OceanLotus (APT32) 解説: 戦術、マルウェア、および TTPs

SOC Prime Team

フォローする

OceanLotus (APT32) 解説: 戦術、マルウェア、および TTPs

Detection stack

AIDR
Alert
ETL
Query

脅威レポート
攻撃フロー
検出
シミュレーション

概要

OceanLotus、APT32とも呼ばれるこのグループは、少なくとも2014年から活動している、ベトナム政府の利益に沿った高度なサイバー諜報グループです。このグループは、東南アジア全域の政府、メディア、民間部門の組織を標的として、カスタムマルウェアツールと高度な作戦手法を使用しています。その侵入方法には、スピアフィッシング、サプライチェーンの妥協、DLLサイドローディングなどがあり、被害者の環境に長期的にアクセスすることを可能にしています。

調査

このレポートは、自動車企業に対する産業スパイから、FireAnt MetaKitプラットフォームを利用した最近のサプライチェーン活動までを網羅しています。また、SPECTRALVIPERやZiChatBotといったマルウェアファミリーについても、これらがどのように配信され、WindowsやmacOSシステムで使用されているかを検討しています。

軽減策

組織は、サプライチェーン攻撃の露出を減らすためにソフトウェア更新の整合性チェックを強制し、DLLサイドローディング活動を検出するために強力なエンドポイント検出を展開すべきです。不正なスケジュールされたタスク、cronジョブ、疑わしいレジストリの変更を監視することも重要です。厳格なメールフィルタリングとユーザー意識向上の訓練が、スピアフィッシングによる初期妥協のリスクをさらに減らすことができます。

対応策

OceanLotusの活動が検出された場合、横移動とデータ盗難を制限するために、影響を受けたシステムを直ちに隔離してください。不審なプロセス、たとえば OneDrive.Sync.Service.exe や意外なmacOSの起動エージェントに対して、深いフォレンジック分析を実施します。コンプロマイズされた資格情報は無効化し、DropboxやGoogle Driveといったクラウドストレージプラットフォームが許可されていないステージングやデータ流出の兆候がないか確認してください。

"graph TB %% Class Definitions Section classDef recon fill:#e1f5fe %% Light Blue classDef resource fill:#fff9c4 %% Light Yellow classDef access fill:#ffccbc %% Light Orange classDef execution fill:#d1c4e9 %% Light Purple classDef persistence fill:#c8e6c9 %% Light Green classDef escalation fill:#f8bbd0 %% Light Pink classDef stealth fill:#cfd8dc %% Light Grey classDef discovery fill:#b2dfdb %% Teal classDef command_control fill:#ffecb3 %% Amber classDef exfiltration fill:#d7ccc8 %% Brown %% Reconnaissance Section recon_track["Action – T1598: Phishing for Information Gathering victim identity and email addresses via tracking links."] class recon_track recon recon_profile["Action – T1592: Gather Victim Host Information Browser and OS profiling using web-profiling frameworks on fake news sites."] class recon_profile recon %% Resource Development Section res_dev_infra["Action – T1583: Acquire Infrastructure Registering look-alike domains and abusing web services like Dropbox, Amazon S3, and Google Drive."] class res_dev_infra resource res_dev_malware["Malware Suite Custom malware suite including WINDSHIELD, KOMPROGO, SOUNDBITE, PHOREAL, and SPECTRALVIPER."] class res_dev_malware resource %% Initial Access Section acc_supply["Action – T1195: Supply Chain Compromise Malicious PyPI wheel packages and compromising FireAnt MetaKit update servers."] class acc_supply access acc_spear["Action – T1566.001: Spearphishing Attachment Weaponized Office documents sent via email."] class acc_spear access acc_driveby["Action – T1189: Drive-by Compromise Use of fake news sites to deliver payloads."] class acc_driveby access %% Execution Section exec_macro["Action – T1059.005: Command and Scripting Interpreter: Visual Basic VBA macros in Office documents."] class exec_macro execution exec_python["Action – T1059.006: Command and Scripting Interpreter: Python Execution via malicious PyPI wheel packages."] class exec_python execution exec_perl["Action – T1059: Command and Scripting Interpreter Perl scripts utilized on macOS."] class exec_perl execution %% Persistence Section pers_task["Action – T1053: Scheduled Task/Job Cron jobs on Linux and Windows Scheduled Tasks."] class pers_task persistence pers_macos["Action – T1543: Create or Modify System Process Modifying macOS LaunchAgents and LaunchDaemons."] class pers_macos persistence pers_registry["Action – T1547.001: Registry Run Keys / Startup Folder Utilizing registry run keys for persistence."] class pers_registry persistence pers_sideloader["Action – T1574.002: Hijack Execution Flow: DLL Side-Loading Hijacking execution flow to maintain presence."] class pers_sideloader persistence %% Privilege Escalation Section esc_token["Action – T1134: Access Token Manipulation Token impersonation and theft to elevate privileges."] class esc_token escalation %% Stealth Section stealth_obf["Action – T1027: Obfuscated Files or Information Heavy obfuscation of files and information."] class stealth_obf stealth stealth_masq["Action – T1036: Masquerading Matching filenames and locations to appear as legitimate resources."] class stealth_masq stealth stealth_inject["Action – T1055: Process Injection Hiding within trusted processes like OneDrive."] class stealth_inject stealth stealth_remov["Action – T1070: Indicator Removal On Host File deletion and timestomping."] class stealth_remov stealth %% Discovery Section disc_sysinfo["Action – T1082: System Information Discovery Collecting hardware details including serial numbers and UUIDs and OS versions."] class disc_sysinfo discovery %% Command and Control Section c2_web["Action – T1071.001: Application Layer Protocol: Web Protocols Resilient C2 channels using HTTPS."] class c2_web command_control c2_nonapp["Action – T1095: Non-Application Layer Protocol Communication via TCP and ICMP."] class c2_nonapp command_control c2_web_svc["Action – T1102: Web Service Bidirectional communication via Zulip and other web services."] class c2_web_svc command_control %% Exfiltration Section exfil_data["Action – T1041: Exfiltration Over C2 Channel Collected data is exfiltrated over established C2 channels."] class exfil_data exfiltration %% Connections Section %% Recon leads to Resource Development recon_track –>|leads_to| res_dev_infra recon_profile –>|leads_to| res_dev_infra %% Resource Development leads to Initial Access res_dev_infra –>|supports| acc_supply res_dev_infra –>|supports| acc_spear res_dev_infra –>|supports| acc_driveby res_dev_malware –>|used_in| acc_supply res_dev_malware –>|used_in| acc_spear %% Initial Access leads to Execution acc_supply –>|triggers| exec_python acc_spear –>|triggers| exec_macro acc_driveby –>|triggers| exec_perl %% Execution leads to Persistence exec_macro –>|enables| pers_task exec_python –>|enables| pers_registry exec_perl –>|enables| pers_macos exec_macro –>|enables| pers_sideloader %% Persistence leads to Privilege Escalation pers_task –>|allows| esc_token pers_registry –>|allows| esc_token %% Privilege Escalation leads to Stealth and Discovery esc_token –>|facilitates| stealth_inject esc_token –>|facilitates| stealth_obf %% Stealth and Discovery lead to C2 stealth_inject –>|hides| c2_web stealth_obf –>|hides| c2_nonapp disc_sysinfo –>|identifies_targets_for| c2_web_svc %% C2 leads to Exfiltration c2_web –>|transports| exfil_data c2_nonapp –>|transports| exfil_data c2_web_svc –>|transports| exfil_data "

攻撃フロー

表示

## Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

Attack Narrative & Commands: The adversary has gained initial access to the workstation. To avoid detection by the existing EDR, they attempt to use the Invoke-Obfuscation framework to mask their subsequent discovery commands. They download the framework (simulated here by direct command invocation) and attempt to run a command that triggers the specific detection rule by including the string Invoke-Obfuscation in the process command line.

Regression Test Script:

# This script simulates the invocation of the Invoke-Obfuscation tool 
# to trigger the 'CommandLine|contains: Invoke-Obfuscation' detection rule.

Write-Host "[+] Starting Simulation: Triggering OceanLotus Detection Rule"

# Simulating the execution of a command that contains the target string
# In a real scenario, this would be the actual module being called.
Start-Process powershell.exe -ArgumentList "-Command `"Invoke-Obfuscation -Command {Get-Process}`""

Write-Host "[+] Simulation command sent. Check SIEM for 'Detection of OceanLotus PowerShell Script Obfuscation'."

Cleanup Commands:

# No persistent changes were made by the simulation script.
# To clean up any temporary files if they were created:
Remove-Item -Path "$env:TEMP*" -ErrorAction SilentlyContinue
Write-Host "[+] Cleanup complete."

SOC PrimeのDetection as Codeプラットフォームに参加し ビジネスに最も関連性のある脅威に対する可視性を向上させましょう。開始して即座に価値をもたらすためには、今すぐSOC Primeの専門家とのミーティングを予約してください。

無料で参加