Tracking a DoNot (APT-C-35) Intrusion Against Bangladesh Military Personnel

Summary

A targeted cyber-espionage operation attributed to the DoNot group, also known as APT-C-35, is aimed at military and defense personnel in Bangladesh. The campaign uses weaponized RTF documents with remote template injection to trigger a multi-stage infection chain that delivers shellcode and a DLL implant. The malware relies on AES-128-CBC encryption and disguises its command-and-control activity and persistence as legitimate OneDrive telemetry.

Investigation

The Howler Cell team uncovered the campaign while analyzing a spear-phishing RTF lure presented as a military biography. During the investigation, researchers successfully retrieved a live second-stage DLL, ejtest.dll, from active command-and-control infrastructure, confirming that the operation remained active. Cryptographic analysis of hardcoded AES keys provided strong evidence linking the activity to previously documented DoNot operations.

Mitigation

Defenders should monitor Microsoft Office applications for remote template retrieval and unexpected outbound network communication. Enforcing strict controls around macro execution and watching for suspicious child processes launched by Office applications is also essential. In addition, organizations should alert on scheduled tasks that imitate legitimate system telemetry, including OneDrive-related activity.

Response

If this activity is detected, affected hosts should be isolated immediately to stop further multi-stage payload delivery. Investigators should examine files stored in %TEMP% directories and review scheduled tasks that mimic OneDrive behavior. A broader hunt should also be conducted for HTTPS POST traffic containing known command-and-control parameters such as mopd= and malp=.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: An attacker sends a spear-phishing email containing a .docx file. The document contains a malicious relationship pointing to a remote template hosted on an attacker-controlled SMB share (e.g., \attacker-ipsharemalicious.dotm). When the user opens the file, Word attempts to fetch the template, creating a UNC path command line. To gain execution, the template contains a macro that triggers cmd.exe as a child process of WINWORD.EXE, attempting to download further payloads.

• Regression Test Script:

  # Simulation Script for Office Remote Template Injection & Child Process Spawning
  
  # 1. Simulate the UNC path detection (Selection 1/2)
  # Note: We simulate the command line that would be seen if Word processed the remote template.
  Write-Host "[*] Simulating Word accessing a remote template via UNC path..."
  Start-Process "winword.exe" -ArgumentList "\192.168.1.100publictemplate.dotm"
  
  Start-Sleep -Seconds 2
  
  # 2. Simulate the Malicious Child Process (Selection 3/4)
  # This mimics a macro executing cmd.exe from within Word.
  Write-Host "[*] Simulating malicious child process (cmd.exe) spawned by WINWORD.EXE..."
  $wordProcess = Start-Process "winword.exe" -PassThru
  Start-Sleep -Seconds 2
  
  # Using Start-Process to ensure the parent-child relationship is captured by Sysmon
  Start-Process "cmd.exe" -ArgumentList "/c echo 'Exploit Success'" -WorkingDirectory $wordProcess.Path
  
  Write-Host "[+] Simulation complete. Check Sysmon logs for Event ID 1."

• Cleanup Commands:

  # Terminate any lingering Office processes
  Stop-Process -Name "winword" -ErrorAction SilentlyContinue
  Stop-Process -Name "excel" -ErrorAction SilentlyContinue
  Write-Host "[+] Cleanup complete."