Aggah Using Compromised Websites to Target Businesses Across Asia, Including Taiwan Manufacturing Industry

Authored by: Tara Gould and Rory Gould

Key Findings

  • Spearphishing emails are targeting the manufacturing industry in Taiwan and South Korea to spread malware.
  • Compromised websites are being used to host malicious JavaScript, VBScript and PowerShell scripts; delivering Warzone RAT.
  • Anomali Threat Research assesses with moderate confidence that this campaign is being conducted by the threat group, Aggah.


Anomali Threat Research discovered a spearphishing campaign that appears to have begun in early July 2021, targeting the manufacturing industry throughout Asia. The tactics, techniques, and procedures (TTPs) identified in this campaign align with the Aggah threat group. Our analysis found multiple PowerPoint files that contained malicious macros that used MSHTA to execute a script utilizing PowerShell to load hex-encoded payloads. Based on the TTPs of this campaign, we assess with moderate confidence this is Aggah.


Aggah is an information-motivated threat group that was first identified in March 2019 by researchers from Unit 42.[1] The researchers initially believed the activity was a campaign targeting entities in the United Arab Emirates (UAE). Further investigation by the same team revealed it to be a global phishing campaign designed to deliver RevengeRat.[2]

Unit 42 first assessed, due to shared high level TTPs as well as the use of RevengeRat, Aggah was associated with the Gorgon Group, a Pakistani group known for targeting Western governments.[3] However, there were prominent Gorgon Group indicators not observed during that investigation, and therefore Unit 42 was unable to formally associate Aggah with the Gorgon Group. Other researchers agree that Aggah is an Urdu speaking Pakistani group due to the use of Urdu words written in Latin script, but stress this does not mean they are the Gorgon Group.[4]

Aggah has been consistently active since 2019, generally using the same identifiable TTPs, in 2020 the group conducted a campaign targeting the Italian manufacturing sector.[5] Later that same year, Aggah were observed likely selling or loaning malware to lower-level Nigerian actors.[6] Historically the group has used Internet Archive, Pastebin and Blogspot to host malicious scripts and payloads, usually RevengeRAT.[7] The move to using compromised sites is likely due to fact the Internet Archive hosted files are being taken down much quicker and is a notable change for Aggah.

Technical Analysis


The infection process began with a custom spearphishing email masquerading as “”, an online food delivery service based in the United Kingdom. The body of the email contained order and shipping information along with an attached PowerPoint file named “Purchase order 4500061977,pdf.ppam”. The email in Figure 1 below was sent on July 8, 2021 to Fon-star International Technology, a Taiwan-based manufacturing company. Other spearphishing emails were sent to CSE group, a Taiwanese manufacturing company, FomoTech, a Taiwanese engineering company, and to Hyundai Electric, a Korean power company. Spoofed business-to-business (B2B) email addresses against the targeted industry is activity consistent with Aggah.[8]

Spoofed Spearphishing Email Sent to Fon Star
Figure 1
- Spoofed Spearphishing Email Sent to Fon Star

PowerPoint File

File name Purchase order 4500061977,pdf.ppam
MD5 b5a31dd4a6af746f32149f9706d68f45

When we analyzed the PowerPoint file, we found obfuscated macros (Figure 2) contained in the document that used MSHTA to execute JavaScript from “http://j[.]mp/4545hhhsdf3qassd3asd2”, which resolved to “[.]html”. At the time of publishing, the site was still hosting the malicious script. “” is a URL shortener service part of Bitly.

Figure 2
- Macro is the legitimate website for a hotel in India that has been compromised to host malicious scripts. Throughout this campaign, we observed legitimate websites being used to host the malicious scripts, most of which appeared to be WordPress sites, indicating the group may have exploited a WordPress vulnerability.

Viewing the page source, there was obfuscated JavaScript, as shown in Figure 3.

Obfuscated JavaScript on
Figure 3
- Obfuscated JavaScript on

The JavaScript utilized anti-debugging techniques such as, using setInterval to detect the use of a debugger based on the execution time, which will go into an infinite loop if a debugger is detected. After the debugging checks, the script returned “mshta[.]html”, another compromised website for an Afgan food distributor, shown in Figure 4.

Figure 4
- “mshta”

Once directed to “” an obfuscated script (Figure 5) created a PowerShell process to execute another PowerShell file hosted on, “party.txt”.

Obfuscated HTA Script
Figure 5
- Obfuscated HTA Script

Script to Download AV Checks File
Figure 6
- Script to Download AV Checks File

Party.txt, shown in Figure 7, was a PowerShell file that checked for the antivirus status. Four conditions were checked:

  • Windows Defender status
  • ESET status
  • If Windows Defender is stopped
  • If neither are running

Based on these criteria, a PowerShell file is downloaded depending on the antivirus status, which contained a hex encoded loader and payload. Based on these checks, a different loader was used to inject the Warzone payload into various legitimate processes.

Figure 7
- Party.txt

For the purposes of this reporting this analysis will focus on the infection chain when Windows Defender was running on a targeted system. With Windows Defender running, “wd.txt” a Powershell file, was downloaded and executed. The infection chain was largely similar against the other antivirus statuses, ESET and no antivirus running.

Screenshot of “wd.txt”
Figure 8
- Screenshot of “wd.txt”

The first function, represented in Figure 8, was decoded using a rolling XOR function shown in Figure 9. This loaded a DLL into memory via reflective DLL injection designed to be used as an AMSI (Anti Malware Scripting Interface) bypass.

Decoding function
Figure 9
- Decoding function

AMSI allows for security products to be integrated with applications. AMSI bypass is performed by memory patching, which changed the behavior of the function AmsiScanBuffer. The code loaded ‘amsi.dll’ with LoadLibrary, used GetProcAddress to locate the function in memory and then overwrites using VirtualProtect. The DLL Aggah used to bypass AMSI (shown in Figure 10) was taken from Mor Davidovich, a pentester who wrote the code to evade Windows Defender.[9]

Class AMS that is Loaded for AMSI Bypass
Figure 10
- Class AMS that is Loaded for AMSI Bypass

Snippet of Hex Encoded Payload
Figure 11
- Snippet of Hex Encoded Payload

After the AMSI bypass, the variable $HH, which is a hex-encoded payload of Warzone RAT (Figure 11), was loaded into memory and injected into an ASP.NET compiler process.

Process Hollowing Function
Figure 12
- Process Hollowing Function

As shown in Figure 12, the loader was used to load and inject Warzone into an ASP.NET compiler process. Under the condition of ESET running or no antivirus running, the same payload was loaded and injected into an MSBuild process using either k.HackItUp or VNPT.B injector DLLs.

Warzone RAT

MD5 5540511a186c7e9dd1c1465b3b5c8197

Warzone RAT is a commodity info stealer written in C++ that is widely available for purchase on criminal forums. Warzone is a commodity malware, with cracked versions hosted on GitHub. The RAT reuses code from the Ave Maria stealer.[10] The functionality of Warzone includes:[11]

  • Privilege Escalation
  • Keylogging
  • Remote Shell
  • Download and execute Files
  • File manager
  • Persistence

To bypass User Account Control (UAC), the Windows Defender path was added to a PowerShell command to exclude it. Privilege escalation in Warzone was carried out using sdclt.exe, a Windows backup utility in Windows 10.

Exclusion Path for PowerShell Command
Figure 13
- Exclusion Path for PowerShell Command

Warzone Frequently Makes Mention of Security Researchers and Midgetporn
Figure 14
- Warzone Frequently Makes Mention of Security Researchers and Midgetporn

Warzone has the capabilities to steal credentials from a range of browsers and email clients. Shown in Figure 14, these include:

  • Chromium
  • Foxmail
  • Google Chrome
  • Microsoft Edge
  • Opera
  • Outlook
  • QQ Browser
  • Thunderbird
  • UC Browser

Credential Stores Warzone Checks
Figure 15
- Credential Stores Warzone Checks


The TTPs used in this campaign align with previous activity of the group known as Aggah. The attribution to Aggah is based on:

  • Obfuscated payloads in a PowerShell file, typically hex-encoded.

  • Previous campaigns of Aggah used ‘’ URL shortener.

  • Reuse of class names, k.HackItUp, VPNT.B, A.B.

  • Spoofed B2B email addresses within target industry.

  • The use of malicious documents, and malicious PowerPoint files containing macros is common among Aggah’s previous TTPs.

  • Themes of order and payment information.

  • Use of scripts embedded in websites.

  • Use of ‘RegWrite mshta “url”’ is seen commonly in Aggah campaigns.


While Aggah has been active since at least 2019 and is known for hosting payloads on the Internet Archive and BlogSpot, this recent campaign suggests the group may have the ability to evolve. The move towards abusing compromised sites shows an ongoing ability to adapt as the use of these sites will aid in evading detection, especially with BlogSpot sites being taken down and many payloads being promptly removed from the Internet Archive.


[1] Robert Falcone and Brittany Barbehenn, “Aggah Campaign:, BlogSpot, and Pastebin Used for C2 in Large Scale Campaign,” Unit42, accessed July 29, 2021,

[2] Ibid.

[3] Ibid.

[4] M, Winston,““Aggah” campaign continues: Urdu speaking Threat Actor behind the latest campaign which delivers Loki Bot Spyware,” Medium, published April 13, 2021, accessed July 29, 2021,

[5] “Cyber-Criminal Espionage operation insists on Italian Manufacturing,” Yoroi, accessed July 29, 2021, published May 22, 2020,

[6] Paul Burbage, “Aggah: Not Exactly APT,” Medium, accessed July 29, 2021, published February 7 2020,

[7] Luigi Martire and Luca Mella, “The "WayBack" Campaign: a Large Scale Operation Hiding in Plain Sight,” Yoroi, accessed July 29, 2021, published June 29, 2020,

[8] Alex Holland, “Aggah Campaign’s Latest Tactics: Victimology, PowerPoint Dropper and Cryptocurrency Stealer,” HP, accessed July 29, 2021, published July 1, 2020,

[9] “Amsi Bypass Post,” Dec0ne, accessed August 5, 2021, published November 8, 2019,

[10] “Warzone 1.0 RAT Analysis Report,”, Domain Tools, accessed July 29, 2021, published September 11, 2019,

[11] “Warzone RAT,” Warzone, accessed July 29, 2021,


Initial AccessT1566.001Phishing: Spearphishing Attachment
ExecutionT1059Command Line Interface
 T1204.002User Execution: Malicious file
PersistenceT1547.001Registry Run Keys
Privilege EscalationT1548.002Bypass User Account Control
 T1055Process Injection
 T1055.012Process Hollowing
 T1547.001Registry Run Keys/Startup Folder
 T1055.001Dynamic-link Library Injection
Defense EvasionT1140Deobfuscate/Decode Files or Information
 T1562.001Impair Defenses: Disable or Modify Tools
 T1218.005Signed Binary Proxy Execution: Mshta
Credential AccessT1056Input Capture
 T1552.001Credentials In Files
Lateral MovementT1021.001Remote Desktop Protocol
DiscoveryT1057Process Discovery
 T1082System Information Discovery
 T1082File and Directory Discovery
CollectionT1125Video Capture
 T1114.001Email Collection: Local Email Collection
Command and ControlT1105Ingress Tool Transfer


Maldocs and Payloads


Compromised sites


Similar Campaign Found on Compromised Site of Elmer Floyd, a North Carolina State Representative
Figure 16
- Similar Campaign Found on Compromised Site of Elmer Floyd, a North Carolina State Representative

Directory of Malicious Files Hosted on Elmer Floyd Compromised Site
Figure 17
- Directory of Malicious Files Hosted on Elmer Floyd Compromised Site​​​​​​​

Another Example of a Spoofed Email. This one appears to be spoofing Chemtron, a chemical plant.
Figure 18
- Another Example of a Spoofed Email. This one appears to be spoofing Chemtron, a chemical plant.

Same PowerPoint File Sent in Another Spearphishing Email to Hyundai
Figure 19
- Same PowerPoint File Sent in Another Spearphishing Email to Hyundai​​​​​​​

Another Example of a Spearphishing Email. This one is imitating a real employee from Rexel Group, a US management services company, with a PowerPoint file containing macros.
Figure 20
- Another Example of a Spearphishing Email. This one is imitating a real employee from Rexel Group, a US management services company, with a PowerPoint file containing macros.



Related Content

Get the Anomali Newsletter

The latest Anomali updates and cybersecurity news, delivered straight to your inbox each month.