Full Report
Operation Hanoi Thief: Threat Actor targets Vietnamese IT professionals and recruitment teams. Introduction Key Targets. Industries Affected. Geographical Focus. Infection Chain. Initial Findings Looking into the decoy-document Technical Analysis Stage 1 – Malicious LNK Script Stage 2 – Pseudo-Polyglot Trick: All in One. Stage 3 – Final Payload: LOTUSHARVEST Infrastructure & Attribution. Conclusion Seqrite Protection. […] The post Operation Hanoi Thief: Threat Actor targets Vietnamese IT professionals and recruitment teams. appeared first on Blogs on Information Technology, Network & Cybersecurity | Seqrite.
Analysis Summary
# Threat Actor: Unnamed Actor associated with Operation Hanoi Thief
## Attribution & Identity
* **Identification:** Threat entity tracked through "Operation Hanoi Thief."
* **Known Aliases/Associations:** Confirmed overlaps with previously witnessed threat campaigns suggest a **Chinese-origin** threat actor. State sponsorship is currently unconfirmed (medium confidence based on TTP comparison).
## Activity Summary
The threat actor is actively running a spear-phishing campaign named **Operation Hanoi Thief**. This operation targets IT departments and HR recruiters in Vietnam using fake resume documents designed for social engineering. The campaign involves a multi-stage approach culminating in the deployment of the LOTUSHARVEST malware.
## Tactics, Techniques & Procedures
* **Initial Access:** Spearphishing via ZIP attachments containing decoy documents and malicious LNK files (T1566.001).
* **Execution:**
* Execution initiated via a malicious shortcut (.LNK) file (T1204.002).
* Use of a "pseudo-polyglot payload" (`offsec-certified-professional.png`) which contains a concealed batch script for staging.
* Execution via DLL sideloading using a C++ implant (T1574.002).
* Abuse of trusted Windows tools for hidden script execution.
* **Defense Evasion:** Masquerading using misleading file extensions (e.g., `.pdf.lnk`) (T1036.007).
* **Discovery:** System information discovery (T1082) and file system discovery for browser data (T1012).
* **Credential Access:** Targeting credentials from password stores (T1555.003) and general data collection (T1005).
* **Exfiltration & C2:** Exfiltration over C2 channel (T1041) using Web Protocols like HTTPS (T1071.001).
## Targeting
* **Sectors:** Information Technology, Recruitment & HR Firms.
* **Geography:** Vietnam (Specific mention of resumes localized to Hanoi).
* **Victims:** Vietnamese IT professionals and HR recruiters.
## Tools & Infrastructure
* **Malware Families Used:**
* **LOTUSHARVEST:** The final-stage C++ DLL implant, specialized in stealing browser credentials and history.
* **Infrastructure (Specific IOCs provided in the source, listed here defensively):**
* Initial Sample Hash (ZIP): `1beb8fb1b6283dc7fffedcc2f058836d895d92b2fb2c37d982714af648994fed`
* Final Payload Hash (DLL): `48e18db10bf9fa0033affaed849f053bd20c59b32b71855d1cc72f613d0cac4b`
* *Note: Specific C2 domains/IPs were not extracted/listed in the provided snippet but the threat uses HTTPS C2.*
## Implications
Operation Hanoi Thief represents a focused, multi-stage espionage effort likely aimed at intellectual property theft or targeted compromise within the Vietnamese technology sector. The use of multi-layered social engineering (fake resumes/CVs) combined with advanced techniques like pseudo-polyglots and DLL sideloading indicates a sophisticated, persistent actor. The final payload's specific focus on browser credentials suggests data exfiltration is a primary objective.
## Mitigations
* Strong detection and blocking policies for LNK files delivered via email attachments.
* Employ security solutions capable of detecting and blocking multi-stage execution chains stemming from archive files.
* User awareness training emphasizing the dangers of opening attachments, especially when the file type appears deceptive (e.g., `.pdf.lnk`).
* Implement controls to monitor and prevent the execution of signed binaries used in proxy execution techniques (like abuse of trusted Windows tools).
* Specific Seqrite protections identified: `Trojan.50086.SL`, `Trojan.A18678918`.