A chain that uses a multi-stage malicious Word document to evade defenses and exfiltrate data. The macro enabled document will first load a previously staged C2 config file and execute mshta.exe to run a second stage HTA payload which downloads a secondary Pneuma Agent as the third stage. This chain will also execute and collect keystrokes and exfiltrate data using OneDrive. Similar behaviours were observed in APT37 when targetting South Korean users, North Korean defectors, policy makers, journalists and human rights activists.


Is my host protected against APT37?

Use a pre-configured OneDrive account to attach a drive and transfer data out of the local system to the cloud.


Exfiltrate data to OneDrive

Authors

Tags

Tactic

Test this TTP