses, ESET and no antivirus running.
Figure 8 - Screenshot of “wd.txt”
The first function, represented in Figure 8, was decoded using a rolling XOR function shown in Figure 9. This loaded a DLL into memory via reflective DLL injection designed to be used as an AMSI (Anti Malware Scripting Interface) bypass.
Figure 9 - Decoding function
AMSI allows for security products to be integrated with applications. AMSI bypass is performed by memory patching, which changed the behavior of the function AmsiScanBuffer. The code loaded ‘amsi.dll’ with LoadLibrary, used GetProcAddress to locate the function in memory and then overwrites using VirtualProtect. The DLL Aggah used to bypass AMSI (shown in Figure 10) was taken from Mor Davidovich, a pentester who wrote the code to evade Windows Defender.
Figure 10 - Class AMS that is Loaded for AMSI Bypass
Figure 11 - Snippet of Hex Encoded Payload
After the AMSI bypass, the variable $HH, which is a hex-encoded payload of Warzone RAT (Figure 11), was loaded into memory and injected into an ASP.NET compiler process.
Figure 12 - Process Hollowing Function
As shown in Figure 12, the loader was used to load and inject Warzone into an ASP.NET compiler process. Under the condition of ESET running or no antivirus running, the same payload was loaded and injected into an MSBuild process using either k.HackItUp or VNPT.B injector DLLs.
Warzone RAT is a commodity info stealer written in C++ that is widely available for purchase on criminal forums. Warzone is a commodity malware, with cracked versions hosted on GitHub. The RAT reuses code from the Ave Maria stealer. The functionality of Warzone includes:
- Privilege Escalation
- Remote Shell
- Download and execute Files
- File manager
To bypass User Account Control (UAC), the Windows Defender path was added to a PowerShell command to exclude it. Privilege escalation in Warzone was carried out using sdclt.exe, a Windows backup utility in Windows 10.
Figure 13 - Exclusion Path for PowerShell Command
Figure 14 - Warzone Frequently Makes Mention of Security Researchers and Midgetporn
Warzone has the capabilities to steal credentials from a range of browsers and email clients. Shown in Figure 14, these include:
- Google Chrome
- Microsoft Edge
- QQ Browser
- UC Browser
Figure 15 - Credential Stores Warzone Checks
The TTPs used in this campaign align with previous activity of the group known as Aggah. The attribution to Aggah is based on:
Obfuscated payloads in a PowerShell file, typically hex-encoded.
Previous campaigns of Aggah used ‘j.mp’ URL shortener.
Reuse of class names, k.HackItUp, VPNT.B, A.B.
Spoofed B2B email addresses within target industry.
The use of malicious documents, and malicious PowerPoint files containing macros is common among Aggah’s previous TTPs.
Themes of order and payment information.
Use of scripts embedded in websites.
Use of ‘RegWrite mshta “url”’ is seen commonly in Aggah campaigns.
While Aggah has been active since at least 2019 and is known for hosting payloads on the Internet Archive and BlogSpot, this recent campaign suggests the group may have the ability to evolve. The move towards abusing compromised sites shows an ongoing ability to adapt as the use of these sites will aid in evading detection, especially with BlogSpot sites being taken down and many payloads being promptly removed from the Internet Archive.
 Robert Falcone and Brittany Barbehenn, “Aggah Campaign: Bit.ly, BlogSpot, and Pastebin Used for C2 in Large Scale Campaign,” Unit42, accessed July 29, 2021, https://unit42.paloaltonetworks.com/aggah-campaign-bit-ly-blogspot-and-pastebin-used-for-c2-in-large-scale-campaign/.
 M, Winston,““Aggah” campaign continues: Urdu speaking Threat Actor behind the latest campaign which delivers Loki Bot Spyware,” Medium, published April 13, 2021, accessed July 29, 2021, https://winstonmmd.medium.com/?p=c37c08624308.
 “Cyber-Criminal Espionage operation insists on Italian Manufacturing,” Yoroi, accessed July 29, 2021, published May 22, 2020, https://yoroi.company/research/cyber-criminal-espionage-operation-insists-on-italian-manufacturing/.
 Paul Burbage, “Aggah: Not Exactly APT,” Medium, accessed July 29, 2021, published February 7 2020, https://firstname.lastname@example.org/aggah-not-exactly-apt-5e51aaff95f5.
 Luigi Martire and Luca Mella, “The "WayBack" Campaign: a Large Scale Operation Hiding in Plain Sight,” Yoroi, accessed July 29, 2021, published June 29, 2020, https://yoroi.company/research/the-wayback-campaign-a-large-scale-operation-hiding-in-plain-sight/?web_view=true.
 Alex Holland, “Aggah Campaign’s Latest Tactics: Victimology, PowerPoint Dropper and Cryptocurrency Stealer,” HP, accessed July 29, 2021, published July 1, 2020,https://threatresearch.ext.hp.com/aggah-campaigns-latest-tactics-victimology-powerpoint-dropper-and-cryptocurrency-stealer/.
 “Amsi Bypass Post,” Dec0ne, accessed August 5, 2021, published November 8, 2019, https://dec0ne.github.io/research/2019-11-08-Amsi-bypass-post/.
 “Warzone 1.0 RAT Analysis Report,”, Domain Tools, accessed July 29, 2021, published September 11, 2019, https://www.domaintools.com/resources/blog/warzone-1-0-rat-analysis-report.
 “Warzone RAT,” Warzone, accessed July 29, 2021, https://warzone.pw/.
|Initial Access||T1566.001||Phishing: Spearphishing Attachment|
|Execution||T1059||Command Line Interface|
|T1204.002||User Execution: Malicious file|
|Persistence||T1547.001||Registry Run Keys|
|Privilege Escalation||T1548.002||Bypass User Account Control|
|T1547.001||Registry Run Keys/Startup Folder|
|T1055.001||Dynamic-link Library Injection|
|Defense Evasion||T1140||Deobfuscate/Decode Files or Information|
|T1562.001||Impair Defenses: Disable or Modify Tools|
|T1218.005||Signed Binary Proxy Execution: Mshta|
|Credential Access||T1056||Input Capture|
|T1552.001||Credentials In Files|
|Lateral Movement||T1021.001||Remote Desktop Protocol|
|T1082||System Information Discovery|
|T1082||File and Directory Discovery|
|T1114.001||Email Collection: Local Email Collection|
|Command and Control||T1105||Ingress Tool Transfer|
Maldocs and Payloads
Figure 16 - Similar Campaign Found on Compromised Site of Elmer Floyd, a North Carolina State Representative
Figure 17 - Directory of Malicious Files Hosted on Elmer Floyd Compromised Site
Figure 18 - Another Example of a Spoofed Email. This one appears to be spoofing Chemtron, a chemical plant.
Figure 19 - Same PowerPoint File Sent in Another Spearphishing Email to Hyundai
Figure 20 - Another Example of a Spearphishing Email. This one is imitating a real employee from Rexel Group, a US management services company, with a PowerPoint file containing macros.