Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

9/6/2019
04:55 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Chinese Group Built Advanced Trojan by Reverse Engineering NSA Attack Tool

APT3 quietly monitored an NSA attack on its systems and used the information to build a weapon of its own.

Chinese threat actor APT3 quietly monitored the US National Security Agency's use of a highly sophisticated cyber attack tool and then reverse engineered the code to build an advanced Trojan of its own called Bemstour.

That conclusion, by Check Point Software, is based on the security vendor's analysis of Bemstour after Symantec in May reported on APT3 using it in attacks on targets in multiple countries, including Belgium, Hong Kong and the Philippines.

Symantec had described APT3 as using Bemstour to deliver a variant of a backdoor called DoublePulsar on target systems. Symantec said its analysis showed both tools appeared to be variants of attack software built by Equation Group, an operation affiliated with the NSA's Tailored Access Operations unit.

Symantec said it was unclear how APT3 had obtained the NSA tools. But it ruled out the possibility that the Chinese threat actor had obtained the weapons from the large trove of NSA cyber weapons that hacking outfit Shadow Brokers publicly leaked in 2017.

According to Symantec, its analysis showed that APT3 was using Bemstour and DoublePulsar well before the Shadow Brokers data dump. The two variants also had differences in code that made it very clear they did not originate from the leak, Symantec had noted.

Check Point's analysis of Bemstour shows that the exploit is in fact APT3's own implementation of EternalRomance, a tool that the NSA developed to break into Windows 7, Windows 8, and some Windows NT systems, the security vendor said.

APT3 developed the exploit by reverse-engineering EternalRomance, but then tweaked it so it could be used to target more systems. APT3's Bemstour leveraged the same Windows zero-day as the one used in EternalRomance (CVE-2017-0143). In addition the group also created an exploit for another Windows zero-day (CVE-2019-0703). Both flaws have been patched.

"What we found out is that in terms of the software vulnerabilities targeted by the underlying exploit they were identical to those leveraged by EternalRomance," says Mark Lechtik, lead security researcher at Check Point.

"This is no coincidence - finding the exact same set of bugs in order to create an exploit that provides remote code execution capabilities is very unlikely," he says. At the same time, there are enough differences in Bemstour to indicate the exploit was re-engineered and built from scratch, rather than copied wholesale. That is what led Check Point to conclude that an NSA exploit was used in some way as a reference, he notes.

Close Monitoring

During the analysis of Bemstour, Check Point researchers found evidence suggesting the Chinese group had closely monitored systems under its control that the NSA had managed to compromise. APT3 members then captured traffic related to those attacks—including information on how the NSA was moving laterally on the compromised networks—and then used that as a reference to reverse-engineer the NSA's exploit.

This allowed them to build an exploit tool that looked and worked remarkably similar to the NSA's exploit, but with less effort and cost. Instead of purchasing from a third party or investing in its own in-house team, APT3 built its malware by collecting and using the NSA's own attack data.

"The main takeaway is that we see evidence for the first time of a nation-state collecting and reusing foreign attack tools to recreate their own," Lechtik says. "We heard of that happening in theory; now we [have] facts that support it."

Lechtik says it's unclear if other Chinese APT groups and state actors have adopted a similar approach. But from their point of view, the approach would make sense. "If they can catch a tool and repurpose it, they cut the costs on finding it themselves," he notes. "If we see they did it once, it would be likely they have done it on other instances and keep doing it today."

The question of whether other countries are doing the same thing is harder to answer, he says. Pulling off something like what APT3 did requires the ability to deliberately monitor domestic systems, collect and analyze a lot of information all with the hope of finding one usable tool.

"Not all nation-states would go down this road in the first place, and indeed a lot don't use exploits, not to mention zero-days, almost at all," he says. "Instead, they try to abuse human weaknesses through phishing, for example—an opportunistic but very cheap alternative. Iran and North Korea are examples for exactly that."

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "8 Ways To Spot an Insider Threat."

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
ifaux
50%
50%
ifaux,
User Rank: Apprentice
9/13/2019 | 2:21:21 PM
Re: Rationale
"Also, the black market is where individuals post code (even on Github)" GitHub; This is true. A surprising amount of resources intended for questionable use. Blatant in some cases, or thinly veiled as "security tools".
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/10/2020
Researcher Finds New Office Macro Attacks for MacOS
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/7/2020
Healthcare Industry Sees Respite From Attacks in First Half of 2020
Robert Lemos, Contributing Writer,  8/13/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: It's a technique known as breaking out of the sandbox kids.
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-20383
PUBLISHED: 2020-08-13
ABBYY network license server in ABBYY FineReader 15 before Release 4 (aka 15.0.112.2130) allows escalation of privileges by local users via manipulations involving files and using symbolic links.
CVE-2020-24348
PUBLISHED: 2020-08-13
njs through 0.4.3, used in NGINX, has an out-of-bounds read in njs_json_stringify_iterator in njs_json.c.
CVE-2020-24349
PUBLISHED: 2020-08-13
njs through 0.4.3, used in NGINX, allows control-flow hijack in njs_value_property in njs_value.c. NOTE: the vendor considers the issue to be "fluff" in the NGINX use case because there is no remote attack surface.
CVE-2020-7360
PUBLISHED: 2020-08-13
An Uncontrolled Search Path Element (CWE-427) vulnerability in SmartControl version 4.3.15 and versions released before April 15, 2020 may allow an authenticated user to escalate privileges by placing a specially crafted DLL file in the search path. This issue was fixed in version 1.0.7, which was r...
CVE-2020-24342
PUBLISHED: 2020-08-13
Lua through 5.4.0 allows a stack redzone cross in luaO_pushvfstring because a protection mechanism wrongly calls luaD_callnoyield twice in a row.