Utilizing Diamond Model methodology for characterizing activity by behaviors attached to victims , we began tracking TRITON S-MAL/TRISIS and immediate enabling activity as a distinct activity group ( collection of behaviors , infrastructure , and victimology ) designated XENOTIME .


Based on information gained from discussion with the initial TRITON S-MAL/TRISIS responders and subsequent work on follow-on activity by this entity , Dragos developed a comprehensive ( public ) picture of adversary activity roughly matching FireEye ’s analysis published in April 2019 , described in various media .


At this stage , we have two similar , parallel constructions of events – the how behind the immediate deployment and execution of TRITON S-MAL/TRISIS – yet dramatically different responses in terms of attribution and labeling .


Since late 2018 , based upon the most-recent posting , FireEye appears to have “ walked back ” the previously-used terminology of TEMP.Veles and instead refers rather cryptically to the “ TRITON actor ” , while Dragos leveraged identified behaviors to consistently refer to an activity group , XENOTIME .


Given that both organizations appear to describe similar ( if not identical ) activity , any reasonable person could ( and should ) ask – why the inconsistency in naming and identification? Aside from the competitive vendor naming landscape ( which I am not a fan of in cases on direct overlap , but which has more to say for itself when different methodologies are employed around similar observations ) , the distinction between FireEye and Dragos ’ approaches with respect to the “ TRITON actor ” comes down to fundamental philosophical differences in methodology .


As wonderfully described in a recent public posting , FireEye adheres to a naming convention based upon extensive data collection and activity comparison , designed to yield the identification of a discrete , identifiable entity responsible for a given collection of activity .


This technique is precise and praiseworthy – yet at the same time , appears so rigorous as to impose limitations on the ability to dynamically adjust and adapt to emerging adversary activity . ( Or for that matter , even categorize otherwise well-known historical actors operating to the present day , such as Turla . ) FireEye ’s methodology may have particular limitations in instances where adversaries ( such as XENOTIME and presumably TEMP.Veles ) rely upon extensive use of publicly-available , commonly-used tools with limited amounts of customization .


In such cases , utilizing purely technical approaches for differentiation ( an issue I lightly touched on in a recent post ) becomes problematic , especially when trying to define attribution to specific , “ who-based ” entities ( such as a Russian research institute ) .


My understanding is FireEye labels entities where definitive attribution is not yet possible with the “ TEMP ” moniker ( hence , TEMP.Veles ) – yet in this case FireEye developed and deployed the label , then appeared to move away from it in subsequent reporting .


Based on the public blog post – which also indicated that FireEye is responding to an intrusion at a second facility featuring the same or similar observations – this is presumably not for lack of evidence , yet the “ downgrade ” occurs all the same .


In comparison , XENOTIME was defined based on principles of infrastructure ( compromised third-party infrastructure and various networks associated with several Russian research institutions ) , capabilities ( publicly- and commercially-available tools with varying levels of customization ) and targeting ( an issue not meant for discussion in this blog ) .


In personally responding to several incidents across multiple industry sectors since early 2018 matching TTPs from the TRITON S-MAL/TRISIS event , these items proved consistent and supported the creation of the XENOTIME activity group .


This naming decision was founded upon the underlying methodology described in the Diamond Model of intrusion analysis .


As such , this decision does not necessarily refer to a specific institution , but rather a collection of observations and behaviors observed across multiple , similarly-situated victims .


Of note , this methodology of naming abstracts away the “ who ” element – XENOTIME may represent a single discrete entity ( such as a Russian research institution ) or several entities working in coordination in a roughly repeatable , similar manner across multiple events .


Ultimately , the epistemic foundation of the behavior-based naming approach makes this irrelevant for tracking ( and labeling for convenience sake ) observations .


Much like the observers watching the shadows of objects cast upon the wall of the cave , these two definitions ( XENOTIME and TEMP.Veles , both presumably referring to “ the TRITON actor ” ) describe the same phenomena , yet at the same time appear different .


This question of perception and accuracy rests upon the underlying epistemic framework and the goal conceived for that framework in defining an adversary : FireEye ’s methodology follows a deductive approach requiring the collection of significant evidence over time to yield a conclusion that will be necessary given the premises ( the totality of evidence suggests APTxx ) ; the Dragos approach instead seeks an inductive approach , where premises may all be true but the conclusion need not necessarily follow from them given changes in premises over time or other observations not contained within the set ( thus , identified behaviors strongly suggests an activity group , defined as X ) .


From an external analysts ’ point of view , the wonder is , which is superior to the other? And my answer for this is : neither is perfect , but both are useful – depending upon your goals and objectives .


But rather than trying to pursue some comparison between the two for identification of superiority ( an approach that will result in unproductive argument and social media warring ) , the point of this post is to highlight the distinctions between these approaches and how – in the case of “ the TRITON actor ” – they result in noticeably different conclusions from similar datasets .


One reason for the distinction may be differences in evidence , as FireEye ’s public reporting notes two distinct events of which they are aware of and have responded to related to “ the TRITON actor ” while Dragos has been engaged several instances – thus , Dragos would possess more evidence to cement the definition of an activity group , while FireEye ’s data collection-centric approach would require far more observations to yield an “ APT ” .


Yet irrespective of this , it is confusing why the previously-declared “ TEMP ” category was walked back as this has led to not small amount of confusion – in both technical and non-technical audiences – as to just what FireEye ’s blog post refers .


Thus respected journalists ( at least by me ) conflate the “ TRITON actor is active at another site ” with “ TRITON malware was identified at another site ” .


In this case , we ’re seeing a definite problem with the overly-conservative naming approach used as it engenders confusion in a significant subset of the intended audience .


While some may dismiss adversary or activity naming as so much marketing , having a distinct label for something allows for clearer communication and more accurate discussion .


Furthermore , conflating adversaries with tools , since tools can be repurposed or used by other entities than those first observed deploying them , leads to further potential confusion as the “ X actor ” is quickly compressed in the minds of some to refer to any and all instantiations of tool “ X ” .


Overall , the discussion above may appear so much splitting of hairs or determining how many angels can dance on the head of a pin – yet given the communicative impacts behind different naming and labeling conventions , this exploration seems not merely useful but necessary .


Understanding the “ how ” and “ why ” behind different entity classifications of similar ( or even the same ) activity allows us to move beyond the dismissive approach of “ everyone has their names for marketing purposes ” to a more productive mindset that grasps the fundamental methodologies that ( should ) drive these decisions .


Threat Group 3390 Cyberespionage .


CTU researchers have observed TG-3390 actors using tools that are favored by multiple threat groups :


PlugX — A remote access tool notable for communications that may contain HTTP headers starting with " X- " ( e.g. , " X-Session : 0 " ) .


Its presence on a compromised system allows a threat actor to execute a wide variety of commands , including uploading and downloading files , and spawning a reverse shell .


The malware can be configured to use multiple network protocols to avoid network-based detection .


DLL side loading is often used to maintain persistence on the compromised system .


HttpBrowser ( also known as TokenControl ) — A backdoor notable for HTTPS communications with the HttpBrowser User-Agent .


HttpBrowser 's executable code may be obfuscated through structured exception handling and return-oriented programming .


Its presence on a compromised system allows a threat actor to spawn a reverse shell , upload or download files , and capture keystrokes .


Antivirus detection for HttpBrowser is extremely low and is typically based upon heuristic signatures .


DLL side loading has been used to maintain persistence on the compromised system .


ChinaChopper web shell — A web-based executable script that allows a threat actor to execute commands on the compromised system .


The server-side component provides a simple graphical user interface for threat actors interacting with web shells .


Hunter — A web application scanning tool written by @tojen to identify vulnerabilities in Apache Tomcat , Red Hat JBoss Middleware , and Adobe ColdFusion .


It can also identify open ports , collect web banners , and download secondary files .


The following tools appear to be exclusive to TG-3390 : OwaAuth web shell — A web shell and credential stealer deployed to Microsoft Exchange servers .


It is installed as an ISAPI filter .


Captured credentials are DES encrypted using the password " 12345678 " and are written to the log.txt file in the root directory .


Like the ChinaChopper web shell , the OwaAuth web shell requires a password .


However , the OwaAuth web shell password contains the victim organization's name .


ASPXTool — A modified version of the ASPXSpy web shell .


It is deployed to internally accessible servers running Internet Information Services ( IIS ) .


TG-3390 actors have also used the following publicly available tools :


Windows Credential Editor ( WCE ) — obtains passwords from memory . gsecdump — obtains passwords from memory . winrar — compresses data for Exfiltration . nbtscan — scans NetBIOS name servers .


CTU researchers have not observed TG-3390 actors performing reconnaissance prior to compromising organizations .


As discussed in the Actions on objectives section , the threat actors appear to wait until they have established a foothold .


TG-3390 actors use command and control ( C2 ) domains for extended periods of time but frequently change the domains' IP addresses .


The new IP addresses are typically on the same subnet as the previous ones .


TG-3390 is capable of using a C2 infrastructure that spans multiple networks and registrars .


The most common registrar used by the adversary is HiChina Zhicheng Technology Ltd .


The threat actors have a demonstrated ability to move from one network provider to another , using some infrastructure for extended periods of time and other domains for only a few days .


Seemingly random activity patterns in infrastructure deployment and usage , along with the ability to use a wide variety of geographically diverse infrastructure , help the threat actors avoid detection .


TG-3390 SWCs may be largely geographically independent , but the group's most frequently used C2 registrars and IP net blocks are located in the U.S. Using a U.S. based C2 infrastructure to compromise targets in the U.S. helps TG-3390 actors avoid geo-blocking and geo-flagging measures used in network defense .


The threat actors create PlugX DLL stub loaders that will run only after a specific date .


The compile dates of the samples analyzed by CTU researchers are all later than the hard-coded August 8 , 2013 date , indicating that the code might be reused from previous tools .


The OwaAuth web shell is likely created with a builder , given that the PE compile time of the binary does not change between instances and the configuration fields are padded to a specific size .


The adversaries modify publicly available tools such as ASPXSpy to remove identifying characteristics that network defenders use to identify web shells .


TG-3390 conducts SWCs or sends spearphishing emails with ZIP archive attachments .


The ZIP archives have names relevant to the targets and contain both legitimate files and malware .


One archive sample analyzed by CTU researchers contained a legitimate PDF file , a benign image of interest to targets , and an HttpBrowser installer disguised as an image file .


Both the redirect code on the compromised site and the exploit code appear and disappear , indicating that the adversaries add the code when they want to leverage the SWC and remove the code when it is not in use to limit the visibility of their operations .


The threat actors have evolved to whitelisting IP addresses and only delivering the exploit and payload to specific targets of interest .


CTU researchers have observed TG-3390 compromising a target organization's externally and internally accessible assets , such as an OWA server , and adding redirect code to point internal users to an external website that hosts an exploit and delivers malware .


TG-3390 actors have used Java exploits in their SWCs .


In particular , the threat actors have exploited CVE-2011-3544 , a vulnerability in the Java Runtime Environment , to deliver the HttpBrowser backdoor ; and CVE-2010-0738 , a vulnerability in JBoss , to compromise internally and externally accessible assets used to redirect users' web browsers to exploit code .


In activity analyzed by CTU researchers , TG-3390 executed the Hunter web application scanning tool against a target server running IIS .


Hunter queried the following URIs in a specific order to determine if the associated software configurations are insecure .


TG-3390 uses DLL side loading , a technique that involves running a legitimate , typically digitally signed , program that loads a malicious DLL .


CTU researchers have observed the threat actors employing legitimate Kaspersky antivirus variants in analyzed samples .


The DLL acts as a stub loader , which loads and executes the shell code .


The adversaries have used this technique to allow PlugX and HttpBrowser to persist on a system .


Note : DLL side loading is a prevalent persistence technique that is used to launch a multitude of backdoors .


The challenge is detecting known good software loading and running malware .


As security controls have improved , DLL side loading has evolved to load a payload stored in a different directory or from a registry value .


In other cases , threat actors placed web shells on externally accessible servers , sometimes behind a reverse proxy , to execute commands on the compromised system .


TG-3390 actors have deployed the OwaAuth web shell to Exchange servers , disguising it as an ISAPI filter .


The IIS w3wp.exe process loads the malicious DLL , which CTU researchers have observed in the Program Files\Microsoft\Exchange Server\ClientAccess\Owa\Bin directory .


To traverse the firewall , C2 traffic for most TG-3390 tools occurs over ports 53 , 80 , and 443 .


The PlugX malware can be configured to use HTTP , DNS , raw TCP , or UDP to avoid network-based detection .


In one sample analyzed by CTU researchers , PlugX was configured with hard-coded user credentials to bypass a proxy that required authentication .


Newer HttpBrowser versions use SSL with self-signed certificates to encrypt network communications .


TG-3390 actors frequently change the C2 domain's A record to point to the loopback IP address 127.0.0.1 , which is a variation of a technique known as " parking " .


Other variations of parking point the IP address to Google 's recursive name server 8.8.8.8 , an address belonging to Confluence , or to other non-routable addresses .


When the adversaries' operations are live , they modify the record again to point the C2 domain to an IP address they can access .


CTU researchers have discovered numerous details about TG-3390 operations , including how the adversaries explore a network , move laterally , and exfiltrate data .


After compromising an initial victim's system ( patient 0 ) , the threat actors use the Baidu search engine to search for the victim's organization name .


They then identify the Exchange server and attempt to install the OwaAuth web shell .


If the OwaAuth web shell is ineffective because the victim uses two-factor authentication for webmail , the adversaries identify other externally accessible servers and deploy ChinaChopper web shells .


Within six hours of entering the environment , the threat actors compromised multiple systems and stole credentials for the entire domain .


The threat actors use the Hunter and nbtscan tools , sometimes renamed , to conduct network reconnaissance for vulnerable servers and online systems .


TG-3390 actors favor At.exe to create scheduled tasks for executing commands on remote systems .


Over a few days' span , the threat actors install remote access tools on additional systems based upon the results of the network reconnaissance .


They use At.exe to schedule tasks to run self-extracting RAR archives , which install either HttpBrowser or PlugX .


CTU researchers observed the threat actors collecting Cisco VPN profiles to use when accessing the victim's network via VPN .


To facilitate lateral movement , the adversaries deploy ASPXTool web shells to internally accessible systems running IIS .


CTU researchers have observed the threat actors encrypting data using the password " admin-windows2014 " and splitting the RAR archives into parts in the recycler directory , with the same name as the uncompressed data .


The number at the end of the password corresponds to the year of the intrusion .


For example , the password " admin-windows2014 " shown in Figure 14 was changed to "admin-windows2015" for TG-3390 intrusions conducted in 2015 .


CTU researchers have observed TG-3390 actors staging RAR archives , renamed with a .zip file extension , on externally accessible web servers .


The adversaries then issue HTTP GET requests , sometimes with the User-Agent MINIXL , to exfiltrate the archive parts from the victim's network .


Successfully evicting TG-3390 from an environment requires a coordinated plan to remove all access points , including remote access tools and web shells .


Within weeks of eviction , the threat actors attempt to access their ChinaChopper web shells from previously used IP addresses .


Finding the web shells inaccessible , the adversaries search google.co.jp for remote access solutions .


CTU researchers discovered the threat actors searching for " [company] login , " which directed them to the landing page for remote access .


TG-3390 attempts to reenter the environment by identifying accounts that do not require two-factor authentication for remote access solutions , and then brute forcing usernames and passwords .


After reestablishing access , the adversaries download tools such as gsecudmp and WCE that are staged temporarily on websites that TG-3390 previously compromised but never used .


CTU researchers believe legitimate websites are used to host tools because web proxies categorize the sites as benign .


TG-3390 actors keep track of and leverage existing ASPXTool web shells in their operations , preferring to issue commands via an internally accessible web shell rather than HttpBrowser or PlugX .


After reentering an environment , the threat actors focus on obtaining the active directory contents .


TG-3390 is known for compromising organizations via SWCs and moving quickly to install backdoors on Exchange servers .


Despite the group's proficiency , there are still many opportunities to detect and disrupt its operation by studying its modus operandi .


The threat actors work to overcome existing security controls , or those put in place during an engagement , to complete their mission of exfiltrating intellectual property .


Due to TG-3390 's determination , organizations should formulate a solid eviction plan before engaging with the threat actors to prevent them from reentering the network .