TA459

TA459 is a threat actor tracked by Proofpoint and assessed as likely operating out of China. Proofpoint reported that TA459 typically targets Central Asian countries, Russia, Belarus, Mongolia, and nearby regions. In 2017, Proofpoint observed TA459 targeting financial analysts at major global financial firms operating in Russia and neighboring countries, particularly analysts covering the telecommunications sector. TA459 is associated with spearphishing-based initial access and user-execution tradecraft. The actor has attempted to get victims to open malicious Microsoft Word attachments sent via spearphishing and has targeted victims using spearphishing emails with malicious Microsoft Word attachments. In the documented 2017 campaign, the malicious Word document exploited CVE-2017-0199, downloaded an HTA disguised as an RTF file, used VBScript and PowerShell to retrieve a PowerShell script, and then downloaded and executed the ZeroT payload. TA459 has used PowerShell for execution of a payload. Proofpoint reported TA459 using malware including ZeroT, PlugX, and NetTraveler, and also documented 2017 activity involving ZeroT with secondary payloads including PlugX and PCrat/Gh0st. In the April 20 campaign, stage-two payloads were hidden inside BMP images using least significant bit steganography, and the stage-two payload was PlugX. Proofpoint also noted TA459 continued to use RAR SFX archives for initial payload delivery. Reported infrastructure related to TA459 activity includes yandax[.]net, which was indirectly related to infrastructure used in attacks against targets in Russia and Belarus. Separate reporting cited in the content notes infrastructure overlaps between domains associated with TA459-related activity and ShadowPad-linked infrastructure, including www.ertufg[.]com and www.ncdle[.]net, and notes WHOIS relationships involving yandax[.]net. However, the content does not directly attribute TA459 itself to ShadowPad or Winnti.