APT40 Find and Exfiltrate Chain
For this week’s TTP Tuesday we are releasing the final chain in our APT40 theme. This chain is called Find and Exfiltrate, it utilizes some techniques that are used in attacks by APT40.
The chain starts by identifying files with names containing “user” or “pass”. The chain will then attempt to filter out binary files and check for the presence of some commonly used special characters. It will then compress those files and host the link on a website. Finally, the chain will shutdown the webserver after two requests and clean up the files that were created.