{
  "name": "Threat Bulletin: Weaponized Software Targets Chinese-Speaking Organizations",
  "slug": "threat-bulletin-weaponized-software-targets-chinese-speaking-organizations",
  "description": "A series of attacks targeting Chinese-speaking regions has been identified, utilizing a multi-stage loader named PNGPlug to deliver ValleyRAT payload. The attack begins with a phishing webpage encouraging victims to download a malicious MSI package disguised as legitimate software. The installer deploys a benign application and extracts an encrypted archive containing malware components. The PNGPlug loader sets up the environment for malware execution, including patching ntdll.dll and injecting payloads from PNG files. ValleyRAT, attributed to the Silver Fox APT, employs advanced techniques like shellcode execution, obfuscation, and persistence mechanisms. The campaign stands out due to its focus on Chinese-speaking victims across China, Hong Kong, and Taiwan, treating these regions as a unified target despite their political differences.",
  "published": "2025-01-20T10:09:40+00:00",
  "created_at": "2025-01-20T10:09:40+00:00",
  "modified_at": "2025-01-20T10:49:29+00:00",
  "created_at_opencti": "2025-01-20T10:09:40+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-01-20",
    "espionage",
    "gh0st rat",
    "pngplug",
    "valleyrat"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "156.247.33.53"
      },
      {
        "id": "",
        "name": "45.195.148.107"
      },
      {
        "id": "",
        "name": "fa26722e99763a29af160fae64183a47a57362b666753624b78e954c8cde0525"
      },
      {
        "id": "",
        "name": "e9e4751c88d3a1a4bfdd5d07bb35636787b0d6fbf68b17642d3fe03cbe5ebf70"
      },
      {
        "id": "",
        "name": "f2f96e5ac1b4bd6cac49c71ca2010dcbe5751757483520cfc7dddf4fb7186044"
      },
      {
        "id": "",
        "name": "e54ce9939679c691dc5719e309a8d541183b6672269fd61013109ef0d8509b1e"
      },
      {
        "id": "",
        "name": "e49b085f5484531395b5a7903f004b2a02a2b4ebfa46116d1a665ba881b1f528"
      },
      {
        "id": "",
        "name": "d9e939f904a1cddf5fb8ffba14acbfe227ed5dfc4990b52a44d4dfd0baa6de4e"
      },
      {
        "id": "",
        "name": "de8a0da702a491f610b9e85050d8641cadf4ed84edf4d151f94335b0d78d6636"
      },
      {
        "id": "",
        "name": "cd347b9f558cf024df1dbb62ed7a0d72a2edc04b1330058cfa1baf4fc3894e03"
      },
      {
        "id": "",
        "name": "d51db234d0236cd0dbfcf13adc33387f10920011537815d188eff012872e30be"
      },
      {
        "id": "",
        "name": "d0ce85ec31053478c67e4f53ca2ef9b7b1f0fda74621c9c7c8c1612772ca778c"
      },
      {
        "id": "",
        "name": "c636120749b49f47fc8d42409ead6c51ea44bc40c815370997ca63f48acdf002"
      },
      {
        "id": "",
        "name": "c5d5054047a12efc68a67abd8f15069a853dd09800cd39d68df5a27702b45334"
      },
      {
        "id": "",
        "name": "c497506fe2df57c39fcf92398f4864ca4bfcb1a6f2f80c3c520166bc61882855"
      },
      {
        "id": "",
        "name": "c070749f95aeeefcd1c3a875c1b8e77b57cad0c8338436af9a3c9e1323fd4e11"
      },
      {
        "id": "",
        "name": "ad23f5c9bab137dc24343fc410f7587885aab6772dee5e75a216ed579c6ee420"
      },
      {
        "id": "",
        "name": "ae6d88ea99e530f778ee6088862b50dfb6e8bb45857211e9105428c57c2a7b4a"
      },
      {
        "id": "",
        "name": "a97371df7d51fe0aee1d54b5b233a1713f69224802b1da35337a3041788990e6"
      },
      {
        "id": "",
        "name": "9d97f3f55bc647911e14a36c83f263e91662cf9d13a2fc3ec7c92dedb8977d37"
      },
      {
        "id": "",
        "name": "9bd53057c8905d508374698e2595301f0be1529ec4ebfa71c09ad0c01a562982"
      },
      {
        "id": "",
        "name": "9aea0fdfead2e956bc0b4574c2b4cb2855dd9df6a5fd61d350f3285d249adfca"
      },
      {
        "id": "",
        "name": "9aa51d1c82fdbc8f0f27340180bd40faa7e76b8ac6d204b2d3548cfd0897d805"
      },
      {
        "id": "",
        "name": "99fb7a40dbf6a042bcb77f67a5a76fe03ec3c6820ac5e15cb009795d545152ea"
      },
      {
        "id": "",
        "name": "94ff4679dd5aec7874354c14132701ecdfbbb558c6011e4952d13bf843255529"
      },
      {
        "id": "",
        "name": "7eaed6fa867875119c3ebb40aa24716d91fdbccb2106fa4708ff0637920a920c"
      },
      {
        "id": "",
        "name": "8aa28f35dbafc18a37b07fd15bb599e3c8de5b692117f1c6fd491bd03028a423"
      },
      {
        "id": "",
        "name": "7c31c4d0308fb1d67f6af48a76138a9db19f494c1e9a12debdcca7382ad5418c"
      },
      {
        "id": "",
        "name": "7bff2404c2816c4e1576d449820f01e3f46e7c972beb1843e3b8da2e065f8dc3"
      },
      {
        "id": "",
        "name": "79acdca5247ca9719f2f3a34c7942cd60b209f7b616efa5dd81e6656a8baf9a5"
      },
      {
        "id": "",
        "name": "76fc76dc651c3cc9d766a6ad8a90f605326463bc4cb2f8f053d44dfbc913beee"
      },
      {
        "id": "",
        "name": "6d4dd4334791c91bb09e7a91dd5c450b2c6e3348a5586de011c54ce3f473f619"
      },
      {
        "id": "",
        "name": "70facc8ad5db172e235b4cc720a0edaedd4470b8a6ec5da8dee2758f4a1aafef"
      },
      {
        "id": "",
        "name": "6d2a4d9e2fc6e4dac2c426851b4bdf86dd63a5515d8d853e622a0bc01d250ce9"
      },
      {
        "id": "",
        "name": "659ede632d3bfc28d143c144fdba34d08b21c4f97ce6c9dc1fcd4d2bf5cc25e3"
      },
      {
        "id": "",
        "name": "5f9a5ad43a9f79976cd7014ce072429ef2edbae872b4226372cfb07d8a86b8a5"
      },
      {
        "id": "",
        "name": "58416315c61ed5cb2c754244ed5c081963dabf3e698b04226a00f978cd913e84"
      },
      {
        "id": "",
        "name": "517b43bf057877727387316d8538dc07599856eb428d43f512e89964a5dfb331"
      },
      {
        "id": "",
        "name": "50a64e97c6a5417023f3561f33291b448ce830a4d99c40356af67301c8fa7523"
      },
      {
        "id": "",
        "name": "504d7714419931f80b734e212a9431ec98887c56ade8966c4d7cae58b28d49ca"
      },
      {
        "id": "",
        "name": "4b6bf40dc331c89e416ef012a6dc4f55c83136197be7115246b42e4f7a828baa"
      },
      {
        "id": "",
        "name": "4d64c2d1ae0de0f3066a6c020ab7aa5a9dd487c0cf1ff1ca2e93d98ff30e039f"
      },
      {
        "id": "",
        "name": "4a68bdfa3e31a8c063bbf94469160eb7998a556027d5ad33f37c347a71c2d3a4"
      },
      {
        "id": "",
        "name": "46af73560cafff5c8bbc16980d01641af0de3b689bc248dfb52afcf3a8a76a55"
      },
      {
        "id": "",
        "name": "463c9704fb009cd13e0ef50fa7d5035aa5f35b4841fe75ecab5c4a276601f837"
      },
      {
        "id": "",
        "name": "3fc35cab1272f769af309cb46375e21680f13d629181c7646cb0cf2c9b2e72e7"
      },
      {
        "id": "",
        "name": "3ac3ca18142a935608cb0d2c8d6421ebb9abc30bce93f094447b9c3f63fe791b"
      },
      {
        "id": "",
        "name": "33bc111238a0c6f10f6fe3288b5d4efe246c20efd8d85b4fe88f7d602d70738e"
      },
      {
        "id": "",
        "name": "30147b6691e5bc1a15c76cebf81b2de77d9099e8200b6ed9742c6e3b36505f34"
      },
      {
        "id": "",
        "name": "16bb3968e1112b63fef8a4e7bda9d021dfef6fd1955fdfa677545535a14a65b4"
      },
      {
        "id": "",
        "name": "0b33f08bc2917c4825c053754fc88e16b35d1a8fff4135595b265a4c6f850250"
      },
      {
        "id": "",
        "name": "08dad42da5aba6ef48fca27c783f78f06ab9ea7a933420e4b6b21e12e550dd7d"
      }
    ],
    "malware": [
      {
        "id": "735f0102-19b5-4ddd-83ec-e995d6d5daa6",
        "name": "PNGPlug",
        "slug": "pngplug"
      },
      {
        "id": "db7f167e-24b0-49d3-b8e0-ef250e0c5046",
        "name": "gh0st RAT - S0032",
        "slug": "gh0st-rat-s0032"
      },
      {
        "id": "f8879be0-dea7-4e8d-9aba-78c8ac8c6207",
        "name": "ValleyRAT",
        "slug": "valleyrat"
      }
    ],
    "intrusion_sets": [
      {
        "id": "9737bc5a-30ea-42a9-8733-7a4540a14ef2",
        "name": "Silver Fox",
        "slug": "silver-fox"
      }
    ],
    "attack_patterns": [
      {
        "id": "a72ebeae-8e62-4039-8135-e9c611011fdc",
        "name": "T1573"
      },
      {
        "id": "6e4e21cc-92cf-4564-920e-d509bd22fd40",
        "name": "T1574"
      },
      {
        "id": "926a888c-190c-4efb-ab6b-f9d7e6a0fc54",
        "name": "T1547"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "7d7ac733-6442-416f-8669-c302dd0843b9",
        "name": "T1036"
      },
      {
        "id": "50514c04-b3a2-4abf-a855-e3a434200c87",
        "name": "T1204"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "bb20a9e1-f4f6-459d-94f4-470c6867dc2d",
        "name": "T1053"
      },
      {
        "id": "09124a92-c11f-4571-b35b-ab0bce6dd081",
        "name": "T1112"
      },
      {
        "id": "9b6064e6-a05b-4e95-baf5-34d180bc9221",
        "name": "T1059"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Hong Kong"
      },
      {
        "id": "",
        "name": "Taiwan"
      },
      {
        "id": "",
        "name": "China"
      }
    ]
  },
  "external_refs": [
    "https://intezer.com/blog/malware-analysis/weaponized-software-targets-chinese",
    "https://otx.alienvault.com/pulse/678e2ef4f93f85cffbe82ebc"
  ]
}