Credential Theft

Using DirectInput via DDRAW.DLL, the malware implements keystroke logging to capture credentials — a direct threat to banking operations.

An Evolving Adversary

This was not the first time we intercepted this threat actor. A closely related malware sample was captured on April 18, 2025. The two variants share nearly identical post-exploitation behavior — the same dropped files, the same C2 infrastructure, the same MITRE ATT&CK technique profile.

The key difference? The delivery mechanism evolved. The April variant dropped files directly into the user’s AppData temp directory. The May variant switched to using HaoZip (a Chinese archiving tool) to extract files into C:\PerfLogs\ — a less-monitored directory that is more likely to bypass endpoint detection rules. This tactical shift is a clear indicator of an adversary that is actively iterating on their tradecraft in response to detection.

MITRE ATT&CK Mapping

The malware maps to techniques across nine MITRE ATT&CK tactics, demonstrating a comprehensive attack capability that is not typical of commodity malware:

Attribution: Who Is Behind This?

Based on the TTP mapping, C2 infrastructure geolocation, tooling characteristics (Chinese-language artifacts, HaoZip usage, UDF-based MySQL exploitation), and targeting pattern (financial sector in India), the observed behavior aligns with three known APT groups:

APT41 (Double Dragon) — A Chinese state-affiliated group known for blending cyber espionage with financially motivated operations. Their use of DLL side-loading, process injection, and non-standard C2 ports closely mirrors what we observed. APT41 has a documented history of targeting the financial and telecommunications sectors across Asia.

APT32 (OceanLotus) — A Vietnamese state-linked group with expanding operations against financial targets in Asia. Their reliance on DLL side-loading and WMI for persistence aligns with several techniques in this attack chain.

Lazarus Group (APT38) — The North Korean group infamous for targeting banks and financial infrastructure globally. Their use of Windows services, scheduled tasks, and covert C2 protocols is consistent with what we found.

While definitive attribution requires intelligence beyond the scope of malware analysis alone, the convergence of technical indicators strongly suggests a state-sponsored or state-affiliated actor with specific interest in India’s financial infrastructure.

What This Means for Indian BFSI

This attack was intercepted before it could cause harm — but not every organization has deception technology deployed at the right choke points. The adversary’s approach — targeting MySQL services, abusing ManageEngine agents, and communicating with C2 servers in China — exploits the exact combination of legacy infrastructure and legitimate enterprise tooling that is common across Indian banks and financial institutions.

Key recommendations for defenders:

1. Block known C2 infrastructure. Add *.zcnet.net and the 114.234.239.0/24 subnet to your firewall and proxy blocklists immediately.
2. Audit ManageEngine deployments. Verify the integrity of all ManageEngine UEMS Agent binaries. Check hashes of dcagentregister.exe, dcstatusutil.exe, and dcconfig.exe against known-good versions.
3. Deploy IoC-based detection rules. Add the file hashes listed at the end of this post to your EDR/SIEM solutions.
4. Monitor non-standard port traffic. Set up alerts for outbound connections on port 8383 and DNS queries to star.zcnet.net.
5. Restrict execution from high-risk directories. Implement application control policies to block binaries executing from C:\PerfLogs\, Temp folders, AppData, and removable drives.
6. Remove persistence artifacts. Hunt for scheduled tasks named DCAgentUpdater.job, services named DesktopCentral under non-standard registry paths, and related registry modifications.

Why Cyber Deception Works

This incident reinforces a fundamental truth about modern cyber defense: you cannot stop what you cannot see.

Traditional perimeter defenses — firewalls, antivirus, even EDR — are reactive. They rely on knowing what an attack looks like before it arrives. The adversary in this case used sandbox evasion, VM detection, polyglot obfuscation, and legitimate tool abuse specifically to bypass these defenses.

Cyber deception flips the equation. By deploying realistic decoys — database services, file shares, application servers — inside the network, defenders create an environment where any interaction is inherently suspicious. There is no legitimate reason for anyone to connect to a decoy MySQL instance. The moment the attacker engaged, the game was already over.

Treacle Tech’s Octopus Decoy captured this malware sample in its entirety, with full bitstream logs of every SQL query, every function creation, and every download attempt. The malware was preserved for analysis without ever executing in the production environment — zero risk, full intelligence.

This is the promise of cyber deception: early detection, zero false positives, and complete threat intelligence capture.

Indicators of Compromise (IoCs)

  About Treacle Technologies

Treacle Technologies is an IIT Kanpur-incubated cybersecurity startup specializing in AI-powered cyber deception. Our flagship platform, i-Mirage, deploys intelligent decoys across enterprise networks to detect, deceive, and deflect advanced threats in real time.

Website: www.treacletech.com  |  Email: contact@treacletech.com  |  Phone: +91-8420407686 

                                                                                                                                                Contributed by Raj Kumar