REF2924
REF2924 is an intrusion set tracked by Elastic Security Labs and assessed as state-sponsored and espionage-motivated based on observed targeting and post-exploitation collection activity. Elastic assessed with moderate confidence that REF2924 is a regional threat group with non-monetary motivations, and linked it along technical, tactical, and victim-targeting lines to Winnti Group and ChamelGang. Reported targeting includes the Foreign Affairs Office or Foreign Ministry of an ASEAN member state, telecommunications providers in Afghanistan, and possible targeting of Mongolian government or NGO entities. Malware and tooling associated with REF2924 include DOORME, SIESTAGRAPH, and SHADOWPAD, with additional co-resident malware later observed in related environments including NAPLISTENER, SOMNIRECORD, and COBALTSTRIKE. DOORME is a malicious IIS backdoor deployed on internet-facing web or Exchange servers. It authenticates via a specific HTTP cookie value, inspects inbound requests early in the IIS pipeline, and supports in-memory shellcode execution, including chunked shellcode staging and named-pipe interaction with executed payloads. SIESTAGRAPH is a .NET backdoor that abuses Microsoft Graph API and Microsoft 365 services for command and control, including Outlook draft messages and OneDrive, blending malicious traffic with legitimate cloud activity. It supports shell execution, file upload and download, drive and directory listing, file deletion and renaming, process listing and killing, network discovery, screenshots, sleep changes, and self-termination. SHADOWPAD was observed delivered through DLL sideloading using an old Bitdefender Crash Handler binary, with encrypted shellcode stored in the registry and later executed from RWX memory. Elastic observed REF2924 activity including mailbox collection from an internet-connected Microsoft Exchange server at the Foreign Affairs Office of an ASEAN member in December 2022, and identified identically configured DOORME backdoors on telecommunications providers in Afghanistan. Elastic also linked REF2924-related campaigns to Winnti and ChamelGang based on shared malware, file names, techniques, victimology, and strategic targeting priorities.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Government & Administration
- Telecommunication Services
Where they target
Geographies tied to known operations.
- 🇦🇫 Afghanistan
Tradecraft
18 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
1 malware family attributed to this actor across reporting.
Observables
24 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Intrusion set referenced for using the SIESTAGRAPH backdoor to access Microsoft 365 Mail via the Microsoft Graph API for command-and-control while targeting the Foreign Affairs Office of an ASEAN member.
A previously reported activity cluster involving an attack on a Southeast Asian foreign ministry and notable for abuse of Microsoft Graph API for command and control.
China-nexus espionage intrusion set targeting government diplomatic entities in ASEAN and likely Mongolian government or NGO victims. Associated with multiple malware families and post-exploitation collection activity.
Intrusion set associated with DOORME, SIESTAGRAPH, and SHADOWPAD, assessed as a nationally aligned group with non-monetary motivations targeting foreign ministry and telecommunications environments.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.