BRONZE PRESIDENT Targets Government Officials

In June and July 2022, Secureworks® Counter Threat Unit™ (CTU) researchers identified a PlugX malware campaign targeting computers belonging to government officials of several countries in Europe, the Middle East, and South America. PlugX is modular malware that contacts a command and control (C2) server for tasking and can download additional plugins to enhance its capability beyond basic information gathering. Several characteristics of this campaign indicate that it was conducted by the likely Chinese government-sponsored BRONZE PRESIDENT threat group, including the use of PlugX, file paths and naming schemes previously used by the threat group, the presence of shellcode in executable file headers, and politically-themed decoy documents that align with regions where China has interests.

The malware is embedded within RAR archive files. Opening the archive on a Windows computer with default settings displays a Windows shortcut (LNK) file (see Figure 1) that masquerades as a document.

Figure 1. Content of RAR archive file. (Source: Secureworks)

Alongside the shortcut is a hidden folder that contains the malware, embedded eight levels deep in a sequence of hidden folders named with special characters (see Figure 2). This tiering is likely to bypass mail-scanning products that may not traverse the entire path when scanning content, suggesting that the delivery mechanism was phishing emails, as there is no other benefit to creating such a folder structure.

Figure 2. Malicious files contained within hidden folder. (Source: Secureworks)

To execute the malware, the recipient must click the Windows shortcut file. The shortcut executes a renamed legitimate file contained in the eighth hidden folder. Alongside the legitimate file is a malicious DLL and an encrypted payload file. CTU™ researchers observed the malicious payload using the folder names and filenames in Table 1.

Table 1. Filenames used in PlugX campaign.

The legitimate binary files are vulnerable to DLL search order hijacking. When executed, they import the malicious DLL that loads, decrypts, and executes the payload file. In each sample analyzed by CTU researchers, the shortcut file metadata indicates the file was created on a Windows system either with hostname "desktop-n2v1smh" or "desktop-cb248vr".

Once running, the payload drops a decoy document to the logged-on user's %Temp% directory and copies the three files to a ProgramData subdirectory using the pattern "<Application><3 characters>" (e.g., Operavng) (see Figure 3). This naming scheme has been used in previous BRONZE PRESIDENT PlugX campaigns. CTU researchers observed that when the payload performs the copy operation, it names the legitimate executable with its usual name (e.g., Opera.exe, AdobePlugin.exe, AvastBrowser.exe).

Figure 3. PlugX files copied to ProgramData subdirectory. (Source: Secureworks)

The political nature of the decoy documents suggests that the government officials of various countries are targets for BRONZE PRESIDENT's intelligence collection efforts (see Figures 4, 5, and 6). The threat group consistently targets China's neighbors such as Myanmar and Vietnam. However, its collection requirements can change quickly and are often driven by geopolitical events such as the war in Ukraine.

Figure 4. Decoy document used by BRONZE PRESIDENT. (Source: Secureworks)

Figure 5. Decoy document used by BRONZE PRESIDENT. (Source: Secureworks)

Figure 6. Decoy document used by BRONZE PRESIDENT. (Source: Secureworks)

PlugX sets up persistence on the host by setting a registry Run key (see Figure 7).

Figure 7. PlugX registry configuration. (Source: Secureworks)

The running instance of the PlugX payload executes the copy of the legitimate file under ProgramData, passing it a command-line argument before exiting (see Figure 8). Passing command-line arguments lets the malware adapt its execution based on its execution location. CTU researchers observed this tactic in previous BRONZE PRESIDENT PlugX campaigns. Once running, the legitimate file again imports the malicious DLL in the same folder, loading, decoding, and passing execution to the malicious payload file.

Figure 8. PlugX process execution with command-line argument. (Source: Secureworks)

The payload file calls GetCommandLineW to check the number of arguments. If an additional argument follows the file path, the malware opens the decoy document previously dropped to the user's %Temp% folder and continues execution with its C2 routine.

The malicious DLLs and payloads are heavily obfuscated to hinder analysis and to reduce the likelihood of detection by host-based security software. The malicious DLL executes its payload using an unusual technique. Instead of using a call or jmp instruction, it first decodes and copies the payload to a new allocation of memory and then makes a call to EnumThreadWindows to pass execution to the start of the malicious payload file (see Figure 9).

Figure 9. Malicious DLL calling EnumThreadWindows. (Source: Secureworks)

The start of the payload file is treated as executable code in the same way as a Cobalt Strike stageless payload artifact. This could be a tactic developed by BRONZE PRESIDENT to increase the likelihood of its malware being misidentified as the popular Cobalt Strike tool.

The payload resolves various required Windows functions. It then starts a new thread that makes repeated calls to CheckRemoteDebuggerPresent, exiting if it detects a debugger.

Figure 10 shows the payload preparing to decode its configuration. The values pushed to the stack are key length, key, data length, and data address. The key is used as a multibyte XOR value. All observed key value lengths are nine bytes, and their values vary across samples.

Figure 10. PlugX calling its configuration decode function. (Source: Secureworks)

Figure 11 shows the beginning of the decoded configuration, including the installation directory, mutex name, and the name of the decoy document associated with the sample.

Figure 11. PlugX configuration data. (Source: Secureworks)

BRONZE PRESIDENT has demonstrated an ability to pivot quickly for new intelligence collection opportunities. Organizations in geographic regions of interest to China should closely monitor this group's activities, especially organizations associated with or operating as government agencies.

To mitigate exposure to this malware, CTU researchers recommend that organizations use available controls to review and restrict access using the indicators listed in Table 2. Note that IP addresses can be reallocated. The IP addresses may contain malicious content, so consider the risks before opening them in a browser.

Table 2. Indicators for this threat.

If you need urgent assistance with an incident, contact the Secureworks Incident Response team.