APT5 Smashes Citrix's Networks

CitrixManganeseAPT5

APT5 is a sophisticated cyber espionage group that is believed to be based in China and has been active since at least 2007. The group primarily targets high-tech and telecommunications firms across the US, Europe, and Asia, using advanced malware and zero-day exploits to gain unauthorized access to networks and steal sensitive information.

Indicators of Compromise

office-updates.infoSOCRadar2023-03-17

local0.infoSOCRadar2023-03-17

css-ethz.chSOCRadar2023-03-17

bnt2.liveSOCRadar2023-03-17

profilepic.siteSOCRadar2023-03-17

gettogether.questSOCRadar2023-03-17

nco2.liveSOCRadar2023-03-17

APT Groups1

Pitty PandaChina

Pitty PandaPittyTiger

Campaign Guidance

Remediation, mitigation, notes, history and related intelligence

Domain	ID	Name	Use
Enterprise	T1588	.002	Obtain Capabilities: Tool	PittyTiger has obtained and used tools such as Mimikatz and gsecdump.[1]
Enterprise	T1078		Valid Accounts	PittyTiger attempts to obtain legitimate credentials during operations.[1]

ID	Name	References	Techniques
S0032	gh0st RAT	[1][2]	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Command and Scripting Interpreter, Create or Modify System Process: Windows Service, Data Encoding: Standard Encoding, Deobfuscate/Decode Files or Information, Dynamic Resolution: Fast Flux DNS, Encrypted Channel, Encrypted Channel: Symmetric Cryptography, Hijack Execution Flow: DLL Side-Loading, Indicator Removal: File Deletion, Indicator Removal: Clear Windows Event Logs, Ingress Tool Transfer, Input Capture: Keylogging, Modify Registry, Native API, Non-Application Layer Protocol, Process Discovery, Process Injection, Query Registry, Screen Capture, Shared Modules, System Binary Proxy Execution: Rundll32, System Information Discovery, System Services: Service Execution
S0008	gsecdump	[1]	OS Credential Dumping: LSA Secrets, OS Credential Dumping: Security Account Manager
S0010	Lurid	[2]	Archive Collected Data, Encrypted Channel: Symmetric Cryptography
S0002	Mimikatz	[1]	Access Token Manipulation: SID-History Injection, Account Manipulation, Boot or Logon Autostart Execution: Security Support Provider, Credentials from Password Stores, Credentials from Password Stores: Windows Credential Manager, Credentials from Password Stores: Credentials from Web Browsers, OS Credential Dumping: Security Account Manager, OS Credential Dumping: LSASS Memory, OS Credential Dumping: LSA Secrets, OS Credential Dumping: DCSync, Rogue Domain Controller, Steal or Forge Authentication Certificates, Steal or Forge Kerberos Tickets: Silver Ticket, Steal or Forge Kerberos Tickets: Golden Ticket, Unsecured Credentials: Private Keys, Use Alternate Authentication Material: Pass the Ticket, Use Alternate Authentication Material: Pass the Hash
S0012	PoisonIvy	[2]	Application Window Discovery, Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, Boot or Logon Autostart Execution: Active Setup, Command and Scripting Interpreter: Windows Command Shell, Create or Modify System Process: Windows Service, Data from Local System, Data Staged: Local Data Staging, Encrypted Channel: Symmetric Cryptography, Ingress Tool Transfer, Input Capture: Keylogging, Modify Registry, Obfuscated Files or Information, Process Injection: Dynamic-link Library Injection, Rootkit

Observed Countries11

BN (760)

ID (506)

KH (326)

LA (453)

MM (784)

MY (450)

PH (355)

SG (632)

TH (655)

US (470)

VN (539)