Loading malware…
PhantomNet, also known as SManager and DOWNTOWN, is a modular Windows backdoor used in cyberespionage operations. It collects victim-system information and downloads and executes additional payloads through a plugin architecture. Collected information includes computer and host names, operating-system version, language settings, username, default browser, network addressing, and administrative privilege status. Its command set supports plugin management and cleanup, allowing operators to extend its functionality after deployment.
PhantomNet exists in TCP and SSL/TLS variants. Observed HTTPS variants use Microsoft Security Support Provider Interface functions and certificate pinning to protect command-and-control communications against interception. The backdoor can retrieve system proxy settings to reach its command-and-control infrastructure, and observed samples encrypt their configuration with RC4. Deployment components establish persistence through Windows services when administrative privileges are available or scheduled tasks when they are not.
PhantomNet was distributed in a 2020 software supply-chain compromise of the Vietnam Government Certification Authority, in which legitimate digital-signature software installers were modified to deploy the backdoor alongside the genuine application. Victims were also observed in the Philippines. The malware is associated with the China-linked espionage actor TA428, also tracked as BRONZE DUDLEY, and has been used by Worok and other China-nexus activity clusters. UNC5330 deployed it during post-compromise activity following exploitation of Ivanti Connect Secure vulnerabilities. It was also deployed by Cluster Alpha during the Crimson Palace espionage campaign against a Southeast Asian government organization.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
7 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Post-compromise activity by UNC5330 includes deployment of PHANTOMNET and TONERJAM.
BRONZE DUDLEY ... Tools ... NCCTrojan, PhantomNet, PoisonIvy, Royal Road
これらのファイルはPhantomNetというPDBを含んでいたことから、以下ではPhantomNetと呼びます。PhantomNetの挙動はTmangerやSmanagerと類似しています。
これらのファイルはPhantomNetというPDBを含んでいたことから、以下ではPhantomNetと呼びます。PhantomNetの挙動はTmangerやSmanagerと類似しています。
+1 more in the app. View in Mallory
26 distinct techniques documented for this family, organized by ATT&CK tactic.
In December 2020, Ignacio Sanmillan and Matthieu Faou released an excellent report on a Vietnamese supply-chain attack that used PhantomNet ( aka SManager) malware.
Attackers modified the installer of the GCA01 software that is hosted on ca.gov.vn and added a backdoor to the MSI installer.
「A Letter of Complaint.docx」というドキュメントファイル...香港の裁判所に関する内容を含んでおり、香港の司法関係組織を標的としていると考えられます。 このドキュメントファイルには...SCTファイルをダウンロードし、実行してしまいます。
UNC5330 has employed Windows Management Instrumentation (WMI) to perform reconnaissance, move laterally, manipulate registry entries, and establish persistence.
The researchers noted that the malware’s persistence was established via a scheduled task that called the malicious DLL’s export, ‘Entery’.
If the user doesn’t have admin privileges, PhantomNet persists via a scheduled task.
C&Cサーバーとのコネクション確立後、C&Cサーバーから受信したデータに応じてコマンドを実行します。
SCTファイルにはVBScriptコードが含まれており、最終的にwinhepp.exeというファイルをダウンロードして実行しました。
他にもRTFファイルを用いて脆弱性を悪用すること、CABファイルを用いること、サブコマンドを用いること、Export関数名などが類似しています。
The victim needs to manually execute the trojanized installer.
ServiceMain takes a service name as an argument and attempts to register a service control handler with a specific HandlerProc function meant to check and set the status of that service. With a valid service status handle, Mail-O detaches the calling process from its console, changes the service status values to reflect its current running state, and calls the Entery function.
MDR launched the hunt after the discovery of a DLL sideloading technique that exploited VMNat.exe, a VMware component... The Crimson Palace campaign included over 15 distinct DLL sideloading scenarios... Cluster Alpha activity included multiple sideloading attempts to deploy various malware... Cluster Bravo used renamed versions of a signed side-loadable binary (mscorsvw.exe) to obfuscate backdoor deployment.
The researchers noted that the malware’s persistence was established via a scheduled task that called the malicious DLL’s export, ‘Entery’.
If the user doesn’t have admin privileges, PhantomNet persists via a scheduled task.
UNC5330 has employed Windows Management Instrumentation (WMI) to perform reconnaissance, move laterally, manipulate registry entries, and establish persistence.
If the user has admin privileges, PhantomNet persists via a Windows service.
The researchers noted that the malware’s persistence was established via a scheduled task that called the malicious DLL’s export, ‘Entery’.
If the user doesn’t have admin privileges, PhantomNet persists via a scheduled task.
If the user has admin privileges, PhantomNet persists via a Windows service.
Use of renamed versions of a signed side-loadable binary (mscorsvw.exe) to obfuscate backdoor deployment and move laterally... Sophos observed the PhantomNet backdoor implant (sslwnd64.exe)...
the HUI loader (msedge_elf.dll), which de-obfuscated the file log.ini to reveal a Cobalt Strike reflective Loader
the actor frequently abused endpoint protection software binaries to sideload their malicious payloads.
MDR launched the hunt after the discovery of a DLL sideloading technique that exploited VMNat.exe, a VMware component... The Crimson Palace campaign included over 15 distinct DLL sideloading scenarios... Cluster Alpha activity included multiple sideloading attempts to deploy various malware... Cluster Bravo used renamed versions of a signed side-loadable binary (mscorsvw.exe) to obfuscate backdoor deployment.
UNC5330 has employed Windows Management Instrumentation (WMI) to perform reconnaissance, move laterally, manipulate registry entries, and establish persistence.
PhantomNet implements a function to retrieve the username.
UNC5330 has employed Windows Management Instrumentation (WMI) to perform reconnaissance, move laterally, manipulate registry entries, and establish persistence.
Moreover, the adoption of SSL/TLS in malware is not restricted to the HTTPS protocol; other protocols, including SMTP and custom TCP protocols, were also found using SSL/TLS. | Over the last six years there has been an increased shift by malware authors to secure their C&C communications using the SSL/TLS protocol to stymie detection and blend in with normal traffic.
PhantomNet uses HTTPS.
PhantomNet can retrieve the proxy configuration of the default browser and use it to connect to the C&C server.
the actor created a SOCKS proxy to be used by the Microsoft Distributed Transaction Coordinator (MSDTC) service
UNC5330 also attempted to download Fast Reverse Proxy (FRP) from this server on Feb. 3, 2024, from a compromised Ivanti Connect Secure device.
PhantomNet can add a certificate to the Windows store and use it for certificate pinning for its HTTPS communications.
Throughout the intrusion, the actor in Cluster Alpha leveraged the PhantomNet implants ... to establish C2 communications and load additional payloads... PowHeartBeat ... now known to be an exfiltration domain.
17 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.