APT38

APT38 has executed persistence actions using sudo commands within zsh shells.^[6]

APT38 has used Finder, a macOS native app with FDA permissions, to rename the folder com.apple.TCC, then used another process to move the TCC.db file to a new location, where SQLite3 was used to edit TCC.db. The edited TCC.db file allowed code signing authorization, permission access, etc. without requiring a user prompt.^[7]

APT38 has used virtual private server (VPS) providers to host C2 infrastructure including Hostwinds.^[7]

APT38 has used OneDrive and GoogleDrive to host malicious files.^[5][7]

APT38 has sent Mac users.scpt files to trigger malicious downloads.^[13] APT38 has targeted macOS uses with native script stagers leading to malicious paylaods.^[5] APT38 has also used an AppleScript-based credential harvesting component.^[6]

APT38 has used a command-line tunneler, NACHOCHEESE, to give them shell access to a victim’s machine.^[2] Additionally, APT38 has used batch scripts.^[12][7] APT38 has also executed scripts to launch cmd.exe to POST stolen data to actor-controlled domains.^[5]

APT38 has run malicious payloads using Linux and Unix shells. APT38 has also executed Unix commands sequentially using && and in the background with &.^{[5] [6]}

APT38 has used VBScript to execute commands and other operational tasks.^[1][12] APT38 has sent Windows victims Visual Basic script stagers leading to malicious downloads.^[13][5] APT38 has also used VBScript to execute scripts for data exfiltration.^[5]

APT38 has used Python versions of its remote access tools on Linux targets.^[5]

APT38 has utilized malicious JavaScript payloads to compromise victims.^[5][7]

APT38 has installed a new Windows service to establish persistence.^[1] APT38 has gained persistence on compromised systems independent of user logon by creating a background service using `sc create scdev binPath= "c:\windows\system32\svchost.exe -k scdev".^[7]

APT38 has established persistence through storing the malicious plist files in /Library/LaunchDaemons.^[6]

APT38 has stolen data stored in macOS keychain.^[6]

APT38 has gathered Web browser data to include saved credentials, cookies, bookmarks, autofill data, and extension-specific storage. APT38 has also sought cryptocurrency wallet extensions.^[6][7]

APT38 has copied Apple Notes database from its application container and staged for upload.^[6]

APT38 has used DYEPACK to manipulate SWIFT messages en route to a printer.^[2]

APT38 has used DYEPACK.FOX to manipulate PDF data as it is accessed to remove traces of fraudulent SWIFT transactions from the data displayed to the end user.^[2]

APT38 have created firewall exemptions on specific ports, including ports 443, 6443, 8443, and 9443. ^[1]

APT38 has displayed a fake "system update complete" dialog to the user following successful deployment of malicious payloads.^[6]

APT38 clears Window Event logs and Sysmon logs from the system.^[2]

APT38 has set up anonymous emails to use in publishing poisoned software packages such as sergey2016@tutamail[.]com.^[7]

APT38 has created a mutex to avoid duplicate execution.^[12]

APT38 has created fictitious profiles on social media utilizing fake photos and personas to entice users to engage in the schemes.^[13]

APT38 has used remote access tools that run AppleScript using nohup osascript to ignore hangup signals.^[5]

APT38 has added Microsoft Defender exclusions to include C:\Windows\System32 to suppress detection of dropped tooling.^[7]

APT38 has used a utility called CLOSESHAVE that can securely delete a file from the system. APT38 has also removed malware, tools, scripts, or other non-native files used during the intrusion to reduce their footprint or as part of the post-intrusion cleanup process.^[2][1][6][5]

APT38 has modified data timestamps to mimic files that are in the same folder on a compromised host.^[1]

APT38 has leveraged a fictitious native macOS password dialog prompt to entice victims to enter credentials.^[7]

APT38 has named malicious payloads as benign-looking executables to blend in the environment including Run keys, npm packages, and JavaScript utilities often using names mirroring Apple, Windows, or other native system files.^[5][7][6]

APT38 has put several spaces before a file extension to avoid detection and suspicion.^[12]

APT38 has configured malware to rename malicious payloads with naming conventions that reduce a chance of detection to include renaming "package.md" to "package.json".^[5]

APT38 has utilized Base64 encoded PowerShell scripts.^[7]

APT38 has compressed its malicious payloads in ZIP files for delivery to victims.^[6]

APT38 has added thousands of blank lines to scripts to push malicious logic past the scrollable view of the script editor.^[6]

APT38 has sent phishing emails with invite links to fictitious meetings.^[6]

APT38 has used social media sites such as LinkedIn to send malicious links to potential vicitims.^[5][7]

APT38 has used Task Scheduler to run programs at system startup or on a scheduled basis for persistence.^[1] Additionally, APT38 has used living-off-the-land scripts to execute a malicious script via a scheduled task.^[12]

APT38 has used a multiplatform implant that can write to ~/.config/systemd/nvmconf/ to gain persistence on Linux hosts.^[7]

APT38 has identified security software, configurations, defensive tools, and sensors installed on a compromised system.^[1][12] APT38 has also executed malware implants to enumerate all installed applications on Windows hosts including installed security products.^[7]

APT38 has used a renamed version of mshta.exe to execute malicious HTML files.^[12]

APT38 has used msiexec.exe to execute malicious files.^[12]

APT38 has used rundll32.exe to execute binaries, scripts, and Control Panel Item files and to execute code via proxy to avoid triggering security tools.^[1][12]

APT38 has gathered cryptographic key data related to cryptocurrency wallets, SSH keys, and messaging applications to include Telegram.^[6]

APT38 has attempted to lure victims into enabling malicious macros within email attachments.^[1] Additionally, APT38 has used malicious Word documents and shortcut files.^[12] APT38 has lured victims into opening malicious .scpt or .vbs files to fix fake connection issues with online meetings.^[13][6] APT38 has used social media invites to lure victims into opening malicious files hosted on cloud infrastructure.^[5]

APT38 has used victim maintainer accounts for the npm Registry to publish malicious packages.^[7]