Chinese cyber espionage APT group ‘Emissary Panda’ activity update

Introduction

Last week we shared research on the Chinese cyber espionage APT group ‘Emissary Panda’ and how the group is for the first time leveraging Hacking Team’s leaked exploits to target a multinational financial services firm. Upon further analysis we have identified multiple other industry verticals that were also targeted by this group in the last month. The ‘Emissary Panda’ APT group has been known to target the government and technology sectors with the intent to monitor and steal intellectual property data.

There were multiple global clients targeted in the last month that belong to following industry verticals:

• Financial Services
• Energy
• Pharmaceutical

Attack Chain

As noted before, this was the first instance of the ‘Emissary Panda’ group weaponizing malware payloads using the 0-day exploits found in the leaked Hacking Team archives. We were able to confirm usage of Adobe Flash exploits CVE-2015-5119 and CVE-2015-5123 in these attacks.

In the attack against a Pharmaceutical firm, we observed the use of a compromised Government site to redirect the victim to a server hosting the Hacking Team’s 0-day Flash exploit. This technique is known as Strategic Web Compromise (SWC) or a Watering Hole attack, wherein a legitimate trusted website known to be visited by the target group is compromised in order to redirect them to the attacker controlled server. The attacker controlled server will serve and execute browser based exploits to install a RAT on the target machine.

APT Attack chain targeting a multinational Pharmaceutical company

In this attack, we were able to prevent the download and installation of the RAT payload.

In another instance, spearphishing e-mail was used to target an organization in energy sector that resulted in installation of HttpBrowser RAT. The attacks against these organizations were largely unsuccessful as the Zscaler security platform blocked either the exploitation attempt or the Command & Control communication attempt.

Emissary Panda APT attacks seen in last month

We are still investigating some of these attack chains and will share additional details when they become available.

Conclusion

It is alarming to see an uptick in the activity from this group targeting multiple verticals with organizations located in United States, Europe, Middle East, and Asia. In order to protect themselves, it is extremely important for organizations to have SSL security inspection enabled as well as a Sandbox environment to detonate and block the 0-day exploits involved in such targeted attacks.

USPS Spam Delivering Asprox Variant

UPDATE: The botnet which is described here is called 'Asprox'. I've compared research with that seen from StopMalvertising.

Recent email spam has begun taking advantage of user's need to snail mail something.  The attacker will forward a message supposedly from USPS in order to get victim's to click on a link purported to be a shipping receipt, which actually leads to a malicious file.  If the user is unfortunate enough to click the link in the spam mail, a zip file containing a variant of Asprox is downloaded.

At the time of research, the VT score was 4/53

Once the file makes it way onto the desktop, it feigns a document icon in order to trick the user into thinking it is safe to view.  This is actually the malicious executable which scored 4/53 on initial VirusTotal scans.

Never trust an icon!  Check the 'Right Click > Properties' to see the true extension

The file itself creates local copies of itself in the logged-in User's Local Application Data and creates an autostarter to ensure that the victim stays infected after restarting their compromised PC.

The threat installs a randomly generated Autostarter value

ThreatLabZ has monitored this infection for a few days and observed several other download locations that kick off this threat.

All links download a similar package.  A third party sandbox analysis is available here

The common factor across all of these dropped files is that they all POST bzip2 compressed data which is then encrypted with a 16-byte random RC4 key via HTTP as reported by StopMalvertising.  We're seeing a growing number of attacks which utilize this method of phone home activity. The case of this Asprox threat phones home over ports 443 and 8080.

Communication is sent over port 8080 or 443

ThreatLabZ collected numerous IPs which were seen to communicate with malicious variants mentioned above.

IPs which communicated with Malicious samples.

Users and Administrators should be cautious of all traffic regardless of the ports it communicates on.  Attackers are leveraging nonstandard HTTP ports in order to bypass some security solutions.

Spearphishing Connects PCs to Russian Botnet

The talent over at MalwareBytes wrote this week about a Zbot dropper which comes from a PDF exploit through a spear-phishing e-mail.  In their blog, they discuss how a spear-phishing attempts to exploit either CVE-2013-0640 or CVE-2013-2729. User's must be extra cautious dealing with any attachment in an e-mail, but this threat merits extreme concern.  It installs a very persistent rootkit and logs the victim into a botnet which receives new commands/tasks every 10 minutes.  Removal is near impossible and also will use your Windows Mail to spear-phish your contact list.

As noted by MalwareBytes, attackers often use false extensions in order to infect victims (such as totally_legit.doc.exe). In the case of this attack, victim's download and click a malicious PDF.  This PDF, as Malwarebytes mentions, exploits Adobe Reader 11 and downloads an executable file.  At the time of research, 18/51 AV companies saw through this ruse and blocked the content before it had a chance to further exploit the victim.

We obtained a copy of the same malware in the Zscaler cloud and noted the following observations. A dropped file immediately connects to a Russian IP address to set up its beaconing activity as well as download more malicious PE files to the victim's machine.

axisbuild[.]com is showing some suspicious activity besides beaconing.

The translation of the C&C configuration file seen above in English is:

Интервал обращения к серверу в минутах

('Interval back to the server in minutes')

Таймаут цикличного обращения по ссылкам в минутах

('Timeout cyclical treatment referred to in minutes')

Список ссылок c&c

('The list of references c & c')

Страна бота

('Country bot')

Список задач

('task List')

In addition to awaiting for further commands from a remote server, the threat will also make many edits to the vicitm's system in order to remain despite removal processes.

There are several locations where this threat might download additional malicious PE files.  I've added a brief list below to illustrate.  I will provide more upon request to interested security professionals.

There are other locations used to download malicious files.

We took all different versions of these files and combined the phone home traffic to give a full list of IPs contacted.  The dropped files immediately begin to contact various IP addresses using nonstandard ports.  The following is a list of IPs and their hosted country.  

List of nonstandard ports used by all variants.

List of IP addresses which were contacted across all variants.

Administrators should monitor their networks for any activity which might match the outgoing transactions above.  Administrators will have a really tough time removing the threat due to the creation of a rootkit and altering the system's boot sequence.  The Zbot variant maintains a high level of persistence by doing the following:

This allows for untested drivers to be executed as part of the boot process

• Uses bcdedit to modify the Windows boot settings.

Dropped files create a system driver which executes during boot sequence.

• Spawns drivers in the Windows Directory

The Autostarter value is randomly generated

• Creates an autostart registry key

Used to inject malicious process into kernel.

• Registers kernel notifiers (kernel callbacks)

The victim is used as a node in further spear-phishing campaigns.

• Manipulates Windows Mail files

Users and Administrators must take extra caution against suspicious attachments.  Common methods for APT infection include tricking users to go to a compromised website or downloading something malicious through an attachment.  The fact that this threat compromises Windows Mail files means that the victim can be used to attack your contact list.  This allows for the attack to circumvent spam lists and base protections employed by regular users.  The best solution is to employ a sandboxing solution against all files which come through e-mail.

Tracking a botnet infection

Recently we found several malicious executables with similar characteristics. These files were found on the following six domains:

• janashfordplumbing.com
• kalliskallis.com
• lowes-pianos-and-organs.com
• continental1.com
• foreigntire.com
• gjhimages.com

The URLs used, adhered to the following two formats:

• http://www.[domain].com/awstats6_data/[a-f0-9]{10}/?f=sm_main.mp3&k=[0-9]{15}
• http://www.[domain].com/images/[folder]/[folder]/[a-f0-9]{10}/?f=sm_main.mp3&k=[0-9]{15}

These six domains are otherwise legitimate sites that have been compromised and used to serve malicious content. While I didn't determine the vulnerability used to obtain  control of these websites, all of them were misconfigured, allowing directory listings (viewing all files available in folders) and/or having AWSTATS publicly available.

The malicious files kept changing, with different signatures. Their behavior, however, was always the same and was identified as a botnet. When executed, the botnet hides itself in the Recycle bin and infects other running processes. It connects to over 50 IP addresses over UDP/16471 and TCP/16471. These IPs keep changing with each file and each execution.

The botnet always connects to xlotxdxtorwfmvuzfuvtspel.com through HTTP, but the domain answers with an empty response. You'll notice that the malware uses HTTP/1.0 with a Host header (not RFC compliant), often a good sign of malicious HTTP activity.

HTTP request to C&C

We found the malicious samples through Behavior Analysis, then used our log correlation to find the source of the malicious executables.

MSUpdater Trojan and link to targeted attacks

This blog post is based on a joint report by Zscaler and Seculert (their blog post). Researchers from both companies separately identified attacks which used a remote access tool (RAT) malware that apparently targeted defense-related organizations. With joined forces, we analyzed the incidents that we observed and those published in the open-source to identify attack patterns and incidents from early 2009 to present.

Figure 1: Screenshot of Report Heading

The threat arrives in phishing emails with a PDF attachment, possibly related to conferences for the particular targeted industry. The PDF exploits a vulnerability within Adobe (for example, a 0-day exploit was used against CVE-2010-2883) which then drops a series of files to begin communicating with the command and control (C&C).

Figure 2: Screenshot of Example Conference PDF "Lure"

The malware dropped and launched from the PDF exploit has been seen to be virtual machine (VM) aware in order to prevent analysis within a sandbox. The Trojan functionality is decrypted at run-time, and includes expected functionality, such as, downloading, uploading, and executing files driven by commands from the C&C. Communication with the C&C is over HTTP but is encoded to evade detection. The Trojan file name (e.g., "msupdate.exe") and the HTTP paths used in the C&C (e.g., "/microsoftupdate/getupdate/default.aspx") are used to stay under the radar by appearing to be related to Microsoft Windows Update - hence the name given to this Trojan.

Correlating this information with open-source intelligence (OSINT), we were able to find other reports of this Trojan within past targeted incidents, as well as a link to other incidents and compromise indicators. Further details of this information can be read within our joint report. The mission of this report is to inform organizations and security executives about these threats, and assist them in detection and mitigation.

"1.php" Group Intrusion Set Paper

Update: report links now go straight to the paper versus the general Whitepaper page.

ThreatLabZ has just released a report that provides a summary of incident information related to the "1.php" Group. Historically, this Group used command and control servers (C&Cs) with "/1.php?" for the checkin URL path - which is the reason for the informal name used. They have repeatedly targeted one of our customers - so I worked to compile some research on this group. There is evidence to show that the group has been operating at least since 2008 and that they tend to target China/US relations experts, Defense entities, and Geospatial entities using spear phishing with a malicious PDF attachment or a link to a ZIP that decompresses a malicious SCR. The payload is often a PoisonIvy remote access tool/trojan (RAT) or something similar. They have varied their C&C checkin behavior, but it is usually over the web - sometimes it is HTTPS, sometimes it is HTTP with different checkin parameters/paths. The Group either registers their own domains or uses No-IP dynamic DNS domains for their C&Cs.

For further details on the "1.php" Group research, please register and view the report HERE.

One challenge with doing this research is who/how to share the information. Responsible disclosure is pretty well defined at this point for vulnerability information, but it is not in terms of incident response information (particularly when the "APT" term is used).

This report provides high-level indicators of compromise (such as general network behavior and malicious domains) without the release of specifics, such as victim information. The purpose is to establish a community of awareness so that organizations can better detect and protect against these and similar threats. Additional specifics of the attacks were limited to stakeholders (victims and those chartered with protecting them).

If you have additional details on this Group or would like to exchange information with Zscaler - please contact us at our threatlabz email address.

.LNK (CVE-2010-2568) / Stuxnet Incident

We’ve had a number of inquiries regarding the .LNK (CVE-2010-2568) vulnerability and related Stuxnet malware. There are a number of stories (for example, CNET) that detail the timeline of events and the SCADA angle to the attacks. Being a SaaS vendor focusing on web-based threats and having the powerful ability to do post-incident web log forensics, I wanted to share information on what we saw.

Detections:

Conducting web log forensics, we detected a small number of Stuxnet infected machines calling out to known C&C servers. None of the impacted machines appear to be running SCADA or industrial equipment.

We are sharing the below information to facilitate detection and analysis for other security operations centers (SOCs) and the like.

The date of all of the infected transactions observed was on July 12.

C&C Server: www.mypremierfutbol.com
Server IP: 78.111.169.146
URL Sample: www.mypremierfutbol.com/index.php?data=66a96e28<redacted>
Request Type: GET

• Only one transaction was observed to the C&C per infected machine.
  
• The request size varied depending on the data parameter.
• The response size was always 24,778 bytes in the observed transactions.
• The user agent string varied among Microsoft Internet Explorer versions (to include MS IE 8).
• The transaction to the C&C was observed immediately following a transaction to MSN or WindowsUpdate.

The URL data parameter always began with “66a96e28” in the observed transactions – the remainder of the data string has been redacted to protect the victim information. The exact details of the data string is currently unknown, however it is likely to contain encoded details about the victim – such as Windows version, host name, account name, and possibly whether the Siemens WinCC or PCS7 software is running.

Organizations that have the ability to, should conduct similar log analysis, and respond to any identified infections.

In-Line Protections:

The following are in-line protections that an enterprise can and should have in place to protect its users against this threat.

Blocks against known C&C servers including:

• mypremierfutbol.com
• todaysfutbol.com

In-line anti-virus signatures in place and tested against known related malware artifacts. For example, MD5s:

• 743E16B3EF4D39FC11C5E8EC890DCD29F (Stuxnet)
• 15db99383d46d790812e83df6196f4fd (SuckMe LNK PoC)

Signatures deployed for traffic that may mimic past observed C&C activity, for example,

• In URL: “index.php?data=66a96e28”

As well as signatures to detect the Metasploit WebDAV .LNK exploit.

Additionally, if appropriate or available organizations can deploy technologies to identify, parse, and/or block LNK files entering their organization.

Local Protections:

There is not currently a patch, though Microsoft has issued a work around detailed here.

Didier Stevens, a security researcher, has released a tool and screenshots on his blog about how to apply protections locally to prevent against LNK exploitation.

Conclusion:

This vulnerability has been, is being, and will continue to be exploited in the wild. Use the above information to conduct log forensics and analysis to identify and respond to infected systems. Apply appropriate in-line and local protections as appropriate within your environments.