MalwareUsed by 1 actorExploits 2 CVEs

xPack

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

2 CVES

CVE-2017-0144EternalBlue SMBv1 Remote Code Execution

A state-backed Chinese APT actor tracked as 'Antlion' has been using a new custom backdoor called 'xPack' against financial organizations and manufacturing companies.

via bleeping computerbleepingcomputer.com

CVE-2019-1458Win32k Elevation of Privilege VulnerabilityExploited in the wild

Finally, the actors were also observed leveraging CVE-2019-1458 for privilege escalation and remote scheduling that helped execute the backdoor. This vulnerability was recently included on CISA's list of actively exploited flaws, so it's still an attractive avenue for multiple adversaries. | A state-backed Chinese APT actor tracked as 'Antlion' has been using a new custom backdoor called 'xPack' against financial organizations and manufacturing companies.

via bleeping computerbleepingcomputer.com

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Antlion

A state-backed Chinese APT actor tracked as 'Antlion' has been using a new custom backdoor called 'xPack' against financial organizations and manufacturing companies.

via bleeping computerbleepingcomputer.com

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1078Valid AccountsEvidence1

the particular campaign focused on dumping credentials from the compromised systems and then using them to move laterally

T1190Exploit Public-Facing ApplicationEvidence1

Although the initial access vector used to the breach the targets remains unclear, it's suspected that Antlion leveraged a web application flaw to gain a foothold and drop the xPack custom backdoor

Execution

3 techniques

T1047Windows Management InstrumentationEvidence1

xPack enabled attackers to run WMI commands remotely

T1053Scheduled Task/JobEvidence1

the actors were also observed leveraging CVE-2019-1458 for privilege escalation and remote scheduling that helped execute the backdoor

T1059Command and Scripting InterpreterEvidence1

xPack custom backdoor, which is employed to execute system commands

Persistence

2 techniques

T1053Scheduled Task/JobEvidence1

the actors were also observed leveraging CVE-2019-1458 for privilege escalation and remote scheduling that helped execute the backdoor

T1078Valid AccountsEvidence1

the particular campaign focused on dumping credentials from the compromised systems and then using them to move laterally

Privilege Escalation

3 techniques

T1053Scheduled Task/JobEvidence1

the actors were also observed leveraging CVE-2019-1458 for privilege escalation and remote scheduling that helped execute the backdoor

T1068Exploitation for Privilege EscalationEvidence1

the actors were also observed leveraging CVE-2019-1458 for privilege escalation

T1078Valid AccountsEvidence1

the particular campaign focused on dumping credentials from the compromised systems and then using them to move laterally

Stealth

1 technique

T1078Valid AccountsEvidence1

the particular campaign focused on dumping credentials from the compromised systems and then using them to move laterally

Credential Access

1 technique

T1003OS Credential DumpingEvidence1

xPack was initially used... then for dumping credentials

Discovery

2 techniques

T1057Process DiscoveryEvidence1

xPack was initially used to collect basic system information and running processes

T1082System Information DiscoveryEvidence1

xPack was initially used to collect basic system information and running processes

Lateral Movement

3 techniques

T1021.002SMB/Windows Admin SharesEvidence1

mounted shares over SMB to deliver data to the command and control (C2) server

T1210Exploitation of Remote ServicesEvidence1

xPack enabled attackers to... leverage EternalBlue exploits

T1570Lateral Tool TransferEvidence1

the particular campaign focused on dumping credentials from the compromised systems and then using them to move laterally

Collection

2 techniques

T1074Data StagedEvidence2

there is also evidence of instances where data was likely staged for further exfiltration

T1119Automated CollectionEvidence1

there is also evidence that the attackers likely automated the data collection process via batch scripts

Command and Control

1 technique

T1105Ingress Tool TransferEvidence2

xPack is a .NET loader that fetches and executes AES-encrypted payloads

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

the hacker newsNews

Feb 7, 2022

Chinese Hackers Target Taiwanese Financial Institutions with a new Stealthy Backdoor

A custom backdoor used in a long-running espionage campaign against Taiwanese organizations. It enables execution of system commands, deployment of additional malware and tools, and staging of data for exfiltration.

bleeping computerNews

Feb 3, 2022

State hackers' new malware helped them stay undetected for 250 days

A custom .NET loader/backdoor that fetches and executes AES-encrypted payloads, executes system commands, supports remote WMI command execution, stages data for exfiltration, collects system/process information, and is used for credential dumping and lateral movement support.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities2

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actorExploits 2 CVEs

xPack

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

2 CVES

CVE-2017-0144EternalBlue SMBv1 Remote Code Execution

A state-backed Chinese APT actor tracked as 'Antlion' has been using a new custom backdoor called 'xPack' against financial organizations and manufacturing companies.

via bleeping computerbleepingcomputer.com

CVE-2019-1458Win32k Elevation of Privilege VulnerabilityExploited in the wild

via bleeping computerbleepingcomputer.com

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Antlion

A state-backed Chinese APT actor tracked as 'Antlion' has been using a new custom backdoor called 'xPack' against financial organizations and manufacturing companies.

via bleeping computerbleepingcomputer.com

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1078Valid AccountsEvidence1

the particular campaign focused on dumping credentials from the compromised systems and then using them to move laterally

T1190Exploit Public-Facing ApplicationEvidence1

Although the initial access vector used to the breach the targets remains unclear, it's suspected that Antlion leveraged a web application flaw to gain a foothold and drop the xPack custom backdoor

Execution

3 techniques

T1047Windows Management InstrumentationEvidence1

xPack enabled attackers to run WMI commands remotely

T1053Scheduled Task/JobEvidence1

the actors were also observed leveraging CVE-2019-1458 for privilege escalation and remote scheduling that helped execute the backdoor

T1059Command and Scripting InterpreterEvidence1

xPack custom backdoor, which is employed to execute system commands

Persistence

2 techniques

T1053Scheduled Task/JobEvidence1

the actors were also observed leveraging CVE-2019-1458 for privilege escalation and remote scheduling that helped execute the backdoor

T1078Valid AccountsEvidence1

the particular campaign focused on dumping credentials from the compromised systems and then using them to move laterally

Privilege Escalation

3 techniques

T1053Scheduled Task/JobEvidence1

the actors were also observed leveraging CVE-2019-1458 for privilege escalation and remote scheduling that helped execute the backdoor

T1068Exploitation for Privilege EscalationEvidence1

the actors were also observed leveraging CVE-2019-1458 for privilege escalation

T1078Valid AccountsEvidence1

the particular campaign focused on dumping credentials from the compromised systems and then using them to move laterally

Stealth

1 technique

T1078Valid AccountsEvidence1

the particular campaign focused on dumping credentials from the compromised systems and then using them to move laterally

Credential Access

1 technique

T1003OS Credential DumpingEvidence1

xPack was initially used... then for dumping credentials

Discovery

2 techniques

T1057Process DiscoveryEvidence1

xPack was initially used to collect basic system information and running processes

T1082System Information DiscoveryEvidence1

xPack was initially used to collect basic system information and running processes

Lateral Movement

3 techniques

T1021.002SMB/Windows Admin SharesEvidence1

mounted shares over SMB to deliver data to the command and control (C2) server

T1210Exploitation of Remote ServicesEvidence1

xPack enabled attackers to... leverage EternalBlue exploits

T1570Lateral Tool TransferEvidence1

the particular campaign focused on dumping credentials from the compromised systems and then using them to move laterally

Collection

2 techniques

T1074Data StagedEvidence2

there is also evidence of instances where data was likely staged for further exfiltration

T1119Automated CollectionEvidence1

there is also evidence that the attackers likely automated the data collection process via batch scripts

Command and Control

1 technique

T1105Ingress Tool TransferEvidence2

xPack is a .NET loader that fetches and executes AES-encrypted payloads

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

the hacker newsNews

Feb 7, 2022

Chinese Hackers Target Taiwanese Financial Institutions with a new Stealthy Backdoor

bleeping computerNews

Feb 3, 2022

State hackers' new malware helped them stay undetected for 250 days

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities2

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.