Loading malware…
SecBox is a customized Go-based remote-access and network-pivot implant associated with an intrusion campaign tracked as Nie, a Chinese-speaking operator. It was deployed in compromises of internet-facing enterprise applications, including a Fengtai District government Office Automation environment, where ASPX webshells and downloaders installed the implant for additional endpoint control. SecBox supports remote command execution, file transfer, host discovery, port scanning, SOCKS5 proxying, port forwarding, and alternate command-and-control routing. Its communications support multiple transports, including TCP, TLS, WebSocket, KCP, and QUIC, with multiplexing for concurrent channels. SecBox can retrieve replacement command-and-control routes through an encrypted dead-drop resolution mechanism and includes self-removal functionality. Windows builds were observed in the government intrusion, and Linux-compatible second-stage implants were staged through a malicious MySQL-compatible service targeting unsafe Java deserialization.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Implant déployé : SecBox (Go), masqué en syscfg.exe (System Configuration Utility).
18 distinct techniques documented for this family, organized by ATT&CK tactic.
The Fengtai intrusion began through an Office Automation application that accepted uploaded ASPX files. The group also tested Shellshock, Spring4Shell, Ghostcat, Log4Shell, Grafana, Nexus, Nacos, and Shiro paths.
ASPX pages invoked Win32_Process.Create through WMI; launchfw.aspx executed the downloaded implant with WMI Win32_Process.Create.
Attackers used server-side command pages to run Windows commands ... cmd.aspx ... executes commands through cmd.exe /c.
The fake MySQL workflow selected serialized Java objects and included CommonsBeanutils1, CommonsCollections6, and Spring gadget-chain payloads to download a second stage. | The malicious MySQL-compatible service returned crafted data designed to trigger unsafe object processing in a vulnerable Java client, launching a platform-aware downloader on the affected host.
They also inserted a privileged application account and staged SecBox.
Attackers used server-side command pages to run Windows commands ... Workers used ... webshells ... PHP webshells masquerading as WordPress files.
PHP webshells masquerading as WordPress files ... av2_chk_cn-44.exe [had] deceptive syscfg.exe internal-name metadata.
Webshell-launched scripts scanned the internal environment for SMB, WinRM, web, and database services, connecting the public OA system to internal servers and infrastructure.
The implant could execute commands, transfer files, scan ports, proxy traffic ...
The discovery sequence included ver, hostname, whoami, whoami /all, tasklist, net use, and sc query.
The implant could ... use replacement command-and-control routes. IoCs include dead-drop-resolver TCP and WebSocket redirectors.
Attackers ... move[d] data through ordinary HTTP requests... SecBox [used] replacement command-and-control routes [including] TCP and WebSocket redirector[s].
The implant could ... proxy traffic, and use replacement command-and-control routes. Hunt.io traced a shared SOCKS proxy across five connected workspaces.
SecBox established long-lived C2 connections using TCP, TLS, WebSocket, KCP, or QUIC, with Yamux multiplexing tasking, file transfer, and pivot traffic.
SecBox : implant Go multiprotocole ... Dead Drop Resolver (Pastebin/GitHub Gist, AES-256-GCM).
dl_e6.aspx [is a] loader that copies e6475722.exe to C:WindowsTempv11.exe... launchfw.aspx [downloads] c22.exe as fw.exe and executes it.
SecBox supported SOCKS5 proxying, port forwarding, and bind pivots; Yamux multiplexed tasking, file transfer, and pivot traffic over a single connection.
SecBox : implant Go multiprotocole (TCP, TLS, WebSocket, KCP, QUIC) ... Dead Drop Resolver (Pastebin/GitHub Gist, AES-256-GCM).
19 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.