Exploit / PoCmedium
Digital Quartermaster Scenario Demonstrated in Attacks Against the Mongolian Government
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2012-0158 | Remote Code Execution in Microsoft MSCOMCTL.OCX (Windows Common Controls) | — | 100% | KEVRansomware | — KEV |
| CVE-2014-1761 | Memory Corruption RCE in Microsoft Word | — | 78% | KEV | — KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | celeinkec.com | http://thbaw.ofhloe[.]com/cgl-bin/conime.cgi http://dolimy.celeinkec[.]com/cgl-bin/upl.cgi http://question.eboregi[.]com http://ppli |
| domain | cocolco.com | dentified the following BBSRAT command and control servers: cocolco[.]com ofhloe[.]com housejjk[.]com Infrastructure Analysis Mappi |
| domain | eboregi.com | tp://dolimy.celeinkec[.]com/cgl-bin/upl.cgi http://question.eboregi[.]com http://pplime.savecarrots[.]com/cgl-bin/upsd.cgi http://d |
| domain | erobegi.com | ommand and Control Infrastructure A single domain, question.erobegi[.]com, was found to be reused. This domain had previous been id |
| domain | housejjk.com | RAT command and control servers: cocolco[.]com ofhloe[.]com housejjk[.]com Infrastructure Analysis Mapping out the first stage comma |
| domain | ofhloe.com | identified to be used by these Cmstar samples: http://thbaw.ofhloe[.]com/cgl-bin/conime.cgi http://dolimy.celeinkec[.]com/cgl-bin/ |
| domain | savecarrots.com | cgl-bin/upl.cgi http://question.eboregi[.]com http://pplime.savecarrots[.]com/cgl-bin/upsd.cgi http://dolimy.celeinkec[.]com/bin/r0206/ |
| bilguun@masm.gov.mn | d Cmstar Description Spear-phishing email originating from 'bilguun@masm.gov.mn'. Nearly two thousand recipients found to be targeted, all | |
| davaa_ayush@mod.gov.mn | r-phishing email originating from 'davaa_ayush@yahoo.com'. 'davaa_ayush@mod.gov.mn' was a target in the August 12, 2015 attack, indicating the | |
| ganbat_g@bpo.gov.mn | d Cmstar Description Spear-phishing email originating from 'ganbat_g@bpo.gov.mn'. A single target is discovered in the collected sample. Su | |
| sha256 | 00ddae5bbc2ddf29954749519ecfb3978a68db6237ebea8e646a898c353053ce | government officials within the Mongolian government SHA256 00ddae5bbc2ddf29954749519ecfb3978a68db6237ebea8e646a898c353053ce Date 10/22/2015 Filename Улс төрийн www.politik.mn сайт нээ |
| sha256 | 0b0e6b40a63710b4f7e6d00d7a4a86e6db2df720fef48640ab6d9d88352a4890 | Russia, as well as other countries across the globe. SHA256 0b0e6b40a63710b4f7e6d00d7a4a86e6db2df720fef48640ab6d9d88352a4890 Date 2/19/2016 Filename Хятадад “Зика” вирусын хоёр дахь то |
| sha256 | 10090692ff40758a08bd66f806e0f2c831b4b9742bbf3d19c250e778de638f57 | ry Day' and Mongolian's participation in this event. SHA256 10090692ff40758a08bd66f806e0f2c831b4b9742bbf3d19c250e778de638f57 Date 8/28/2015 Filename Бээжин хотод цэргийн ёслолын жагсаа |
| sha256 | 44dbf05bc81d17542a656525772e0f0973b603704f213278036d8ffc999bb79a | nerary from Ulaanbaatar, Mongolia to Beijing, China. SHA256 44dbf05bc81d17542a656525772e0f0973b603704f213278036d8ffc999bb79a Date 9/15/2015 Filename Путины урилга.doc (Putin's Invitati |
| sha256 | 5beb50d95c1e720143ca0004f5172cb8881d75f6c9f434ceaff59f34fa1fe378 | Mongolian government. Attack Timeline Attack Details SHA256 5beb50d95c1e720143ca0004f5172cb8881d75f6c9f434ceaff59f34fa1fe378 Date 8/12/2015 Filename Ялалтын баярын ар дахь улс төр.doc |
| sha256 | 5c7e3cde4d286909154e9a5ee5a5d061a1f0efaa9875fb50c9073e1e8b6cfaef | sident regarding sanctions made against North Korea. SHA256 5c7e3cde4d286909154e9a5ee5a5d061a1f0efaa9875fb50c9073e1e8b6cfaef Date 2/19/2016 Filename Зика Монголд ойртсоор.doc Vulnerabi |
| sha256 | 68f97bf3d03b1733944c25ff4933e4e03d973ccdd73d9528f4d68806b826735e | rience of individuals in the Mongolian armed forces. SHA256 68f97bf3d03b1733944c25ff4933e4e03d973ccdd73d9528f4d68806b826735e Date 10/22/2015 Filename албанушаалтнуудын сарын цалингийнх |
| sha256 | 6f3d4fb64de9ae61776fd19a8eba3d1d828e7e26bb89ace00c7843a57c5f6e8a | e United States in other countries across the globe. SHA256 6f3d4fb64de9ae61776fd19a8eba3d1d828e7e26bb89ace00c7843a57c5f6e8a Date 9/29/2015 Filename Далай ламыг эмч нар амрахыг зөвлөжэ |
| sha256 | 7e031a04e570cddda907d0b4b7af19ce60dc481394dfb3813796ce0e6d079305 | a series of children holiday season songs and poems. SHA256 7e031a04e570cddda907d0b4b7af19ce60dc481394dfb3813796ce0e6d079305 Date 2/17/2016 Filename Хойд Солонгост хориг арга хэмжээ ав |
| sha256 | 91ffe6fab7b33ff47b184b59356408951176c670cad3afcde79aa8464374acd3 | layed to the victim upon opening the malicious file. SHA256 91ffe6fab7b33ff47b184b59356408951176c670cad3afcde79aa8464374acd3 Date 9/16/2015 Filename 1.doc Vulnerability Targeted CVE-20 |
| sha256 | aa86f4587423c2ff677aebae604614030f9f4d38280409501662ab4e4fe20c2a | 2016 budget discussion in the Mongolian Parliament. SHA256 aa86f4587423c2ff677aebae604614030f9f4d38280409501662ab4e4fe20c2a Date 12/23/2015 Filename СОНОРДУУЛГА.doc Vulnerability Targ |
| sha256 | c2ebaf4366835e16f34cc7f0b56f8eaf80a9818375c98672bc678bb4107b4d8c | website being launched by the Mongolian government. SHA256 c2ebaf4366835e16f34cc7f0b56f8eaf80a9818375c98672bc678bb4107b4d8c Date 10/28/2015 Filename Unknown Vulnerability Targeted CVE |
| sha256 | e88ea5eb642eaf832f8399d0337ba9eb1563862ddee68c26a74409a7384b9bb9 | as a number of US-based trips he made in late 2015. SHA256 e88ea5eb642eaf832f8399d0337ba9eb1563862ddee68c26a74409a7384b9bb9 Date 10/2/2015 Filename Sudalgaa avah zagvar.doc Vulnerabil |
| sha256 | fc21814a5f9ed2f6bef9e15b113d00f9291a6553c1e02cc0b4c185c6030eca45 | ks and financial institutions on October 16th, 2015. SHA256 fc21814a5f9ed2f6bef9e15b113d00f9291a6553c1e02cc0b4c185c6030eca45 Date 1/4/2016 Filename Өвлийн өвгөнийн үг.doc Vulnerability |
From the original article
12 min read at unit42.paloaltonetworks.comUnit 42 has collected multiple spear phishing emails, weaponized document files, and payloads that targeted various offices of the Mongolian government during the time period of August 2015 and February 2016 .
By Bryan Lee · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.