Full Report
Operation Hanoi Thief: Threat Actor targets Vietnamese IT professionals and recruitment teams. Introduction Key Targets. Industries Affected. Geographical Focus. Infection Chain. Initial Findings Looking into the decoy-document Technical Analysis Stage 1 – Malicious LNK Script Stage 2 – Pseudo-Polyglot Trick: All in One. Stage 3 – Final Payload: LOTUSHARVEST Infrastructure & Attribution. Conclusion Seqrite Protection. […] The post Operation Hanoi Thief: Threat Actor targets Vietnamese IT professionals and recruitment teams. appeared first on Blogs on Information Technology, Network & Cybersecurity | Seqrite.
Analysis Summary
# Threat Actor: Unnamed Actor behind Operation Hanoi Thief
## Attribution & Identity
* **Identification:** Threat entity operation dubbed "Operation Hanoi Thief" by SEQRITE Labs APT-Team.
* **Attribution Confidence:** Medium confidence attribution to a **Chinese-origin** threat actor based on TTP overlaps and differences with previously witnessed campaigns. State sponsorship remains unconfirmed due to a lack of required metrics.
* **Known Aliases/Groups:** Not explicitly named or associated with a known APT moniker in the summary, though overlap analysis was performed.
## Activity Summary
* **Campaign Name:** Operation Hanoi Thief.
* **Operation Focus:** A spear-phishing campaign targeting IT departments and HR recruiters in Vietnam using fake resume documents.
* **Objective:** Deployment of the **LOTUSHARVEST** stealer payload to compromise sensitive information, specifically browser credentials and history.
* **Timeline:** Initial discovery recorded on November 3rd, 2025.
## Tactics, Techniques & Procedures
The campaign utilized a multi-stage infection chain:
* **Initial Access:** Spear-phishing attachment (ZIP file containing malicious LNK and lure document). (T1566.001)
* **Lure/Staging:** Used a decoy resume document ("Le-Xuan-Son\_CV") with forged details (Hanoi location, linked GitHub profile) to enhance social engineering.
* **Second Stage Delivery:** Leveraged a pseudo-polyglot payload file (`offsec-certified-professional.png`) which contained a hidden batch script payload. (T1036.007 - Masquerading via misleading file extension, T1140 - Deobfuscate File)
* **Execution:** Initial execution triggered by a malicious shortcut file (`CV.pdf.lnk`). (T1204.002 - User Execution: Malicious File)
* **Defense Evasion/Execution:** The method abuses trusted Windows tools and file structures, involving proxy execution. (T1218 - Signed Binary Proxy Execution)
* **Final Payload Execution:** Utilizes **DLL Sideloading** to execute the final implant. (T1574.002)
* **Discovery/Reconnaissance:** System Information Discovery (T1082) and File system discovery for browser data (T1012).
* **Credential Access:** Stealing credentials from password stores (T1555.003) and general data from the local system (T1005).
* **Exfiltration:** Data collection and exfiltration over a C2 channel utilizing HTTPS web protocols (T1041, T1071.001).
## Targeting
* **Sectors:** Information Technology, Recruitment & HR Firms.
* **Geography:** Vietnam (with social engineering lures referencing Hanoi).
* **Victims:** Vietnamese IT professionals and HR recruiters.
## Tools & Infrastructure
* **Malware Families Used:**
* **LOTUSHARVEST:** Final-stage C++ DLL implant used for credential and history stealing.
* **LNK Scripts:** Used for initial execution.
* **Batch Script:** Embedded within the pseudo-polyglot.
* **Infrastructure:** Attacker servers used to receive exfiltrated data (C2 Channel details not provided in the summary beyond the protocol used).
* **IOCs (Hashes - SHA-256):**
* ZIP File: `1beb8fb1b6283dc7fffedcc2f058836d895d92b2fb2c37d982714af648994fed`
* LNK File: `77373ee9869b492de0db2462efd5d3eff910b227e53d238fae16ad011826388a`
* Pseudo-polyglot payload: `693ea9f0837c9e0c0413da6198b6316a6ca6dfd9f4d3db71664d2270a65bcf38`
* DLL File: `48e18db10bf9fa0033affaed849f053bd20c59b32b71855d1cc72f613d0cac4b`
## Implications
Operation Hanoi Thief demonstrates a focused, technologically sophisticated phishing campaign targeting specific high-value roles (IT/HR) within a defined geographic area (Vietnam). The use of multi-stage delivery systems incorporating LNK files, pseudo-polyglots, and DLL sideloading signifies a prepared adversary aiming to deploy powerful credential-stealing malware (LOTUSHARVEST).
## Mitigations
* Seqrite Protection identified two specific malware detections: `Trojan.50086.SL` and `Trojan.A18678918`.
* Implement robust email filtering to block spear-phishing ZIP attachments.
* Educate users, particularly IT and HR personnel, on the risks associated with shortcut files (.LNK) delivered via email, even when disguised as documents.
* Monitor for and prevent execution techniques associated with DLL Sideloading (T1574.002).
* Restrict the execution of batch scripts delivered through unusual file formats.