Cluster Bravo, despite its brief initial activity, subsequently targeted 11 organizations in the same region, as researchers found that these attackers used compromised environments within the same vertical for malware staging.
Cluster Charlie, after being disrupted, returned with new techniques, including using the HUI loader to inject Cobalt Strike beacons into mstsc.exe.
They employed open-source tools and leveraged techniques from other threat clusters to re-establish their presence and bypass EDR software by shifting their primary focus to re-establishing and extending their foothold on the target network.
Threat actors switched tactics after Sophos blocked their C2 tools by leveraging stolen credentials to deploy web shells for reconnaissance and DLL sideloading.
Open-source tools like Havoc and SharpHound were used for further intel gathering on Active Directory and network layout.
Attackers also adopted tactics from other threat clusters, like using Impacket atexec on unmanaged devices for remote execution and lateral movement, highlighting a potential overarching organization behind these activities.
The APT actor leveraged stolen credentials and a web shell to inject a malicious DLL into a legitimate Windows process and then performed reconnaissance tasks by querying Windows Defender exclusion paths, Sophos security policies, and Active Directory infrastructure using SharpHound.
The actor also used the compromised credentials to move laterally and establish persistence on a hypervisor by creating a scheduled task to execute another malicious DLL.
In December 2023, Cluster Charlie attackers compromised administrator credentials and user data and conducted reconnaissance. In 2024, they rapidly cycled through C2 channels and deployment methods likely to evade detection.
Their tactics included deploying modified versions of legitimate tools like RealBlindingEDR (asoc.exe, ssoc.exe) to disable endpoint protection via a vulnerability (CVE-2023-38817) in an anti-cheat tool (Echo.ac) and tamper with kernel routines.
In February and March 2024, a threat actor was observed rapidly changing tactics and tools to evade detection by switching C2 implants (Havoc, Cobalt Strike) and frameworks (Havoc, XieBroC2) while using Donut shellcode loaders to inject malicious payloads.
They also abused legitimate executables (jcef_helper.exe, jconsole.exe) to sideload malicious DLLs (libcef.dll, jli.dll) for further obfuscation and persistence.
The DLLs sometimes checked for debuggers and security tools before injecting payloads and connecting to C2 servers in Cyprus, the United States, Japan, and Singapore.
In April, attackers abused legitimate apps (identity_helper.exe) to sideload malicious DLLs (Havoc implants) and a custom keylogger (TattleTale, steals LSA info, browser data) and also deployed another keylogger (r1.exe) to disable EDR and access Chrome data, while in June, they used Impacket to install a Cloudflared tunnel after disabling endpoint protection.
The threat actors behind this ongoing cyberespionage campaign continue to target Sophos customers in the same region by constantly evolving their tactics and tools, using a mix of custom and open-source tools to bypass security measures.