Heyoka

The content repeatedly states that threat actors 'obtained,' 'acquired,' or 'used' publicly available, open-source, legitimate, or modified tools such as Mimikatz, Cobalt Strike, PsExec, Empire, Impacket, and many others.

From 2018 to present, this actor has also been observed using a fake removable device as an initial infection vector... The spreader component will try to find the removable device in the victim’s environment. This malware component will copy all the malicious modules to any removable device to spread the malware in the target’s network environment

MITRE ATT&CK TTPs ... Initial Access T1566 – Phishing Threat actor use fake icon executable and document exploit as a decoy

Using a document exploit and tricking the user into opening a weaponized Word document to install a backdoor. Luring users into double-clicking a fake Anti-Virus to execute malware in the victim’s host.

MITRE ATT&CK TTPs ... Execution T1569 – System Service Modified Heyoka will set itself as a service permission

The malware sets the auto start function with the value “EverNoteTrayUService”. When the user restarts the computer, it will execute the “Evernote Tray Application” and use DLL hijacking to load the malicious loader.

After decrypting the encrypted payload, DLL-test.dll will execute rundll32.exe and run specific export functions. The loader injects the decrypted payload into memory and runs it persistently.

There are two payloads in this attack chain... the second one is an encrypted backdoor which injects itself into rundll32’s memory.

The malware sets the auto start function with the value “EverNoteTrayUService”. When the user restarts the computer, it will execute the “Evernote Tray Application” and use DLL hijacking to load the malicious loader.

After decrypting the encrypted payload, DLL-test.dll will execute rundll32.exe and run specific export functions. The loader injects the decrypted payload into memory and runs it persistently.

There are two payloads in this attack chain... the second one is an encrypted backdoor which injects itself into rundll32’s memory.

From 2018 to present, this actor has also been observed using a fake removable device as an initial infection vector... The spreader component will try to find the removable device in the victim’s environment. This malware component will copy all the malicious modules to any removable device to spread the malware in the target’s network environment

Heyoka is a proof-of-concept of an exfiltration tool which uses spoofed DNS requests to create a bidirectional tunnel... Modified Heyoka has used DNS tunneling for C2 communications.

Aoqin Dragon “obtained the Heyoka open source exfiltration tool and subsequently modified it for their operations.”

Heyoka is an open source exfiltration tool that uses spoofed DNS requests to create a two-way communication tunnel. Hackers employ Heyoka by copying files from compromised devices

Aoqin Dragon modified the Heyoka open source exfiltration tool; Cinnamon Tempest used a keylogger that uploads data to Alibaba cloud storage; Salesforce Data Exfiltration relied on the legitimate Salesforce Data Loader app for data exfiltration.