Digital Quartermaster Scenario Demonstrated in Attacks Against the Mongolian Government
Summary: Unit 42 collected spear phishing emails, weaponized documents and payloads targeting multiple offices of the Mongolian government between August 2015 and February 2016, using lures tied to Beijing events, the Dalai Lama, North Korea relations and the Zika virus. The documents exploited CVE-2012-0158 and, in the three newest samples, CVE-2014-1761, dropping the Cmstar loader or BBSRAT directly, with tool overlaps pointing to a shared 'Digital Quartermaster' supplying the malware.
What's compelling: The same toolset appeared across campaigns previously attributed separately to NetTraveler, Lurid/Enfal and Roaming Tiger, with an 80% code similarity between the newer Cmstar variant and a NetTraveler sample - meaning defenders tracking these as distinct adversaries may be watching one supplier's product line. Unit 42 also notes the campaign likely began before August, with initial footholds possibly gained through compromised legitimate email accounts inside the Mongolian government.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Mentions
- CVE-2012-0158CVE-2014-1761
- Related
- CVE-2014-1761, Oh did you mean CVE-2012-2539? Cyber Risks ·CVE-2014-1761: Microsoft Word Memory Corruption Vulnerability Known Exploited Vulnerabilities · Feb 15, 2022