 From at least January to April 2020, suspected Vietnamese actors APT32 carried out intrusion campaigns against Chinese targets that Mandiant Threat Intelligence believes was designed to collect intelligence on the COVID-19 crisis. Spear phishing messages were sent by the actor to China's Ministry of Emergency Management as well as the government of Wuhan province, where COVID-19 was first identified. While targeting of East Asia is consistent with the activity we’ve previously reported on APT32, this incident, and other publicly reported intrusions, are part of a global increase in cyber espionage related to the crisis, carried out by states desperately seeking solutions and nonpublic information. The first known instance of this campaign was on Jan. 6, 2020, when APT32 sent an email with an embedded tracking link (Figure 1) to China's Ministry of Emergency Management using the sender address [email protected][.]com and the subject 第一期办公设备招标结果报告 (translation: Report on the first quarter results of office equipment bids). The embedded link contained the victim's email address and code to report back to the actors if the email was opened. Figure 1: Phishing email to China's Ministry of Emergency Management Mandiant Threat Intelligence uncovered additional tracking URLs that revealed targets in China's Wuhan government and an email account also associated with the Ministry of Emergency Management. The libjs.inquirerjs[.]com domain was used in December as a command and control domain for a METALJACK phishing campaign likely targeting Southeast Asian countries. APT32 likely used COVID-19-themed malicious attachments against Chinese speaking targets. While we have not uncovered the full execution chain, we uncovered a METALJACK loader displaying a Chinese-Language titled COVID-19 decoy document while launching its payload. When the METALJACK loader, krpt.dll (MD5: d739f10933c11bd6bd9677f91893986c) is loaded, the export _force_link_krpt is likely called. The loader executes one of its embedded resources, a COVID-themed RTF file, displaying the content to the victim and saving the document to %!T(MISSING)EMP%! (MISSING)The decoy document (Figure 2) titled 冠状病毒实时更新：中国正在追踪来自湖北的旅行者, MD5: c5b98b77810c5619d20b71791b820529 (Translation: COVID-19 live updates: China is currently tracking all travelers coming from Hubei Province) displays a copy of a New York Times article to the victim. Figure 2: COVID-themed decoy document The malware also loads shellcode in an additional resource, MD5: a4808a329b071a1a37b8d03b1305b0cb, which contains the METALJACK payload. The shellcode performs a system survey to collect the victim's computer name and username and then appends those values to a URL string using libjs.inquirerjs[.]com. It then attempts to call out to the URL. If the callout is successful, the malware loads the METALJACK payload into memory. It then uses vitlescaux[.]com for command and control. The COVID-19 crisis poses an intense, existential concern to governments, and the current air of distrust is amplifying uncertainties, encouraging intelligence collection on a scale that rivals armed conflict. National, state or provincial, and local governments, as well as non-government organizations and international organizations, are being targeted, as seen in reports. Medical research has been targeted as well, according to public statements by a Deputy Assistant Director of the FBI. Until this crisis ends, we anticipate related cyber espionage will continue to intensify globally. Type Indicators Domains m.topiccore[.]com jcdn.jsoid[.]com libjs.inquirerjs[.]com vitlescaux[.]com Email Address [email protected][.]com Files MD5: d739f10933c11bd6bd9677f91893986c METALJACK loader MD5: a4808a329b071a1a37b8d03b1305b0cb METALJACK Payload MD5: c5b98b77810c5619d20b71791b820529 Decoy Document (Not Malicious) Platform Signature Name Endpoint Security Generic.mg.d739f10933c11bd6 Network Security Trojan.Apost.FEC2, Trojan.Apost.FEC3, fe_ml_heuristic Email Security Trojan.Apost.FEC2, Trojan.Apost.FEC3, fe_ml_heuristic Helix   Tactic Techniques Initial Access Spearphishing Attachment (T1193), Spearphising Link (T1192) Execution Regsvr32 (T1117), User Execution (T1204) Defense Evasion Regsvr32 (T1117) Command and Control Standard Cryptographic Protocol (T1032), Custom Command and Control Protocol (T1094)		From at least January to April 2020, suspected Vietnamese actors APT32 carried out intrusion campaigns against Chinese targets that Mandiant Threat Intelligence believes was designed to collect intelligence on the COVID-19 crisis. Spear phishing messages were sent by the actor to China's Ministry of Emergency Management as well as the government of Wuhan province, where COVID-19 was first identified. While targeting of East Asia is consistent with the activity we’ve previously reported on APT32, this incident, and other publicly reported intrusions, are part of a global increase in cyber espionage related to the crisis, carried out by states desperately seeking solutions and nonpublic information.Phishing Emails with Tracking Links Target Chinese GovernmentThe first known instance of this campaign was on Jan. 6, 2020, when APT32 sent an email with an embedded tracking link (Figure 1) to China's Ministry of Emergency Management using the sender address [email protected][.]com and the subject 第一期办公设备招标结果报告 (translation: Report on the first quarter results of office equipment bids). The embedded link contained the victim's email address and code to report back to the actors if the email was opened.Figure 1: Phishing email to China's Ministry of Emergency ManagementMandiant Threat Intelligence uncovered additional tracking URLs that revealed targets in China's Wuhan government and an email account also associated with the Ministry of Emergency Management.libjs.inquirerjs[.]com/script/<VICTIM>@wuhan.gov.cn.pnglibjs.inquirerjs[.]com/script/<VICTIM>@chinasafety.gov.cn.pngm.topiccore[.]com/script/<VICTIM>@chinasafety.gov.cn.pngm.topiccore[.]com/script/<VICTIM>@wuhan.gov.cn.pnglibjs.inquirerjs[.]com/script/<VICTIM>@126.com.pngThe libjs.inquirerjs[.]com domain was used in December as a command and control domain for a METALJACK phishing campaign likely targeting Southeast Asian countries.Additional METALJACK Activity Suggests Campaigns Targeting Mandarin Speakers Interested in COVID-19APT32 likely used COVID-19-themed malicious attachments against Chinese speaking targets. While we have not uncovered the full execution chain, we uncovered a METALJACK loader displaying a Chinese-Language titled COVID-19 decoy document while launching its payload.When the METALJACK loader, krpt.dll (MD5: d739f10933c11bd6bd9677f91893986c) is loaded, the export _force_link_krpt is likely called. The loader executes one of its embedded resources, a COVID-themed RTF file, displaying the content to the victim and saving the document to %!T(MISSING)EMP%!T(MISSING)he decoy document (Figure 2) titled 冠状病毒实时更新：中国正在追踪来自湖北的旅行者, MD5: c5b98b77810c5619d20b71791b820529 (Translation: COVID-19 live updates: China is currently tracking all travelers coming from Hubei Province) displays a copy of a New York Times article to the victim.Figure 2: COVID-themed decoy documentThe malware also loads shellcode in an additional resource, MD5: a4808a329b071a1a37b8d03b1305b0cb, which contains the METALJACK payload. The shellcode performs a system survey to collect the victim's computer name and username and then appends those values to a URL string using libjs.inquirerjs[.]com. It then attempts to call out to the URL. If the callout is successful, the malware loads the METALJACK payload into memory.It then uses vitlescaux[.]com for command and control.OutlookThe COVID-19 crisis poses an intense, existential concern to governments, and the current air of distrust is amplifying uncertainties, encouraging intelligence collection on a scale that rivals armed conflict. National, state or provincial, and local governments, as well as non-government organizations and international organizations, are being targeted, as seen in reports. Medical research has been targeted as well, according to public statements by a Deputy Assistant Director of the FBI. Until this crisis ends, we anticipate related cyber espionage will continue to intensify globally.IndicatorsTypeIndicatorsDomainsm.topiccore[.]comjcdn.jsoid[.]comlibjs.inquirerjs[.]comvitlescaux[.]comEmail Address[email protected][.]comFilesMD5: d739f10933c11bd6bd9677f91893986cMETALJACK loaderMD5: a4808a329b071a1a37b8d03b1305b0cbMETALJACK PayloadMD5: c5b98b77810c5619d20b71791b820529Decoy Document (Not Malicious)Detecting the TechniquesPlatformSignature NameEndpoint SecurityGeneric.mg.d739f10933c11bd6Network SecurityTrojan.Apost.FEC2, Trojan.Apost.FEC3, fe_ml_heuristicEmail SecurityTrojan.Apost.FEC2, Trojan.Apost.FEC3, fe_ml_heuristicHelix Mandiant Security Validation ActionsA150-096 - Malicious File Transfer - APT32, METALJACK, DownloadA150-119 - Protected Theater - APT32, METALJACK ExecutionA150-104 - Phishing Email - Malicious Attachment, APT32, Contact Information LureMITRE ATT&CK Technique MappingTacticTechniquesInitial AccessSpearphishing Attachment (T1193), Spearphising Link (T1192)ExecutionRegsvr32 (T1117), User Execution (T1204)Defense EvasionRegsvr32 (T1117)Command and ControlStandard Cryptographic Protocol (T1032), Custom Command and Control Protocol (T1094)