Mofang__2016__fox-it_mofang_threatreport_tlp-white.pdf

Mofang is an information-stealing APT tracked by FOX-IT that likely operates out of China with probable government ties; it conducts targeted espionage (notably against Myanmar SEZ-related organizations, government, military and selected industries) using two custom tools, ShimRat (a RAT with persistence via Windows shims and DLL-hijacked AV components) and ShimRatReporter (an environment-mapping reconnaissance tool). The group relies on social engineering for initial compromise, builds faux C2 infrastructure that mimics trusted services, deploys customized payloads configured for local proxies, and the report provides detailed TTPs, timelines, sample hashes, domains/IPs, YARA/Snort rules and host/network IOCs for detection and IR.