FunnyDream

Campaign overview

MITRE ATT&CK historical record. Dates reflect source observations. Current activity and target-region classification are not asserted; Global denotes unclassified catalogue coverage. FunnyDream was a suspected Chinese cyber espionage campaign that targeted government and foreign organizations in Malaysia, the Philippines, Taiwan, Vietnam, and other parts of Southeast Asia. Security researchers linked the FunnyDream campaign to possible Chinese-speaking threat actors through the use of the Chinoxy backdoor and noted infrastructure overlap with the TAG-16 threat group.(Citation: Bitdefender FunnyDream Campaign November 2020)(Citation: Kaspersky APT Trends Q1 2020)(Citation: Recorded Future Chinese Activity in Southeast Asia December 2021)

This is a historical record and does not establish current campaign activity.

Threat actor

Not established

Attribution confidence

Not established

First documented activity

2018-07-01

End date

Not established

Estimated victims

Not established

Reported impact

Not established

Unknown attribution, confidence and impact remain unspecified. Regional labels can include unspecified targets; assess the source evidence before acting.

Documented timeline

1. 2018-07-01

   Source-reported first observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

2. 2020-11-01

   Source-reported last observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

MITRE ATT&CK techniques

• T1059.005 · Visual Basic

  Execution — During FunnyDream, the threat actors used a Visual Basic script to run remote commands.(Citation: Bitdefender FunnyDream Campaign November 2020)

• T1018 · Remote System Discovery

  Discovery — During FunnyDream, the threat actors used several tools and batch files to map victims' internal networks.(Citation: Bitdefender FunnyDream Campaign November 2020)

• T1016 · System Network Configuration Discovery

  Discovery — During FunnyDream, the threat actors used ipconfig for discovery on remote systems.(Citation: Bitdefender FunnyDream Campaign November 2020)

• T1560.001 · Archive via Utility

  Collection — During FunnyDream, the threat actors used 7zr.exe to add collected files to an archive.(Citation: Bitdefender FunnyDream Campaign November 2020)

• T1059.003 · Windows Command Shell

  Execution — During FunnyDream, the threat actors used `cmd.exe` to execute the wmiexec.vbs script.(Citation: Bitdefender FunnyDream Campaign November 2020)

• T1105 · Ingress Tool Transfer

  Command And Control — During FunnyDream, the threat actors downloaded additional droppers and backdoors onto a compromised system.(Citation: Bitdefender FunnyDream Campaign November 2020)

• T1588.001 · Malware

  Resource Development — For FunnyDream, the threat actors used a new backdoor named FunnyDream.(Citation: Bitdefender FunnyDream Campaign November 2020)

• T1057 · Process Discovery

  Discovery — During FunnyDream, the threat actors used Tasklist on targeted systems.(Citation: Bitdefender FunnyDream Campaign November 2020)

• T1583.001 · Domains

  Resource Development — For FunnyDream, the threat actors registered a variety of domains.(Citation: Bitdefender FunnyDream Campaign November 2020)

• T1049 · System Network Connections Discovery

  Discovery — During FunnyDream, the threat actors used netstat to discover network connections on remote systems.(Citation: Bitdefender FunnyDream Campaign November 2020)

• T1585.002 · Email Accounts

  Resource Development — For FunnyDream, the threat actors likely established an identified email account to register a variety of domains that were used during the campaign.(Citation: Bitdefender FunnyDream Campaign November 2020)

• T1047 · Windows Management Instrumentation

  Execution — During FunnyDream, the threat actors used `wmiexec.vbs` to run remote commands.(Citation: Bitdefender FunnyDream Campaign November 2020)

• T1588.002 · Tool

  Resource Development — For FunnyDream, the threat actors used a modified version of the open source PcShare remote administration tool.(Citation: Bitdefender FunnyDream Campaign November 2020)

• T1082 · System Information Discovery

  Discovery — During FunnyDream, the threat actors used Systeminfo to collect information on targeted hosts.(Citation: Bitdefender FunnyDream Campaign November 2020)

Linked indicators

0 reviewed indicators. An indicator’s presence does not establish that every resource on shared infrastructure is malicious.

No reviewed indicators are supplied. None are inferred from the campaign description.

Documented infrastructure

No reviewed infrastructure is supplied.

Sources and evidence

• MITRE ATT&CK C0007

  Official MITRE ATT&CK campaign record C0007. Derived from mitre/cti commit 50be388e93819a5d20e71cbaaeccfda157abc846. Actor links and technique mappings are attributed to this source; confidence, victims, monetary impact and infrastructure are not inferred.

External sources retain their own licences and sharing conditions. Request a correction with supporting evidence.