BitDefender Chafer May 2020

APT39 has used different versions of Mimikatz to obtain credentials.

APT39 has used NBTscan and custom tools to discover remote systems.

APT39 has been seen using RDP for lateral movement and persistence, in some cases employing the rdpwinst tool for mangement of multiple sessions.

APT39 has packed tools with UPX, and has repacked a modified version of Mimikatz to thwart anti-virus detection.

APT39 has used malware disguised as Mozilla Firefox and a tool named mfevtpse.exe to proxy C2 communications, closely mimicking a legitimate McAfee file mfevtps.exe.

APT39 has used CrackMapExec and a custom port scanner known as BLUETORCH for network scanning.

APT39 has created scheduled tasks for persistence.

APT39 has used PowerShell to execute malicious code.

APT39 has used a command line utility and a network scanner written in python.

APT39 has used HTTP in communications with C2.

APT39 has used remote access tools that leverage DNS in communications with C2.

APT39 used custom tools to create SOCK5 and custom protocol proxies between infected hosts.

APT39 has used various tools to proxy C2 communications.

APT39 has communicated with C2 through files uploaded to and downloaded from DropBox.

APT39 has used the post exploitation tool CrackMapExec to enumerate network shares.

APT39 has created accounts on multiple compromised hosts to perform actions within the network.

APT39 has sent spearphishing emails in an attempt to lure users to click on a malicious attachment.

APT39 has used the Smartftp Password Decryptor tool to decrypt FTP passwords.

APT39 has used post-exploitation tools including RemCom and the Non-sucking Service Manager (NSSM) to execute processes.

APT39 has modified and used customized versions of publicly-available tools like PLINK and Mimikatz.