MONSOON – ANALYSIS OF AN APT CAMPAIGN

Forcepoint Security Labs | Special Investigations
EXECUTIVE SUMMARY
MONSOON is the name given to the Forcepoint Security Labs
investigation into an ongoing espionage campaign that the Special
Investigations team have been tracking and analysing since May 2016.
The overarching campaign appears to target both Chinese nationals
within different industries and government agencies in Southern Asia. It
appears to have started in December 2015 and is still ongoing as of July
2016.
Amongst the evidence gathered during the MONSOON investigation were
a number of indicators which make it highly probable 1 that this adversary
and the OPERATION HANGOVER [1], [2] adversary are one and the
same. These indicator include the use of the same infrastructure for the
attacks, similar Tactics, Techniques and Procedures (TTPs), the targeting
of demographically similar victims and operating geographically within the
Indian Subcontinent.
The malware components used in MONSOON are typically distributed through weaponised documents
sent through e-mail to specifically chosen targets. Themes of these documents are usually political in
nature and taken from recent publications on topical current affairs. Several malware components have
been used in this operation including Unknown Logger Public, TINYTYPHON, BADNEWS, and an AutoIt
[3] backdoor.
BADNEWS is particularly interesting, containing resilient command-and-control (C&C) capability using RSS
feeds, Github, forums, blogs and Dynamic DNS hosts.
This whitepaper provides an in-depth understanding and insight into the actors and their campaign. It
includes detailed analysis and findings, previously undocumented malware components, victims, and
infrastructure involved.
ACKNOWLEDGEMENTS
“More information is always
better than less. When
people know the reason
things are happening, even if
it's bad news, they can
adjust their expectations and
react accordingly. Keeping
people in the dark only
serves to stir negative
emotions”.
Simon Sinek
We would like to acknowledge both Kaspersky and Cymmetria [4] who have published their own research
on the groups referred to as "PATCHWORK" and "DROPPER ELEPHANT". We also recognise the
analysis by Blue Coat in tracking OPERATION HANGOVER in the past [1].
We would like to thank the wider Forcepoint Security Labs team for their help with our investigation. We
would also like to give special thanks to Ran Mosessco for assisting with specific analysis.
1 SEE: “Uncertainty Yardstick”, Page 3-32
https://www.gov.uk/government/uploads/system/uploads/attachment_data/file/311572/20110830_jdp2_00_ed3_with_change1.pdf
MONSOON – ANALYSIS OF AN APT CAMPAIGN Revision: 1.07 | TLP-WHITE | 4/57