Full Report
Trend Micro found that Chinese espionage group Mustang Panda is deploying malware via legitimate Microsoft tools, enabling it to bypass ESET antivirus applications
Analysis Summary
# Threat Actor: Mustang Panda (Earth Preta/CeranaKeeper)
## Attribution & Identity
Attribution points to a Chinese nation-state group.
Known Aliases: Earth Preta (from Trend Micro research). ESET suggests attribution to the China-aligned APT Group **CeranaKeeper** based on samples of the described technique.
## Activity Summary
The group is actively engaged in espionage, leveraging novel techniques to maintain persistence and exfiltrate sensitive data.
A recent campaign highlighted involves sophisticated evasion targeting ESET antivirus.
The attack chain begins with initial access, favored via phishing, dropping a mix of legitimate and malicious files. Victims are sometimes distracted by decoy documents (e.g., a PDF requesting participation in an anti-crime platform whitelist for Thailand-based users).
The group compromises large numbers of victims; Trend Micro reported compromising over 200 victims since 2022.
## Tactics, Techniques & Procedures
- **Initial Access:** Phishing is the favored entry vector.
- **Defense Evasion/Persistence:** Extensive use of legitimate, digitally signed Windows processes and utilities to hide malicious execution:
- Usage of **Setup Factory** (an installer builder) to drop and execute payloads.
- Use of **Microsoft Application Virtualization Injector (MAVInject.exe)** for proxy execution/code injection into running processes.
- Using **waitfor.exe** (a Windows utility) as the target process for injection, specifically to detect ESET tools running.
- Sideloading a modified **Toneshell** variant backdoor (`EACore.dll`) via a legitimate Electronic Arts (EA) application (`OriginLegacyCLI.exe`).
- **Process Tampering/Injection:** If ESET (ekrn.exe or egui.exe) is detected, the modified DLL registers itself using `regsvr32.exe` to execute code via MAVInject. If ESET is *not* found, the malware uses `WriteProcessMemory` and `CreateRemoteThreadEx` APIs to inject directly into `waitfor.exe`.
- Decoy tactics observed previously by the actor.
- **Command and Control:** The malware decrypts a shellcode stored in the `.data` section to manage C2 communication.
## Targeting
- **Sectors:** Governments.
- **Geography:** Primarily the Asia Pacific region, specifically mentioning Taiwan, Vietnam, and Malaysia. A decoy element specifically targeted Thailand-based users.
- **Victims:** Over 200 victims compromised since 2022 (per Trend Micro).
## Tools & Infrastructure
- **Malware Families/Components:**
- Modified variant of the **Toneshell** backdoor (`EACore.dll`).
- Shellcode for C2 communication.
- **Infrastructure:** The article only mentions communication to a Command and Control (C2) server, but specific URLs or IPs are not provided.
## Implications
Mustang Panda continues to evolve its evasion techniques, specifically demonstrating proficiency in living off the land (LotL) by abusing legitimate Microsoft binaries (`MAVInject.exe`, Windows utilities) to significantly complicate detection efforts against security solutions like ESET. Their ability to tailor execution based on the presence or absence of AV signals suggests sophisticated pre-operational testing.
## Mitigations
- Enhance monitoring capabilities to focus on identifying unusual activity within legitimate, signed processes and executables (e.g., monitoring execution of `waitfor.exe` by unexpected parent processes or unusual API calls like `WriteProcessMemory`).
- System administrators must maintain a deep understanding of how legitimate tools are used within their environments to recognize abuse patterns (e.g., unexpected use of MAVInject.exe).
- ESET claims existing detection prevents the bypass, but organizations utilizing similar security products should verify their current detection mechanisms against process injection techniques leveraging legitimate system utilities.