We were also able to classify the victims based on the targeted industries. As Figure 2 shows, most of the targeted individuals were working in or involved in some capacity with government-related entities. A significant number of targets also came from the telecommunications industry.

2023 arrival vectors

In 2023, we observed Earth Preta using several new arrival vectors, including MIROGO, QMAGENT, and the new TONESHELL dropper called TONEDROP. Likewise, the infection chains of these arrival vectors have also changed. For example, in addition to deploying legitimate Google Drive download links, the actors also used other download sites that resembled but were not actually Google Drive pages. In the following sections, we will introduce these new malware families and TTPs.

Backdoor.Win32.QMAGENT

Around January 2023, we found the QMAGENT malware being delivered via spear-phishing emails to target individuals involved with government organizations and entities. Initially disclosed in a report from ESET, QMAGENT — also known as MQsTTang —is noteworthy because it leverages the MQTT protocol, which is commonly used in internet-of-things (IoT) devices to tunnel data and commands. Since the said report thoroughly describes the technical details of the malware, we will not expand on them here. However, we think that the protocol used deserves further investigation, and we will tackle it in the following sections.

Backdoor.Win32.MIROGO

In February 2023, we discovered another backdoor written in Golang named MIROGO, first reported as the TinyNote malware by Check Point Research. We noted that it was delivered through a phishing email embedded with a Google Drive link, which then downloaded an archive named Note-2.7z. The archive is password-protected, with the password provided in the email’s body. After extraction, we found a single executable disguised as being addressed to an East Asian government.

Trojan.Win32.TONEDROP

In March 2023, we discovered a new dropper named TONEDROP that drops the TONEINS and TONESHELL pieces of malware. Its infection chain is similar to the one we introduced in our previous report and involves fake document files hiding XOR-ed malicious binaries.

In the following months, we found the group still using this dropper. During our investigation, we uncovered a new variant of the TONESHELL backdoor, the technical details of which we will share in the following sections.

Table 1. Files in TONEDROP

Before dropping and installing the files, TONEDROP will check the existence of the folder C:ProgramDataLuaJIT to determine if the environment has already been compromised. It will also check the running processes and windows if they are related to malware analysis tools. If so, it will not proceed with its routine.

The C&C communication protocol works as follows:

1. The handshake containing the xor_key and victim_id is sent to the C&C server.
2.  A 5-byte-sized data packet that is composed of magic and has a size of 0x02 is received.
3. A 2-byte-sized data packet decrypted with the xor_key and that must have a first byte of 0x08 is received.
4. Data that is composed of magic and the next payload size is received.
5. Data is received and decrypted using xor_key. The first byte is the command code, and the following data is the extra information.

Although the page looks like a Google Drive download page, it is actually a picture file (gdrive.jpg) trying to masquerade itself as a normal website. In the source code, it runs the script file https://myanmarfreedomwork[.]org/Js/jQuery.min.js, which will download the file Document.rar.

In May 2023, Earth Preta continuously distributed the same download site with different paths to deploy TONESHELL, such as https://rewards[.]roshan[.]af/aspnet_client/acv[.]htm. In this version, the threat actor obfuscated the malicious URL script with another piece of JavaScript, as shown in Figure 11.

Finally, the script jQuery.min.js will download the archive file from https://rewards.roshan[.]af/aspnet_client/Note-1[.]rar.

The topic name iot/server0 is used to detect the analysis or debugging environments, so it has the lowest victim count. March had the highest spike because the ESET report was published on March 2, and this spike involved the activation of automation systems (sandboxes and other analysis systems). As a result, we decided to break the spike down into smaller ranges.

Meanwhile, the webchat function /webchat allows two users to communicate with each other on the same page. The login usernames and passwords are hard-coded in the source codes, which are john:john and tom:tom.

Once logged in, users can submit their text messages via WebSocket, with all the messages they receive being displayed here. Based on the hard-coded usernames, we suppose that “tom” and “john”  are accomplices cooperating with one another. After checking the webchat template file, we found some simplified Chinese characters written inside, so it’s possible that the threat actors might be Chinese-speaking.

As mentioned in the previous section, most of the malicious download URLs we collected follow specific patterns like /fav/xxxx or /file/xxxx. Based on the source codes, the path /fav/<name> (and so on) will download the payload Documents.rar if the request’s User-Agent header contains any of the following strings:

• Windows NT 10
• Windows NT 6

This archive is hosted on the IP address 80[.]85[.]157[.]3. Users will be redirected to another Google Drive link if the specified User-Agent conditions are not satisfied. At the time of writing, we were not able to retrieve the payloads, so we are unable to definitively determine if they are indeed malicious. We believe that this is a mechanism to deliver different payloads to different victims.

It’s worth noting that every source IP address, request header, and request URL, is logged upon each connection. All the logging files are then stored in the /static folder.

The logging files: /static

The “/static” folder contains a large number of logging files that are seemingly manually rotated by the threat actors. At the time of writing, the logging files recorded the logs from January 3, 2023, to March 29, 2023. There were 40 logging files in the folder at the time we found them.

We also tried to parse and analyze the logging files. Since the files contain the access logs from the victims, we think that they could be counted for further analysis. The format of a logging record is as follows:

[Source IP] —- [Connection Date and Time]
[ Headers
// Host:
// User-Agent:
…
]
[Connected URL]

We also wanted to know which countries the victims were from. Based on app.py, the access logs record two kinds of URLs:

We’d like to emphasize that these connections are only a small portion of this campaign since these logs are only based on a single site. It’s also obvious that this site is used to host malicious files targeting victims from the European region.

With the help of those logging files, we were able to collect many distributed links in the wild. These links are attached in the Appendix.

Conclusion

In our previous research published in 2022, we learned that Earth Preta was actively targeting victims in the APAC region such as Australia, the Philippines, and Taiwan. This year, we found that the group not only targeted the APAC region but also expanded its scope to Europe.

We suspect that the group used the Google accounts compromised in the previous wave of attacks to continue this campaign. After analysis, we were also able to determine that it has been using different techniques to bypass various security solutions. From our monitoring of its used C&C servers, we also observed the group’s tendency to reuse these servers in subsequent attack waves.

From our observations of various Earth Preta campaigns, we’ve noticed that the group tends to build its arsenal with similar C&C protocols and capabilities in different programming languages, showing that the actors behind Earth Preta have likely been enhancing their development skills. However, because of their operational security mistakes, we were able to retrieve the scripts behind the scenes and learn the workflow of their attacks.

In the past, we have extensively analyzed the threat actor Earth Preta. The group’s evolution in its TTPs shows that it is highly active and that it is likely we will see more campaigns by it in the future. As such, we will continue to monitor Earth Preta to keep the public informed of the group’s activities.

MITRE ATT&CK

Appendix: URLs found in the folder “/static”

The appendix can be found here.

Indicators of Compromise (IOCs)

The full list of IOCs can be found here.