Threat Intelligence and Security Incidents
Espionage Disguised as Recruitment Notices: Technical Analysis of the Entire Attack Chain of Warzone RAT Delivery via Template Injection by the Confucius Group
Confucius (also known as: Molaosuo, Kungfuzi, APT-C-48) is a long-standing active APT group with a South Asian state background, primarily targeting Pakistan and Chinese military-related government agencies and strategic research institutes. At the end of 2020, the group used a recruitment notification from the Pakistan Space and Upper Atmosphere Research Commission (SUPARCO) as a lure to deliver Word documents with template injection vulnerabilities to specific targets.
After the victim opens the document, the attack chain silently pulls the next-stage RTF payload without triggering any macro prompts, then exploits the Equation Editor legacy vulnerability CVE-2018-0802 to drop a DLL downloader, and finally deploys Warzone RAT (also known as Ave Maria Stealer)—a commercial spyware Trojan with full keylogging, credential theft, webcam surveillance, and remote shell capabilities.
The core challenge for security teams lies in the fact that the lure document itself contains no macros or scripts, and initially only 2–3 engines detected it when uploaded to VirusTotal; the entire attack chain runs silently from the moment the victim clicks to open the document until the RAT is completely resident.
Figure 1 – Overview flowchart of the complete Confucius × Warzone RAT attack chain (all stages from the lure document to the RAT landing)
Attacker Profile: Who is Confucius
Confucius (also known as: Molaosuo, Kungfuzi, APT-C-48) was publicly disclosed by Palo Alto Networks in 2016, but its footprint can be traced back to 2013. The group is widely recognized by the security industry as having a South Asian (Indian) state-level background, and has long carried out cyber espionage activities against governments, military industrial enterprises, and nuclear energy institutions in regions such as Pakistan, China, and Nepal.
Typical tactical characteristics of Confucius:
Spearphishing
Uses high-fidelity political hot spots, official notices, or military documents as lures to trigger clicks based on victims' professional interests (T1566.001 – Phishing: Spearphishing Attachment)Document Exploit Chain
Long-term use of legacy Equation Editor vulnerabilities such as CVE-2017-11882 and CVE-2018-0802, using Word documents containing template injection as the initial carrierTemplate Injection Evades Detection
Uses remote template references instead of directly embedding macro code. The document body contains no macros during static detection, evading traditional sandboxes and AV engines (T1221 – Template Injection)Commercial RAT Reuse
Introduces commercial RATs such as Warzone in addition to its self-developed tools ChatSpy/Bahamut. The toolchain shows an "outsourcing" trend, increasing the difficulty of attribution
Attack Origin: Lure Document Disguised as a SUPARCO Recruitment Notice (T1566.001 – Phishing: Spearphishing Attachment, T1221 – Template Injection)
The attackers precisely selected a recruitment notice from the Pakistan Space and Upper Atmosphere Research Commission (SUPARCO) as a lure, a topic with an extremely strong opening motive among the target audience (practitioners in the government/military/aerospace sectors).
Figure 2 – Screenshot of the Suparco recruitment notice lure document, showing the lure text content and format (mimicking the official style of Pakistan SUPARCO documents)
The lure document's structure is carefully hidden: the template reference field in the settings.xml.rels file was altered to point to a C2 domain controlled by the attacker. When the victim opens the document in Word, the program automatically and silently initiates an HTTP request to the remote address to fetch the next-stage RTF payload—with no macro prompt pop-ups throughout the process, no secondary user interaction required, and the document's appearance is completely identical to a normal recruitment notice.
Figure 3 – Word automatically downloads the RTF payload during the file opening process
Lure Document Sample Information:
Field | Value |
|---|---|
File Name | Suparco Vacancy Notification.docx |
MD5 | 37f78dd80716d3ecefc6a098a6871070 |
Remote Template Address | http://recent.wordupdate[.]com/ver/update12/KB466432 |
Initial VT Detection Rate | 2–3 engines (at upload time) |
Exploit Triggered: CVE-2018-0802 and Embedded DLL (T1203 – Exploitation for Client Execution, T1574.001 – DLL Search Order Hijacking)
The template pulled from C2 is an RTF file, in which a malicious DLL named bing.dll is embedded via an OLE object. The RTF file itself triggers code execution by exploiting the known Microsoft Equation Editor (EQNEDT32.exe) vulnerability CVE-2018-0802—which is triggered automatically when Word attempts to render the equation object in the RTF, without requiring the victim to manually enable any content.
Figure 4 – Screenshot of the OLE object embedded DLL structure within the RTF file
The trigger for CVE-2018-0802 is based on CLSID 7b0002CE02-0000-0000-C000-000000000046 in the RTF, which points to the Equation Editor component. Once the vulnerability is triggered, bing.dll (SHA-256: 07277c9f33d0ae873c2be3742669594acc18c7aa93ecadb8b2ce9b870baceb2f) is released and executed, entering the next stage of the download process.
Payload Delivery: From DLL to Warzone RAT (T1105 – Ingress Tool Transfer, T1547.009 – Shortcut Modification)
The internal export function mark in bing.dll is responsible for downloading the final RAT body from the C2 server and placing it in %ProgramData%update.exe. Once the download is complete, the program creates a shortcut named update.lnk pointing to update.exe in the current user's Startup directory, achieving automatic persistence after system reboots.
Figure 5 – Screenshot of the code in `bing.dll` responsible for downloading the Warzone payload
The downloader (muka.dll) creates the directory C:intel and places the RAT as C:intelnew.exe, while creating new.lnk in the Startup directory for persistence. The paths are different, but the mechanism is completely identical.
Figure 6 – The DLL file is a downloader program, downloading and executing the subsequent stages from the attack server
Privilege Escalation and Defense Evasion: UAC Bypass and Disabling Defender (T1548.002 – Bypass User Account Control, T1562.001 – Disable or Modify Tools)
Once the Warzone RAT lands, it first performs a UAC bypass, exploiting the auto-elevation property of Windows built-in backup tool sdclt.exe: it writes the following key-value pair to the registry, and then calls sdclt.exe, allowing the attacker's process to automatically gain high-integrity privileges.
Figure 7 – The Saixun Intelligent Security Validation Platform is already capable of simulating this attack stage
Figure 8 – Win10 elevating privileges via sdclt.exe
Once privilege escalation is complete, the sample executes the PowerShell command 2`Add-MpPreference -ExclusionPath C:`, adding the entire system drive to the Defender exclusion list.
Figure 9 – Sample executing powershell Add-MpPreference -ExclusionPath
It then copies itself to C:ProgramDatawinhost.exe to completely escape protection coverage
Figure 10 – Copying the currently running file to C:/ProgramData/winhost.exe
Stealth Persistence: NTFS Alternate Data Streams (T1547.001 – Registry Run Keys / Startup Folder, T1564.004 – NTFS File Attributes, T1055 – Process Injection)
Some variants utilize NTFS Alternate Data Streams (ADS) to achieve persistence, which is one of the most difficult hiding methods to detect via regular file scanning:
Writes a batch file programs.bat with normal content to the Startup directory (no abnormalities in static scanning)
Figure 11 – Creating a bat file in the startup directory and writing malicious commands.
Creates a hidden ADS stream programs.bat:start, containing the WMIC command: wmic process call create “C:ProgramData:ApplicationData”
Figure 12 – Creating an ADS data stream and writing backdoor instructions to hide malicious behavior
When
programs.batexecutes at boot, it calls the:startstream, launching the core Warzone module hidden in the ADS via WMIC
Figure 13 – Copying itself to the ADS stream file C:/ProgramData:Application and writing to startup
Finally, Warzone selects the injection target based on the system bitness: x64 systems are injected into cmd.exe, and x86 systems are injected into explorer.exe, completing C2 communication using a legitimate system process as a shell.
Warzone RAT Espionage Capability Panorama (T1555 – Credentials from Password Stores, T1125 – Video Capture, T1056.001 – Keylogging)
Once activated, Warzone RAT (internal communication key warzone160) possesses the following complete espionage capabilities:
Capability Type | Technical Implementation Details |
|---|---|
Credential Theft | Extracts locally stored login credentials from 10+ browsers including Chrome, Edge, Opera, UC Browser, and QQ Browser |
Email Account Theft | Reads saved account passwords from Outlook and Thunderbird |
Keylogging | Captures all keystrokes in real-time via the GetAsyncKeyState API, including special keys like TAB/ESC/CTRL |
Webcam Monitoring | Calls the ICreateDevEnum COM interface to silently record the feed of the currently connected webcam |
Remote Shell | Receives instruction 0x0E to execute arbitrary remote commands |
Process Injection | Instruction 0x48: x64 injects into cmd.exe, x86 injects into explorer.exe |
Download and Execute | Instruction 0x22 downloads and executes a new payload from C2 |
Process and File Management | Directory traversal (0x4A), system service registration (0x28) |
Indicators of Compromise (IoC)
File Hashes
C2 Infrastructure
YARA Characteristic Strings
Defense Recommendations
Email and Document Entry Points: Monitor HTTP requests initiated by winword.exe / excel.exe to external domains when documents are opened; document attachments triggering no macros in a sandbox does not mean there is no threat, as the malicious behavior of template injection occurs during the sandbox's network request phase.
Endpoint Detection Priority (EDR):
Detection Scenario | Critical Behavior | MITRE Technique |
|---|---|---|
Abnormal Outbound Connection from Office Process | winword.exe initiates DNS resolution to non-Microsoft/non-CDN domains | T1221 – Template Injection |
Equation Editor Vulnerability Trigger | Subprocess or file drop occurs after EQNEDT32.exe starts | T1203 – Exploitation for Client Execution |
UAC Bypass Characteristics | HKCU…Foldershellopencommand is written to + sdclt.exe executes immediately | T1548.002 – Bypass User Account Control |
Defender Exclusion Path Modification | PowerShell executes Add-MpPreference -ExclusionPath with the path being at the root directory level | T1562.001 – Disable or Modify Tools |
ADS Hidden Persistence | A .bat file appears in the Startup directory and a :start alternate data stream of the same name exists | T1564.004 – NTFS File Attributes |
The attack techniques used in this operation have been added to our security validation attack library, allowing you to directly verify the effectiveness of the above detection rules in an internal network environment.
Verify in your internal network: can your defense system stop this chain?
Figure 14 – Complete Confucius Attack Playbook
Saixun Security Labs has dismantled the complete attack chain of this Confucius operation—from template injection triggering, CVE-2018-0802 vulnerability exploitation, DLL downloader landing Warzone RAT, to UAC bypass, Defender disabling, and NTFS ADS hidden residency—and recorded them one by one into the security validation attack library. Enterprise security teams can directly execute this attack chain in their own real internal network environment to obtain a quantified answer on the "actual block rate of the current defense system against such attacks", rather than relying solely on IOC comparisons to judge whether they are protected.
