1. Home
  2. Groups
  3. Mofang

Mofang

Mofang is a likely China-based cyber espionage group, named for its frequent practice of imitating a victim's infrastructure. This adversary has been observed since at least May 2012 conducting focused attacks against government and critical infrastructure in Myanmar, as well as several other countries and sectors including military, automobile, and weapons industries.[1]

ID: G0103
Version: 1.0
Created: 12 May 2020
Last Modified: 29 May 2020
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1027 Obfuscated Files or Information

Mofang has compressed the ShimRat executable within malicious email attachments. Mofang has also encrypted payloads before they are downloaded to victims.[1]
Enterprise T1566 .001 Phishing: Spearphishing Attachment

Mofang delivered spearphishing emails with malicious documents, PDFs, or Excel files attached.[1]
.002 Phishing: Spearphishing Link

Mofang delivered spearphishing emails with malicious links included.[1]
Enterprise T1204 .001 User Execution: Malicious Link

Mofang's spearphishing emails required a user to click the link to connect to a compromised website.[1]
.002 User Execution: Malicious File

Mofang's malicious spearphishing attachments required a user to open the file after receiving.[1]

Software

ID Name Techniques
S0444 ShimRat Abuse Elevation Control Mechanism: Bypass User Account Control, Application Layer Protocol: Web Protocols, Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Command and Scripting Interpreter: Windows Command Shell, Create or Modify System Process: Windows Service, Data from Local System, Deobfuscate/Decode Files or Information, Event Triggered Execution: Application Shimming, Fallback Channels, File and Directory Discovery, Hijack Execution Flow, Indicator Removal on Host: File Deletion, Ingress Tool Transfer, Masquerading: Masquerade Task or Service, Modify Registry, Native API, Network Share Discovery, Obfuscated Files or Information: Software Packing, Obfuscated Files or Information, Proxy: External Proxy, Scheduled Transfer
S0445 ShimRatReporter Account Discovery, Application Layer Protocol: Web Protocols, Archive Collected Data, Automated Collection, Automated Exfiltration, Exfiltration Over C2 Channel, Ingress Tool Transfer, Masquerading: Match Legitimate Name or Location, Native API, Obfuscated Files or Information, Permission Groups Discovery, Process Discovery, Software Discovery, System Information Discovery, System Network Configuration Discovery, System Network Connections Discovery

References

  1. Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.