Skip to main content

Manager APT Toolkit

First observed in late 2019, the Manager toolkit is a set of three C++ based tools; NewManager, AmpManager, and DDoSManager, created by the ChinaZ advanced persistent threat to primarily target Linux web servers.

Threat ID:
CC-3321
Category:
Dos
Threat Severity:
Low
Threat Vector:
Published:
19 December 2019 12:00 AM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

First observed in late 2019, the Manager toolkit is a set of three C++ based tools; NewManager, AmpManager, and DDoSManager, created by the ChinaZ advanced persistent threat to primarily target Linux web servers.

Affected platforms

The following platforms are known to be affected:

Microsoft Windows

  • Linux - Most popular distributions
  • Microsoft Windows - All versions

Threat details

At the time of publication it is unclear how the toolkit is delivered however, there are unconfirmed reports that ChinaZ has been observed deploying malware compromised with Manager binaries.

Each of the three tools contains its own persistence and command mechanisms and as such can be launched individually. The tools are listed bellow:

  • NewManager - A backdoor used to collect system and user information, before connecting to a command and control server.
  • AmpManager - Similar functionality to NewManager, but is able to perform DNS, NTP, and SSDP flood distributed denial-of-service (DDoS) attacks.
  • DDoSManager - Uses a different code base, but has similar functionality and persistence methods as AmpManager. Able to perform SYN, UDP, and DNS flood DDoS attacks.

Remediation steps

Type Step

To protect against a distributed denial-of-service (DDoS) attack, organisations should ensure:

Should an organisation suspect it is subject to an active DDoS attack, they should ensure that every effort is made to stop the attack and restore service. However, care should be taken to ensure that the attackers are not using the DDoS attack as a distraction whilst other, potentially more sensitive, systems are exploited. Monitoring of critical systems is recommended, including the use of host-based intrusion prevention and detection systems (HIPS/HIDS) where appropriate.

Additionally, to prevent and detect an infection, ensure that:

  • A robust program of education and awareness training is delivered to users to ensure they don’t open attachments or follow links within unsolicited emails.
  • All operating systems, anti-virus and other security products are kept up-to-date.
  • Regular anti-virus and security scans are performed on your organisation’s estate.
  • All day-to-day computer activities such as email and internet are performed using non-administrative accounts.
  • Strong password policies are in place.
  • Network, proxy and firewall logs should be monitored for suspicious activity.
  • User accounts accessed from affected devices should be reset on a clean computer.
  • Your organisation adopts a holistic all-round approach to Cyber Security as advocated by the 10 Steps to Cyber Security.

Last edited: 29 June 2021 11:57 am