Sharp Panda Using New Soul Framework Version to Target Southeast Asian Governments

Mar 08, 2023Ravie LakshmananAdvanced Persistent Threat

High-profile government entities in Southeast Asia are the target of a cyber espionage campaign undertaken by a Chinese threat actor known as Sharp Panda since late last year.

The intrusions are characterized by the use of a new version of the Soul modular framework, marking a departure from the group’s attack chains observed in 2021.

Israeli cybersecurity company Check Point said the “long-running” activities have historically singled out countries such as Vietnam, Thailand, and Indonesia. Sharp Panda was first documented by the firm in June 2021, describing it as a “highly-organized operation that placed significant effort into remaining under the radar.”

The use of the Soul backdoor in real-world attacks was first detailed by Broadcom’s Symantec in October 2021 in connection to an unattributed espionage operation targeting defense, healthcare, and ICT sectors in Southeast Asia.

The implant’s origins, according to research published by Fortinet FortiGuard Labs in February 2022, date as far back as October 2017, with the malware repurposing code from Gh0st RAT and other publicly available tools.

The attack chain detailed by Check Point begins with a spear-phishing email containing a lure document that leverages the Royal Road Rich Text Format (RTF) weaponizer to drop a downloader by exploiting one of several vulnerabilities in the Microsoft Equation Editor.

The downloader, in turn, is designed to retrieve a loader known as SoulSearcher from a geofenced command-and-control (C&C) server that only responds to requests originating from IP addresses corresponding to the targeted countries.

The loader is then responsible for downloading, decrypting, and executing the Soul backdoor and its other components, thereby enabling the adversary to harvest a wide range of information.

“The Soul main module is responsible for communicating with the C&C server and its primary purpose is to receive and load in memory additional modules,” Check Point said.

“Interestingly, the backdoor configuration contains a ‘radio silence’-like feature, where the actors can specify specific hours in a week when the backdoor is not allowed to communicate with the C&C server.”

The findings are yet another indication of the tool sharing that’s prevalent among Chinese advanced persistent threat (APT) groups to facilitate intelligence gathering.

“While the Soul framework has been in use since at least 2017, the threat actors behind it have been constantly updating and refining its architecture and capabilities,” the company said.

It further noted that the campaign is likely “staged by advanced Chinese-backed threat actors, whose other tools, capabilities and position within the broader network of espionage activities are yet to be explored.”