APT-C-60 exploits WPS Office zero-day in East Asia attacks.

In July 2024, the Chinese-linked threat group APT-C-60 (also tracked as Mustang Panda) weaponized a previously unknown zero-day vulnerability in WPS Office (CVE-2024-7262) to target government and military entities in East Asia. The exploit, delivered via spear-phishing emails with malicious .docx files, leveraged a flaw in WPS Office's handling of embedded OLE objects to execute arbitrary code without user interaction. Over 300 confirmed infections were reported across Taiwan, South Korea, and Japan within the first two weeks. In this post, we dissect the technical mechanics of the exploit, map the attacker's TTPs to MITRE ATT&CK, and provide actionable detection and mitigation strategies for your SOC.

Real-World Context: Why East Asia?

APT-C-60 has historically targeted geopolitical adversaries, focusing on espionage in the South China Sea region. The use of WPS Office—a widely used office suite in Chinese-speaking regions—is strategic. According to a June 2024 report by Trend Micro, WPS Office holds over 60% market share in China and significant adoption in Taiwan and Southeast Asia. The zero-day allowed attackers to bypass standard email security gateways that fail to inspect embedded OLE objects in .docx files. In one incident, a Taiwanese defense contractor received a document titled \"2024_Defense_Budget_Review.docx\" that, when opened in WPS Office, silently installed a backdoor tracked as 'PlugX'.

Attacker TTPs: Mapping to MITRE ATT&CK

The attack chain aligns with several MITRE ATT&CK techniques:

• T1566.001 (Spearphishing Attachment): Emails contained malicious .docx files crafted to exploit CVE-2024-7262.
• T1204.002 (User Execution: Malicious File): The vulnerability triggers on file open, requiring no additional user interaction.
• T1059.003 (Command and Scripting Interpreter: Windows Command Shell): The exploit downloads and executes a PowerShell script.
• T1071.001 (Application Layer Protocol: Web Protocols): C2 traffic uses HTTPS to blend with legitimate traffic.

We've observed similar patterns in our own pentests: attackers often target productivity software because of its high trust level and embedded object handling flaws.

Technical Deep Dive: CVE-2024-7262 Exploitation

The vulnerability resides in WPS Office's wpsoffice.exe binary (version 12.1.0.16420 and earlier). Specifically, it's a heap-based buffer overflow in the OLE object parser when processing crafted oleObject XML elements within a .docx file. The exploit uses a malformed OLEObject with an oversized DataSize attribute, causing the parser to allocate insufficient memory and then copy attacker-controlled data into adjacent heap memory.

Step-by-Step Exploit Flow

1. The attacker crafts a .docx file with a modified document.xml containing a element referencing an OLE object.
2. The OLE object's DataSize field is set to 0xFFFFFFFF, forcing a 4-byte integer overflow during memory allocation.
3. WPS Office's parser allocates a 256-byte buffer but then reads 1024 bytes from the OLE stream, overwriting adjacent heap metadata.
4. The attacker controls the overflow data to overwrite a function pointer used later in the rendering pipeline, redirecting execution to a shellcode payload embedded in the document.
5. The shellcode downloads a second-stage payload from hxxps://cdn-update[.]com/update.exe (now defunct).

This technique—heap overflow via integer truncation—is well-documented in CVE-2018-0798 (Microsoft Office) but is novel for WPS Office. The shellcode itself is obfuscated using XOR with a dynamic key derived from the document's creation timestamp, making static analysis harder.

Defensive Playbook: Detection and Mitigation

We recommend a layered approach:

Endpoint Detection

Deploy YARA rules to detect the exploit's shellcode patterns. Example rule:

rule APT_C60_WPS_Exploit_Shellcode {
  meta:
    description = "Detects shellcode used in CVE-2024-7262 exploits"
    author = "Ammar Khan, CybernytronX"
    date = "2024-08-01"
  strings:
    $xor_loop = { 33 C0 8A 04 08 34 ?? 88 04 08 40 3B ?? 7C F2 }
    $url_string = "cdn-update" ascii wide
  condition:
    all of them
}

Network Detection

Use Sigma rules for proxy logs to detect C2 traffic patterns:

title: APT-C-60 C2 Beaconing
logsource:
  category: proxy
detection:
  selection:
    url|contains: "cdn-update"
    method: "POST"
  condition: selection

Mitigation Steps

• Update WPS Office to version 12.2.0.17100 or later, which patches CVE-2024-7262.
• Enable Windows Defender Attack Surface Reduction (ASR) rules to block Office applications from creating child processes.
• Implement email attachment scanning with deep OLE object inspection (e.g., using oletools).
• Monitor for anomalous WPS Office process behavior, such as wpsoffice.exe spawning powershell.exe or cmd.exe.

Why This Matters for Your Organization

This campaign demonstrates that zero-days in niche but widely deployed software are lucrative targets. If your organization operates in East Asia or partners with entities there, your attack surface includes WPS Office. The exploit's sophistication—using integer overflow and heap manipulation—requires advanced EDR telemetry to detect. In our SOC assessments, we've seen similar techniques used by APT groups like APT29 (using Microsoft Office zero-days) and LockBit (using browser exploits). The key takeaway: don't assume your productivity software is secure just because it's not Microsoft Office. Regularly audit third-party applications for known CVEs, and deploy behavioral detection rules that catch anomalous process chains.

Frequently Asked Questions

What is CVE-2024-7262 and how does it work?

CVE-2024-7262 is a heap-based buffer overflow in WPS Office's OLE object parser. It allows attackers to execute arbitrary code by sending a specially crafted .docx file that triggers an integer overflow during memory allocation, leading to a function pointer overwrite.

Who is APT-C-60?

APT-C-60, also known as Mustang Panda, is a Chinese state-sponsored threat group active since at least 2012. They focus on espionage against government, military, and technology sectors in East Asia, particularly Taiwan.

Which versions of WPS Office are affected?

Versions prior to 12.2.0.17100 are vulnerable. Users should update immediately to the latest version from the official WPS website.

How can I detect this exploit in my environment?

Deploy YARA rules targeting the shellcode patterns and Sigma rules for C2 traffic to domains like 'cdn-update'. Also monitor for WPS Office spawning PowerShell or cmd.exe processes, which is abnormal.

What should I do if I suspect an infection?

Isolate the affected system immediately, collect a memory dump and relevant logs, and scan for indicators of compromise (IoCs) such as the URL pattern mentioned. Contact your incident response team or CybernytronX for assistance.

Is this exploit still active?

As of August 2024, the C2 domains have been taken down, but APT-C-60 may use similar techniques with new infrastructure. Continuous monitoring and patch management are essential.

Need expert help with this?

At CybernytronX, we've analyzed over 50 zero-day exploits in the past year, including CVE-2024-7262. Our penetration testing team can simulate such attacks to find weaknesses in your environment, and our SOC automation platform, Ethereon AI, can detect these TTPs in real time. Contact us for a free consultation or learn more about Ethereon AI to fortify your defenses against advanced persistent threats.

Need expert help with this threat?

If your team needs to validate exposure to the issues above, CybernytronX runs penetration tests, SOC build-outs, and zero-day detection deployments backed by our Ethereon AI platform. We've remediated 50+ environments and recovered 20+ compromised domains. Most engagements start with a free 30-minute scoping call — book it here.