The “You Dun” hacking group exploited vulnerable Zhiyuan OA software using SQL injection, leveraging tools like WebLogicScan, Vulmap, and Xray for reconnaissance.
They further escalated privileges on compromised hosts with tools like traitor and CDK.
Active Cobalt Strike server leaked, revealing its use in various cyberattacks, including ransomware deployment (LockBit 3) and data theft.
The threat actor, associated with “Dark Cloud Shield Technical Team” and “EVA,” leveraged the leaked tools to conduct malicious activities.
The attacker used WebLogicScan and vulmap.py scripts to identify WebLogic vulnerabilities on various targets, and an Xray scanner was employed for broader vulnerability detection on two Chinese websites.
The threat actor utilized research to identify vulnerable web paths, then exploited a Zhiyuan OA vulnerability with seeyon_exp to deploy JSPX web shells, which were used to launch SQLmap attacks against multiple targets, including a South Korean pharmaceutical organization to extract sensitive data.
Protecting Your Networks & Endpoints With UnderDefense MDR – Request Free Demo
The threat actor compromised a Zhiyuan OA instance by utilizing the Weaver tool for vulnerability scanning and exploitation and the Cobalt Strike platform.
They deployed a sophisticated toolkit, including TaoWu and Landon, to enhance Cobalt Strike’s capabilities. This enabled them to execute various malicious activities, such as credential theft, lateral movement, and persistence, on the compromised system.
They also used Cobalt Strike’s Ladon plugin to automate intrusion on a Bitnami WordPress server. Initial access likely exploited a WordPress plugin WPCargo vulnerability (CVE-2021-25003) and Viper C2 with the Metasploit backend delivered the final payload.
The attacker exploited a Docker container vulnerability using CDK, then escalated privileges further using the mount-cgroup module and the Traitor tool to gain unauthorized access to the system.
The adversary possessed LockBit ransomware (.local/LB3.exe) and deleted RAR archives containing the LockBit Black builder, which was likely used to build custom ransomware variants.
The threat actor targeted multiple countries, primarily China, South Korea, and Iran. Their reconnaissance activities involved scanning various industries, including government, education, health, and logistics, for vulnerabilities using tools like Vulmap and WebLogicScan.
Analysis of an open directory revealed infrastructure used by a threat actor, including SSH servers with a matching fingerprint proxied through multiple IPs likely added via VIM.
Malicious actors use the f8x script downloaded from f8x.io to automate security tooling installation on compromised systems. Options like “-all” and “-viper” likely control the specific tools installed.
According to the DFIR Report, evidence suggests a Chinese-speaking threat actor using Telegram channels (You_Dun, You_Dun888) for communication and boasting about defacements, data leaks, and offering illegal services like penetration testing and DDoS attacks.
Run private, Real-time Malware Analysis in both Windows & Linux VMs. Get a 14-day free trial with ANY.RUN!