MonPass CA delivered Cobalt Strike installer
Avast disclosed in July 2021 that the official client installer for MonPass — a major Mongolian certificate authority — was backdoored on the company's download site between 2021-02-08 and 2021-03-03.
Story
MonPass was a trusted certificate authority in Mongolia. In 2021, Avast found that its public web server had been breached and that the official MonPass client installer had been replaced with a backdoored version. The affected download window ran from February 8 to March 3, 2021.
The installer was built to look normal. It downloaded the legitimate MonPass client from the official site, dropped it under C:\Users\Public\, and executed it in a new process. The user saw the expected installation path while the malicious code ran beside it.
The payload used a second channel. It fetched bitmap files from attacker infrastructure such as download.google-images.ml:8880, extracted hidden bytes from image data, decoded hexadecimal text, and XOR-decrypted the result with miat_mg. The recovered payload was a Cobalt Strike beacon.
Avast's server review found multiple webshells and backdoors on the MonPass public server, showing repeated control rather than a one-file accident. MonPass later told Avast it had resolved the issues and notified affected customers. The core failure was simple: a CA's trusted client download became a loader for remote access.
Affected Artifacts
- Observed
- 2021-02-08 to 2021-03-03
- Compromised Versions
- Unknown
- Fixed
- Not listed
- Hashes
-
- sha256:f21a9c69bfca6f0633ba1e669e5cf86bd8fc55b2529cd9b064ff9e2e129525e8
- sha256:a7e9e2bec3ad283a9a0b130034e822c8b6dfd26dda855f883a3a4ff785514f97
- sha256:5cebdb91c7fc3abac1248deea6ed6b87fde621d0d407923de7e1365ce13d6dbe
- +6 more
- Evidence
- distribution: int.monpass.mn, mirror: github.com/avast/ioc/tree/master/MpIncident, malware: Cobalt Strike, pdb: C:\Users\test\Desktop\fishmaster\x64\Release\fishmaster.pdb , +13 more
Incident Context
- Motive
- Espionage
- Attribution
- State
- Cause
- Website Compromise
- Transitive
- No
- Actor
- Nation-state
External References
- Backdoored client from Mongolian CA MonPassgendigital.com
- Backdoored Client from Mongolian CA MonPassdecoded.avast.io
- Avast IoCs for MonPass incidentgithub.com
- Mongolian certificate authority MonPass breached, website served malwarebleepingcomputer.com
- Mongolian Certificate Authority Hacked to Distribute Backdoored CA Softwarethehackernews.com
Source record: proprietary/monpass/meta.yaml