MONSOON – ANALYSIS OF AN APT CAMPAIGN
2aWUb2X
2aWUb2X
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
Forcepoint Security Labs | Special Investigations<br />
Using YMLP, the threat actor is faking the sender using this service and embedding a link to a weaponised<br />
document in the e-mail body.<br />
Examples of a number of email details and embedded URLs can be seen in the table below.<br />
UTC Time Subject Sender Embedded URL to Malicious Document<br />
6/29/2016<br />
7:12<br />
The Chinese Statecraft, The China<br />
Syndrome and it's new legalism<br />
mailreturn@smtp5.ymlpsrvr.net<br />
hxxp://www.newsnstat[.com]/index.php?f=Report_Asia_Program<br />
_New_Geopolitics.pps<br />
6/28/2016<br />
4:13<br />
China Plans a Breakaway Faction of<br />
the NSG<br />
mailreturn@smtp6.ymlpsrvr.net<br />
hxxp://www.newsnstat[.com]/index.php?f=Report_Asia_Program<br />
_New_Geopolitics.pps<br />
6/27/2016<br />
5:08<br />
Stretching and Exploiting Thresholds<br />
for High Order War<br />
mailreturn@smtp1.ymlpsrvr.net<br />
hxxp://www.newsnstat[.com]/index.php?f=China_plan_to_domin<br />
ate_South_China_Sea_and_beyond.doc<br />
6/24/2016<br />
4:52<br />
5/20/2016<br />
8:56<br />
2016 年 成 都 中 国 电 子 展 。 mailreturn@smtp3.ymlpsrvr.net hxxp://www.newsnstat[.com]/index.php?f=CEF_Chengdu_July_2<br />
016.pps<br />
Limits of Law in the South China Sea mailreturn@smtp6.ymlpsrvr.net hxxp://www.newsnstat[.com]/index.php?f=Limits_of_Law_in_the_<br />
South_China_Sea.pps<br />
5/9/2016<br />
5:16<br />
China International Defence<br />
Electronics Exhibition (CIDEX) 2016<br />
mailreturn@smtp5.ymlpsrvr.net<br />
hxxp://www.newsnstat[.com]/index.php?f=CIDEX2016.pps<br />
4/12/2016<br />
4:56<br />
中 国 安 全 战 略 报 告 2016 mailreturn@smtp2.ymlpsrvr.net hxxp://www.cnmilit[.com]/index.php?f=China_Security_Report_C<br />
N2016.pps<br />
Figure 9 <strong>–</strong> YMLP Lures<br />
<strong>MONSOON</strong> <strong>–</strong> <strong><strong>AN</strong>ALYSIS</strong> <strong>OF</strong> <strong>AN</strong> <strong>APT</strong> <strong>CAMPAIGN</strong> Revision: 1.07 | TLP-WHITE | 11/57
Change language