MalwareUsed by 2 actors

BackConfig

BackConfig is a Windows malware family associated with the Hangover threat group, also tracked as Neon, Viceroy Tiger, and MONSOON. It has been used in targeted intrusions against government and military organizations in South Asia. The malware exhibits downloader and backdoor-like behavior centered on staging and repeatedly executing additional malicious payloads on compromised hosts.

BackConfig has been delivered through malicious documents containing VBA macros and through VBS-based installation routines that deploy its downloader component. On infected systems it can download and execute files using native Windows and networking APIs, including functionality consistent with retrieving remote content over HTTP and launching payloads locally. It also gathers basic host information such as the victim computer name.

For persistence, BackConfig abuses Windows Scheduled Tasks to repeatedly execute malicious payloads. It also employs multiple defense-evasion measures, including hiding files and folders from normal Windows Explorer view, storing payloads in directories made to resemble legitimate software locations, masquerading as a legitimate DHCP service binary, removing artifacts from previous infections, and identifying prior infection-related files and folders. Samples have also used custom string decryption routines and self-signed code-signing certificates crafted to imitate a legitimate software company, further complicating analysis and detection.

Overall, BackConfig is best characterized as a Windows downloader used in espionage-oriented campaigns, with persistence, payload staging, host profiling, cleanup, and masquerading features tailored for stealthy operations against high-value governmental and military targets.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

DoNot APT

References : https://unit42.paloaltonetworks.com/updated-backconfig-malware-targeting-government-and-military-organizations/

via k7 labslabs.k7computing.com

Hangover

Unit 42 researchers recently published on activity by the Hangover threat group (aka Neon, Viceroy Tiger, MONSOON) carrying out targeted cyberattacks deploying BackConfig malware attacks against government and military organizations in South Asia.

via palo alto networks unit 42 blogunit42.paloaltonetworks.com

MITRE ATT&CK

Techniques & procedures

16 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

5 techniques

T1053Scheduled Task/JobEvidence1

“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”

T1053.005Scheduled TaskEvidence4

The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.

T1059.003Windows Command ShellEvidence3

Many entries mention .bat, .cmd, or batch scripting, such as APT1 using batch scripting to automate execution, APT41 using a batch file for persistence, and numerous malware families executing or downloading batch files. | The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.

T1059.005Visual BasicEvidence2

APT-C-36 has embedded a VBScript within a malicious Word document which is executed upon the document opening.

T1106Native APIEvidence1

The content is a MITRE ATT&CK-style listing of many malware families and threat groups using Windows/native OS APIs for execution, injection, discovery, anti-debugging, and other actions, ending with 'NtCreateProcess' and 'fork()'.

Persistence

2 techniques

T1053Scheduled Task/JobEvidence1

T1053.005Scheduled TaskEvidence4

The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.

Privilege Escalation

2 techniques

T1053Scheduled Task/JobEvidence1

T1053.005Scheduled TaskEvidence4

The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.

Stealth

6 techniques

T1027Obfuscated Files or InformationEvidence1

"...moved from plain text code and URLs to encoded... storing encoded executables within the documents..." and "Defense Evasion: Obfuscated Files or Information (T1027)"

T1036MasqueradingEvidence3

actors used the following command to rename one of their tools to a benign file name: ren "%temp%\upload" audiodg.exe ... APT1 ... used ... AcroRD32.exe ... as a name for malware ... APT28 ... changed extensions on files containing exfiltrated data to make them appear benign ... APT32 has renamed a NetCat binary to kb-10233.exe to masquerade as a Windows update.

T1036.005Match Legitimate Resource Name or LocationEvidence1

Akira has used legitimate names and locations for files to evade defenses.

T1070.004File DeletionEvidence7

The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.

T1140Deobfuscate/Decode Files or InformationEvidence7

APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload.

T1564.001Hidden Files and DirectoriesEvidence2

The content repeatedly describes malware and threat actors creating hidden folders, adding dot prefixes to filenames, and setting file attributes such as hidden/system to conceal files and directories from users and defenders.

Defense Impairment

1 technique

T1553.002Code SigningEvidence1

The content repeatedly describes threat actors and malware using valid, stolen, forged, self-signed, or abused code-signing certificates to sign malware and appear legitimate, including examples such as AppleJeus using a valid digital signature from Sectigo, APT41 leveraging code-signing certificates, FIN7 signing Carbanak payloads, and SUNBURST being digitally signed by SolarWinds.

Discovery

2 techniques

T1082System Information DiscoveryEvidence8

The content repeatedly describes malware and threat actors collecting OS version, computer name, architecture, CPU, memory, disk, language, and other host details; examples include use of commands such as ver, systeminfo, hostname, uname -m, sw_vers -productVersion, and fsutil.

T1083File and Directory DiscoveryEvidence4

The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence4

The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications.

T1105Ingress Tool TransferEvidence1

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."

ACTIVITY FEED

Recent activity

34 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

34 SOURCESView more in app

wikipedia cyber incidentsNews

Nov 20, 2023

Appin (company) - Wikipedia

Backdoor malware referenced in connection with Appin-linked cyberespionage activity; the content itself does not describe capabilities beyond being malware used in targeting campaigns.

k7 labsNews

Feb 23, 2023

The DoNot APT - K7 Labs

Malware associated with DoNot APT and targeting government and military organizations, mentioned in the references/background.

mitre attack websiteNews

Oct 25, 2022

Command and Scripting Interpreter: Visual Basic, Sub-technique T1059.005 - Enterprise | MITRE ATT&CK®

Uses VBS to install a downloader component and malicious documents with VBA macros.

mitre attack websiteNews

Oct 21, 2021

Deobfuscate/Decode Files or Information, Technique T1140 - Enterprise | MITRE ATT&CK®

Malware that uses a custom routine to decrypt strings.

+30 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping16

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

BackConfig