This process enables the operators to obfuscate the configured C2 servers from automated sandbox runs or disclosure in public file scanning services.


A newly identified utility dubbed FJORDOHELPER can update FOCUSFJORD configurations and completely remove FOCUSFJORD from the system.

UNC215 Spotlight on a Chinese Espionage Campaign in Israel


The tool can be deployed and executed remotely to delete any remaining FOCUSFJORD forensic evidence, including files on disk, configuration data encrypted in the registry, and related services and registry keys used for persistence.


Exploiting Trust Relationships UNC215 leveraged trusted third parties in a 2019 operation targeting an Israeli government network.


As illustrated in Figure 2, the operators were able to access their primary target via RDP connections from a trusted third party using stolen credentials and used this access to deploy and remotely execute FOCUSFJORD on their primary target.


Figure 2: Two FOCUSFJORD samples configured to proxy C2 traffic Concealing C2 Infrastructure UNC215 made technical modifications to their tools to limit outbound network traffic and used other victim networks to proxy their C2 instructions, likely to minimize the risk of detection and blend in with normal network traffic.


The following are examples of HYPERBRO and FOCUSFJORD samples capable of acting as proxies to relay communications to their C2 servers.


We do not have enough context about the following samples to attribute all of them to UNC215, though they are representative of activity we have seen from the group.


HYPERBRO samples MD5:


0ec4d0a477ba21bda9a96d8f360a6848 and MD5: 04dece2662f648f619d9c0377a7ba7c0 have embedded configurations of internal IP addresses (192.168.1.237 and 192.168.4.26 respectively) as C2 servers.


If they receive a command with an IP address and port, they will connect and relay the command.


FOCUSFJORD sample MD5: e3e1b386cdc5f4bb2ba419eb69b1b921 has an internal IP address, 192.168.4.197, configured as its C2.


This sample was extracted from MD5: c25e8e4a2d5314ea55afd09845b3e886, which was submitted to a public malware repository in December 2017.


While hunting for FOCUSFJORD samples, we found a sample of a new malware (MD5: 625dd9048e3289f19670896cf5bca7d8) that shares code with FOCUSFJORD, but is distinct.


However, analysis indicates that it only contains functions to relay communications between another FOCUSFJORD instance and a C2 server (Figure 2, Network A).


We suspect this type of malware was used in the aforementioned operation.


The actors stripped out unnecessary FOCUSFJORD capabilities, possibly to reduce the likelihood it would be detected by security controls.


Figure 3 contains the data structure as it is being sent from a FOCUSFJORD sample configured to communicate with another FOCUSFJORD victim.


Figure 3: Two FOCUSFJORD samples configured to proxy C2 traffic FOCUSFJORD Changes We have observed numerous variants of the FOCUSFJORD malware family since 2017.


The authors have added new communications protocols, an updated loading mechanism, and expanded the number of supported configurations in newer versions.


Version numbers indicate that the malware undergoes frequent changes and maybe supported by a team of developers.


Many of these variants contain or remove functionality depending on the operator’s unique requirements at the time, which may suggest that multiple operators have access to the source code or a builder, or that a close relationship exists between the developers and operators.


FOCUSFJORD samples can be configured with up to 13 unique registry values which allow operators to control and organize compromised hosts.


In addition to specifying details related to the loading and persistence mechanisms and C2 communications, there are two keys which allow the operator to add additional context about the victim: Registry key 12 is the “group” name.


When a new FOCUSFJORD sample is first executed and writes its configuration to registry, this value is set to “default” and is later manually changed by the actor, usually to the victim’s domain name or organization name.


Registry key 13 could be interpreted as the “console” name, although we do not fully understand how the identifier is used by the operators.


We have observed the values “galway”, “iceland”, “helen”, and “idapro”.


It is not clear how or if UNC215 uses these configuration parameters to organize and track large numbers of compromised hosts.


We observed different console values within the same network, identical console values using different C2 addresses, and identical console values targeting different countries.


Some FOCUSFJORD samples from 2018 and 2020 use the same console values despite the significant gap in time (See Table 1).


The NCC Group discussed these configurations in a 2018 report and released a decoding tool.


Trendmicro noted changes to supported configurations in FOCUSFJORD, dubbed SysUpdate, in their 2020 and 2021 reports following public disclosures.


This suggests that operators using FOCUSFJORD are sensitive to security vendor reports and will update the code to avoid detection and exposure.


Registry Key 13 FOCUSFJORD MD5 Hash Related C2 Suspected Target helen 3d95e1c94bd528909308b198f3d47620 139.59.81.253 Israel helen


f335b241652cb7f7e736202f14eb48e9 139.59.81.253 Israel helen a0b2193362152053671dbe5033771758 139.59.81.253 Israel helen


6a9a4da3f7b2075984f79f67e4eb2f28 139.59.81.253 Kazakhstan helen a19370b97fe64ca6a0c202524af35a30 159.89.168.83 Iran helen 3c1981991cce3b329902288bb2354728 103.59.144.183 Unknown iceland 26d079e3afb08af0ac4c6d92fd221e71 178.79.177.69 UAE iceland 19c46d01685c463f21ef200e81cb1cf1 138.68.154.133 UAE iceland 28ce8dbdd2b7dfd123cebbfff263882c 138.68.154.133 Unknown iceland a78c53351e23d3f84267e67bbca6cf07 206.189.123.156 Israel (Gov),


UAE iceland a78c53351e23d3f84267e67bbca6cf07 206.189.123.156 Israel (IT) idapro a78c53351e23d3f84267e67bbca6cf07 206.189.123.156 Israel (IT) galway 04c51909fc65304d907b7cb6c92572cd


159.65.80.157 Unknown galway 0e061265c0b5998088443628c03188f0 159.65.80.157


Unknown galway 09ffc31a432f646ebcec59d32f286317


159.65.80.157 Unknown galway 6ca8993b341bd90a730faef1fb73958b


128.199.44.86 Unknown Helen * Unknown 46.101.255.16 Iran Helen * Unknown 178.79.143.78 Iran Idapro * Unknown 138.68.154.133 Iran Table 1: FOCUSFJORD comparison (note: the * entries are from public reporting and have not been verified by Mandiant) False Flags Artifacts in UNC215 campaigns often contain foreign language strings that do not match the country being targeted and may be intended to mislead an analyst examining the malware.


Additionally, on at least three occasions, UNC215 employed a custom tool associated with Iranian actors whose source code was leaked.


In several cases, we identified FOCUSFJORD samples with registry key names in regional languages.


The registry key names are hardcoded into every FOCUSFJORD sample, as the malware needs to read and decrypt those registry key values for proper execution.


FOCUSFJORD samples (MD5: d13311df4e48a47706b4352995d67ab0 and MD5: 26d079e3afb08af0ac4c6d92fd221e71) observed on Israeli and UAE networks, and a memory dump (MD5: d875858dbd84b420a2027ef5d6e3a512) submitted to a public malware repository by a likely Uzbekistan financial organization are configured with registry keys in Farsi.


Linguistic analysis suggests that these terms were auto translated as they are not commonly used by native Farsi speakers.


Another FOCUSFJORD sample uploaded from Uzbekistan (MD5: ac431261b8852286d99673fddba38a50) contains a configuration with registry key names in Hindi.


Notably, this variant also contains an error message string in Arabic ('ضائع' – which translates to: lost or missing).


In April 2019, UNC215 deployed the SEASHARPEE web shell against financial and high-tech organizations in the Middle East and Asia.


The SEASHARPEE web shell was developed and used by Iranian APT actors until the code was leaked online in the telegram channel Lab Dookhtegan a few weeks earlier in March 2019.


Around this time, the Turkish-language file Sosyal Güvenlik Reformu-Not-3.doc "Social Security Reform - Note - 3.doc" (MD5: 6930bd66a11e30dee1ef4f57287b1318) was distributed to a suspected Turkish government entity based on data from an open-source malware repository.


The document contains "C:\Users\Iran" paths that were likely included to obfuscate the source of the activity.


The use of Farsi strings, filepaths containing /Iran/, and web shells publicly associated with Iranian APT groups may have been intended to mislead analysts and suggest an attribution to Iran.


Notably, in 2019 the government of Iran accused APT27 of attacking its government networks and released a detection and removal tool for HYPERBRO malware.


Tradecraft Mistakes While UNC215 prioritizes evading detection within a compromised network, Mandiant identified several examples of code, C2 infrastructure, and certificate reuse indicating that UNC215 operators are less concerned about defenders’ ability to track and detect UNC215 activity.


In several instances, UNC215 used the same exact file against multiple victims and frequently shared infrastructure across victims.


This lack of compartmentalization is not uncommon, but does show that UNC215 is relatively less concerned about the ability for their compromises to be linked to each other.


C2 servers used by UNC215 frequently reuse the same SSL certificate, as described in Team Cymru’s research in 2020.


On one network, between April 2019 and April 2020, an operator repeatedly and infrequently revisited a compromised network whenever an Endpoint Detection and Response (EDR) tool detected or quarantined tools like HYPERBRO and Mimikatz.


After several months of repeated detections, UNC215 deployed an updated version of HYPERBRO and a tool called “anti.exe” to stop Windows Update service and terminate EDR and Antivirus related services.


Attribution Mandiant attributes this campaign to Chinese espionage operators which we track as UNC215 a Chinese espionage operation that has been suspected of targeting organizations around the world since at least 2014.


We have low confidence that UNC215 is associated with APT27.


UNC215 has compromised organizations in the government, technology, telecommunications, defense, finance, entertainment, and health care sectors.


The group targets data and organizations which are of great interest to Beijing's financial, diplomatic, and strategic objectives.


Outlook and Implications


The activity detailed in this post demonstrates China’s consistent strategic interest in the Middle East.


This cyber espionage activity is happening against the backdrop of China’s multi-billion-dollar investments related to the Belt and Road Initiative (BRI) and its interest in Israeli’s robust technology sector.


Chinese companies have invested billions of dollars into Israeli technology startups, partnering or acquiring companies in strategic industries like semi-conductors and artificial intelligence.


As China’s BRI moves westward, its most important construction projects in Israel are the railway between Eilat and Ashdod, a private port at Ashdod, and the port of Haifa.


China has conducted numerous intrusion campaigns along the BRI route to monitor potential obstructions—political, economic, and security—and we anticipate that UNC215 will continue targeting governments and organizations involved in these critical infrastructure projects in Israel and the broader Middle East in the near- and mid-term. MITRE ATT&CK Techniques ID Technique T1003.001 OS Credential Dumping: LSASS Memory T1007 System Service Discovery T1010 Application Window Discovery T1012 Query Registry T1016 System Network Configuration Discovery T1021.001 Remote Services: Remote Desktop Protocol T1027 Obfuscated Files or Information T1033


System Owner/User Discovery T1055 Process Injection T1055.003 Process Injection: Thread Execution Hijacking T1055.012 Process Injection: Process Hollowing T1056.001 Input Capture: Keylogging T1057 Process Discovery T1059.001 Command and Scripting Interpreter:


PowerShell T1059.003 Command and Scripting Interpreter: Windows Command Shell T1070.004 Indicator Removal on Host: File Deletion T1070.006 Indicator Removal on Host: Timestomp T1071.001 Application Layer Protocol: Web Protocols T1078 Valid Accounts T1082 System Information Discovery T1083 File and Directory Discovery T1087 Account Discovery T1090 Proxy T1095 Non-Application Layer Protocol T1098 Account Manipulation T1105


Ingress Tool Transfer T1112


Modify Registry T1113 Screen Capture T1115 Clipboard Data T1133 External Remote Services T1134 Access Token Manipulation T1140


Deobfuscate/Decode Files or Information T1190


Exploit Public-Facing Application T1199 Trusted Relationship T1202 Indirect Command Execution T1213 Data from Information Repositories T1482 Domain Trust Discovery T1489


Service Stop T1497 Virtualization/Sandbox Evasion T1497.001 Virtualization/Sandbox Evasion: System Checks T1505.003 Server Software Component: Web Shell T1518 Software Discovery T1543.003 Create or Modify System Process: Windows Service T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder T1553.002 Subvert Trust Controls: Code Signing T1559.002 Inter-Process Communication: Dynamic Data Exchange T1560


Archive Collected Data T1564.003


Hide Artifacts: Hidden Window T1569.002 System Services: Service Execution T1573.002 Encrypted Channel:


Asymmetric Cryptography T1574.002 Hijack Execution Flow: DLL Side-Loading T1583.003 Acquire Infrastructure: Virtual Private Server T1588.003 Obtain Capabilities: Code Signing Certificates T1608.003 Stage Capabilities: Install Digital Certificate Indicators of Compromise


The following indicators have been seen in use with the noted malware families, but not all have been confirmed to be used by UNC215. Type Value Description IP 85.204.74.143 HYPERBRO C2 IP 103.79.78.48 HYPERBRO C2 IP 89.35.178.105 HYPERBRO C2 IP 47.75.49.32 HYPERBRO C2 IP 139.59.81.253


FOCUSFJORD C2 IP 34.65.151.250 FOCUSFJORD C2 IP 159.89.168.83 FOCUSFJORD C2 IP 103.59.144.183


FOCUSFJORD C2 IP 141.164.52.232


FOCUSFJORD C2 Detecting the Techniques FireEye detects this activity across our platforms.


Platform(s) Detection Name Network Security Email Security Detection On Demand Malware Analysis File Protect Backdoor.


FEC3 FE_APT_Backdoor_Win32_HYPERBRO_1 FE_Downloader_Win32_FOCUSFJORD_2 FE_Trojan_Raw32_SILKWRAP_1 Trojan.


FEC3 FE_Trojan_Raw32_SILKWRAP_1 33341691_APT.Downloader.


Win.


FOCUSFJORD Trojan.Win32.DllHijack.


FEC3 FE_Trojan_Raw32_SILKWRAP_1 FE_Autopatt_Win_FOCUSFJORD Trojan.


Generic FE_Tool_Win_Generic_3 FE_Tool_Win32_Generic_3 FE_Trojan_Win_Generic_154 FE_Trojan_Win32_Generic_403 FE_Trojan_Win_Generic_155 FE_Trojan_Win64_Generic_54 FE_APT_Backdoor_Win32_HYPERBRO_2 FE_Trojan_Win32_Generic_404 FE_Trojan_Win32_Generic_406 Suspicious File Config Suspicious Regkey Added Suspicious Process Launch Activity Suspicious Codeinjection Activity Suspicious Process Delete Activity Suspicious Process Hijacking Activity Suspicious Process Self Deletion Activity Endpoint Security Generic.mg.a0b2193362152053 Generic.mg.26d079e3afb08af0 Generic.mg.28ce8dbdd2b7dfd1 Generic.mg.04c51909fc65304d Generic.mg.0e061265c0b59980 Generic.mg.09ffc31a432f646e Generic.mg.6ca8993b341bd90a Generic.mg.0ec4d0a477ba21bd Generic.mg.04dece2662f648f6 Trojan.


GenericKD.43427954 Gen:Variant.


Ursu.933105 Trojan.GenericKD.32762213 Trojan.GenericKD.34854595 Gen:Variant.


Ursu.256631 Gen:Variant.Doina.16603 Gen:Variant.


Helix 1.1.2927.fireeye_intel_hit_ip 1.1.2928.fireeye_intel_hit_ip 1.1.2929.fireeye_intel_hit_ip 1.1.2930.fireeye_intel_hit_ip 1.1.2947.fireeye_intel_hit_hash 1.1.2948.fireeye_intel_hit_hash 1.1.2949.fireeye_intel_hit_hash 1.1.2950.fireeye_intel_hit_hash 1.1.1404.windows_methodology_unusual_web_server_child_process 1.1.3506.windows_methodology_adfind 1.1.1650.windows_methodology_mimikatz_args 1.1.1651.antivirus_methodology_mimikatz 1.1.1652.windows_methodology_invokemimikatz_powershell_artifacts


Our previous report on Cobalt Strike focused on the most frequently used capabilities that we had observed.


In this report, we will focus on the network traffic it produced, and provide some easy wins defenders can be on the look out for to detect beaconing activity.


We cover topics such as domain fronting, SOCKS proxy, C2 traffic, Sigma rules, JARM, JA3/S, RITA & more.


As with our previous article, we will highlight the common ways we see threat actors using Cobalt Strike.


Big shout-out to @Kostastsale for helping put this Part 2 together!


Also thanks to @svch0st, @pigerlin, and @0xtornado for reviewing this report.


Even though network monitoring and detection capabilities do not come easy for many organizations, they can generally offer a high return on investment if implemented correctly.


Malware has to contact its C2 server if it is to receive further instructions.


This article will demonstrate how to detect this communication before threat actors accomplish their objectives.


There are a couple of factors that we can utilize to fingerprint any suspicious traffic and subsequent infrastructure.


Before we get into that part, we should first discuss what makes Cobalt Strike so versatile.


Cobalt Strike’s versatility comes from the ability to change the indicators with each payload.


This is made possible thanks to Malleable C2 profiles.


Our other post touched on Malleable C2 profiles and how threat actors use them; however, that was just some of their many applications.


Below you can find information related to some of the most important fields that could throw off an analyst while investigating a Cobalt Strike network communication:


The reference profile below is taken from Raphael Mudge’s GitHub repository.


###Global Options### set sample_name "whatever.profile"; set sleeptime "0"; <================ # Decimal number to indicate the time the beacon will sleep for between communications in milliseconds set jitter "25"; <================ # A number that indicates the percentage of a random sleep time that beacon will introduce to its C2 comm set useragent "<string>"; <================ # Custom user agent of your choice set data_jitter "35"; <================ # Represents the value bytes variable that would instruct Cobalt Strike to send a random string on http-get/post to match the bytes value.


set headers_remove "<header to remove>"; <================ # Specifying headers to be removed in a comma separated manner.


####### Not much explanation is needed here, you can change the certificate information to your heart's content.


####### https-certificate { set C "US"; set CN "whatever.com"; set L "California"; set O "whatever LLC.


"; set OU "local.org"; set ST "CA"; set validity "365"; } ###HTTP-Config Block### http-config { set headers "<headers to include>"; <================ # Specifying the headers that you want to include. header "<name of the header(s)>"; <================ # Specifying the name of the header that will store the data that are transmitted to the C2 server set trust_x_forwarded_for "<true OR false>"; <================ # If the C2 server is behind a redirector, this option would allow to forward the traffic to the correct destination set block_useragents "<user agents>"; <================ # User agents that C2 server will block and show a 404 response set allow_useragents "<user agents>" <================ # Opposite of the above } ###HTTP-GET Block.


This function and all of its fields could also exist and be customized for the HTTP-POST Block (Server communication)### http-get { set uri "/<URI string>"; <================ # Specifying the URI to reference in bidirectional communication from client and server set verb "POST"; <================ # Setting the verb when requesting available tasks from the C2 server.


client { header "Host" "whatever.com"; <================ # Setting the header specific to client communication with the C2.


header "Connection" "close"; ### Metadata corresponds to the information that the beacon is sending to the C2 server about itself.


The operators may choose to enable additional fields that will include data on the C2 communication.


You can mix and match fields below: metadata { #base64; <================ # Base64 encoded string base64url; <================ # URL safe Base64 encoded string #mask; <================ # Encrypting and encoding the data with XOR mask and random key #netbios; <================ # Encoding data as netbios in lower case #netbiosu; <================ # Another variation of netbios encoding #prepend "TEST123"; <================ # Choosing a string to prepend to the transmitted data append ".php"; <================ # Choosing a string to append ### Termination statements: This statement tells Beacon and its server wherein the transaction to store the transformed data.


You may choose one of these termination statement methods.


parameter "file"; <================ # Adding a parameter to the URI.


#header "Cookie"; <================ # Adding a specific string within a specific header.


#uri-append; <================ # Adding a specific string in the URI.


#print; } parameter "test1" "t We added comments to the profile above to explain the numerous fields operators can change to customize the profile to their needs.


All these different fields provide control and flexibility over the indicators of the C2 channel.


Many free, open-source randomizer scripts exist to create a unique profile such as Random C2 Profile Generator by @joevest, Malleable-C2-Randomizer by @bluscreenofjeff, and C2concealer by @FortyNorthSec.


Below are some of the Cobalt Strike C2 servers that we observed during intrusions.


On the right column, we show the URLs that the Cobalt Strike payloads were configured to query.


A trained eye could spot some of the Malleable profiles that exist on freely available resources such as Raphael Mudge’s list on his GitHub page.


Another example is the “jquery-3.3.1.min.js” which is associated with this malleable C2 profile as we observed in four intrusions.


+----------------------+-----------------------+ | C2 Server | URI queried |


+----------------------+-----------------------+ | gawocag.com | /nd


| | 190.114.254.116 | /push | | 190.114.254.116 | /__utm.gif | | kaslose.com | /jquery-3.3.1.min.js | | yawero.com | /skin.js | | sazoya.com | /skin.js | | 192.198.86.130 | /skin.js | | 162.244.83.216 | /jquery-3.3.1.min.js | | sammitng.com | /jquery-3.3.1.min.js | | 23.19.227.147 | /styles.html


| | securityupdateav.com | /tab_shop_active.html


| | 108.62.118.247 | /as


| | windowsupdatesc.com | /as | | 212.114.52.180 | /copyright.css | | defenderupdateav.com | /default.css | | onlineworkercz[.]com | /kj | | checkauj.com | /jquery-3.3.1.min.js


| +----------------------+-----------------------+ A deep dive into all available fields can be found on this post from @ZephrFish.


He also includes other fields related to post-exploitation beacon configuration along with network communication-related fields.


Another great resource is this article released by SpecterOps.


Domain Fronting Domain fronting is another method for concealing communication between the endpoint and the command and control servers.


The main purpose of domain fronting is to connect to a restricted host while pretending to communicate with an allowed host.


It essentially masks your traffic to a certain website by masquerading it as a different domain.


This technique is possible thanks to Content Delivery Networks (CDNs).


Domain fronting was mostly used by web services to bypass censorship in several countries that restricted traffic (e.g., China).


In recent years, attackers have started using this technique to hide their malicious infrastructure behind legitimate domains.


Because domain fronting is a complicated topic to grasp, below we have included an image from the official Cobalt Strike page that discusses this technique.


Cobalt Strike made domain fronting possible by allowing the operators to configure related settings via the malleable C2 profiles.


The following prerequisites must be met in order for domain fronting to be possible: Own a domain.


(e.g., infosecppl.store) Pick one of the many web services that provide CDN capabilities.


(e.g., cloudfront.net).


Setup the CDN service to create a new CDN endpoint and redirect traffic to your domain.


(e.g., l33th4x0r.cloudfront.net).


Setup a profile to facilitate domain fronting.


Identify a domain that uses the same CDN to ensure that the traffic will be forwarded to the correct resource.


Step five is where things get interesting.


Attackers can use legitimate domains that are registered under the same CDN provider.


As demonstrated in the screenshot above, all they have to do is include their CDN endpoint domain (created in step three) in the host header of the request.


In that way, the legitimate website will forward the traffic through the CDN to the original destination according to the host header.


In the screenshots below, you can see how the malleable C2 profiles are configured to allow domain fronting using the Fastly and AzureEdge CDNs:


This research paper released by academics from the University of California, Berkeley, is a great introduction to domain fronting.


This paper inspired many researchers to expand the possibilities of this unique way of hiding the final destination server on web traffic.


One of those researchers is Vincent who wrote a great article on domain fronting.


He explains in simple terms how it works.


He also published a Python script to identify possible domains that can be leveraged for domain fronting.


Looking into our reporting, we don’t see many instances of domain fronting.


This is most likely due to the complex process of setting up the necessary infrastructure.


Although, based on the data we have collected regarding malicious infrastructure, domain fronting appears to be used by threat actors.


According to our data from early 2021 up to now, Amazon Cloudfront takes the lead on preferable CDN used by threat actors, by a large margin.


The data above is available via our services.


Reverse Proxy using Cobalt Strike Beacon A technique that we come across often is a reverse proxy.


We see instances where threat actors use their beacon sessions to establish RDP access through a reverse proxy.


Cobalt Strike has the ability to run a SOCKS proxy server on the team server.


This enables the operators to setup a listening port and leverage it to relay traffic to and from the open beacon session.


The screenshot below demonstrates this implementation.


Image credit: cobaltstrike.com Some of the cases we have observed threat actors using reverse proxy are: Diavol Ransomware BazarLoader and the Conti Leaks Snatch Ransomware


In most, of the above cases, the aim of the attackers was to establish a Remote Desktop session.


There are numerous advantages to establishing a RDP session, including the ability to navigate using a graphical environment and easily move laterally once the necessary access has been granted.


Below, we demonstrate how attackers take advantage of this technique using proxychains from the attackers’ kali Linux host.


In the first image, the attackers open a socks listening port, in this case port 8888, on the Cobalt Strike team server.


Creating the listening port (TCP port 8888)


In this second image, we employ proxychains from the attacker’s Kali Linux host to RDP into our target’s environment via the SOCKS server.


We essentially add the team server’s IP address into the proxychains configuration and connect with xfreerdp.


RDP into the target host using reverse proxy Looking into the generated artifacts, we can see that a 4624 type 3 event is created on the target host.


One interesting aspect that we have also mentioned in similar cases from our reporting is that the victim’s hostname is captured in this logon event as well as the source address being 127.0.0.1. Security Event ID 4624 Type 3 shows the attacker’s hostname Once again, the running Cobalt Strike beacon acts as the intermediary to facilitate the Remote Desktop session via reverse proxy.


Inside Cobalt Strike’s


C2 Traffic This section will attempt to illustrate how the different malleable C2 profiles can affect network communication.


In some of the examples below, we simulated the malicious C2 channel to show how different malleable profile configurations can change the observed traffic.


After that, we’ll examine network data associated with lateral movement and the various methods employed by Cobalt Strike operators based on our observations.


HTTP/HTTPS C2 traffic


We will use a slightly modified version of the jquery profile to illustrate how the configuration defines the various fields that make up the C2 connection.


Our previous article presented this jquery profile as one of the most commonly used profiles by threat actors in the intrusions we reported.


As shown above, malleable C2 profiles can generate unique network traffic based on the provided configuration.


A portion of the malleable C2 profile configuration is shown at the bottom half of the screenshot.


At the top half of the screenshot, we show the HTTP communication between the Beacon and the Cobalt Strike server.


The malleable profile determines the content of all parameters used in GET and POST requests.


Because of how simple it is to change these parameters, creating network signatures for proactive defense can be difficult.


Defenders can create signatures for publicly available profiles (see Sigma section below) or profiles extracted and made available thru open-source reporting.


One could search for traffic that matches known patterns (such as jquery or amazon) but the target IP/domain does not match the expected infrastructure.


DNS C2 traffic Cobalt Strike is capable of using DNS as the C2 method.


Operators can choose to configure their server to respond to beacon requests in A, AAAA or TXT records.


This strategy is useful for more covert operations, as the destination host could be a benign DNS server.


Defenders will have to inspect the traffic data and look for suspicious DNS records.


The screenshot below is from the official Cobalt Strike documentation page and shows how DNS communication works between the compromised host and the C2 server.


In the below example, we emulated this technique and configured the Beacon to communicate over DNS and request new tasks using A records.


In the same way, we can configure the Beacon to use TXT or AAAA records for requesting tasks or sending information to the server.


It is worth noting that the default method is the DNS TXT record data channel.


Below is the infrastructure that we used for demonstration purposes: Target Host: 192.168.88.179 Internal DNS server: 192.168.88.2 Cobalt Strike C2 domain: infosecppl.store We instructed the Beacon to execute the command systeminfo on the compromised host.


As you can see from the screenshot below, it took 148 packets containing DNS requests and responses to finish the task and send back the data to the Cobalt Strike Server.


The activity took 5 seconds to complete.


As with HTTP/HTTPS traffic, DNS traffic can be randomized using malleable C2 profiles.


Some of the options that are available to threat actors are as follows:


The above table was taken from Cobalt Strike’s official documentation SMB Beacons Another option for threat actors is to employ SMB beacons, once they have gained access to the network.


SMB beacons open a local port on the target host and listen for incoming communication from a parent beacon.


The communication between the two beacons is possible thanks to named pipes.


The operators can configure the pipename on the client; however, the default pipename starts with “msagent_#” for SMB beacons.


For a list of default pipe names for other services including some custom profiles check out @svch0st’s post here.


SMB beacons are mostly used to make network detection harder and to get access to isolated systems where communication to the internet is prohibited.


Additionally, due to SMB protocol being accessible in most internal networks, it makes for a reliable C2 method.


Operators can also chain beacons and move laterally inside the network.


According to our records, SMB beacons are not frequently used.


However, they’re still a powerful weapon in the hands of skilled operators.


As we do not see SMB beacons used often in our intrusion cases, we took an example case from our lab to demonstrate the effectiveness of this method.


We ran a PowerShell loader on the target host, which loaded a stageless SMB beacon in memory.


In our case, the SMB Beacon is communicating over the network with a parent Beacon using named pipes.


For this example, we chose the named pipe “my_pipes”.


As you can see from the screenshots below, windows event 4688 contains the execution of the PowerShell command.


As explained in our previous Cobalt Strike article, Sysmon events 17 and 18 can log named pipes.


However, Sysmon should be explicitly configured to log named pipes.


A good public Sysmon config that includes named pipes and much more is Olaf‘s Sysmon Moduler.


Below, you can see the named pipe created that we specified on the Cobalt Strike interface when we created the SMB listener.


Furthermore, the SMB Beacon will communicate over port 445 to the main beacon as we described above, which will then send the results to the C2 server.


This is known as chaining beacons.


The below screenshot illustrates the SMB communication between the beacon on the beachhead host and the chained beacon(s).


Another way to describe the communication is a parent/child relationship.


The network traffic shows the target host communicating over SMB with the other compromised host running the parent HTTP Beacon.


Named Pipes are used to facilitate the transition of data.


192.168.38.102 = SMB Beacon 192.168.38.104 = HTTP Parent Beacon Detecting and Analyzing C2 Traffic Thanks to free, open-source tooling, investigating network traffic has become more accessible.


There are specific tools that we use to analyze suspicious network traffic in our intrusion cases.


We believe that no single tool can provide complete detection coverage, but we can get close by combining them.


In the following section, we will look at these tools that could accelerate analysis for defenders.


Sigma We’ll go through a few Sigma rules that can help us detect Cobalt Strike’s network activity.


Cobalt Strike DNS Beaconing is a rule created by Florian Roth which looks at DNS logs to detect the default DNS C2 behavior based on the dns_stager_subhost, put_output and dns_stager_subhost as seen above.


Below is a more generic rule created by @bareiss_patrick which is a good example of detecting suspicious DNS traffic based on a high amount of queries for a single domain.


Another more generic rule created by Daniil Yugoslavskiy uses dns logs to look for 50 or more TXT records from a single source in one minute: Default Cobalt Strike Certificate is a rule written by Bhabesh Raj that uses Zeek logs to detect the default Cobalt Strike certificate.


RDP over Reverse SSH Tunnel WFP by Samir Bousseaden is a rule that can look for suspicious RDP activity using reverse tunneling.


CobaltStrike Malleable Amazon Browsing Traffic Profile by Markus Neis which looks at proxy logs for the Amazon Malleable profile.


Other malleable profile rules include CobaltStrike Malformed UAs in Malleable Profiles, CobaltStrike Malleable (OCSP) Profile, and CobaltStrike Malleable OneDrive Browsing Traffic Profile.


All Sigma rules here are documented towards the bottom of Part 1. Rita Rita stands for Real Intelligence Threat Analytics (RITA), developed by Active Countermeasures.


Rita is a framework for detecting command and control communication.


It takes Zeek logs data and can, in our experience, accurately detect beaconing activity.


One of the great features of Rita is its ease of use and detailed output information in various forms, including CSV and HTML.


One simply can point Rita to the Zeek logs and wait for the results.


The more available data, the more precise the results will be.


Zeek logs can be generated from the PCAP(s).


The screenshot samples below show the results created by Rita based on the traffic we used in the previous sections to demonstrate the jquery malleable C2 profile.


We left the Beacon running for an hour to simulate an actual infection while several other network-unrelated processes ran in the background.


During this hour, we tasked the Beacon with carrying out several commands.


Rita determined that one hour of network data was adequate for identifying the beacon link and assigning it the highest score.


Although, the more data you have, the more accurate the results will be.


Below, we can see the results from one of our recent cases, BazarLoader and the Conti Leaks.


The first three IP addresses relate to the CS servers with which the Beacon communicated.


Rita accurately identified beaconing activity related to Cobalt Strike C2 communication.


Using Rita, we can identify malicious C2 traffic based on multiple variables, including communication frequency, average bytes sent/received, number of connections etc.


As a result, we can detect Cobalt Strike beaconing regardless of the malleable C2 profile utilized or any additional jitter present.


JA3/JA3S JA3 is an open-source project created by John Althouse, Jeff Atkinson and Josh Atkins.


JA3/JA3S can create SSL fingerprints for communication between clients and servers.


The unique signatures can represent several values collected from fields in the Client


Hello packet: - SSL Version - Accepted Ciphers - List of Extensions - Elliptic Curves - Elliptic Curve Formats For more information on how JA3 works, you can visit the official GitHub repository here: https://github.com/salesforce/ja3.


The JA3 tool is used to generate a signature for the client-side beacon connection with the server.


JA3S, on the other hand, is able to generate a server fingerprint.


The combination of the two can produce the most accurate result.


JA3S can capture the full cryptographic communication and combine the JA3 findings to generate the signature.


The downside of this method is that it can produce inaccurate results if the Cobalt Strike is behind redirectors.


We can find many reports that contain the JA3 value that corresponds to the Cobalt Strike fingerprint.


When it comes to Cobalt Strike infrastructure, the known JA3 and JA3s signatures that we are looking for are: JA3 72a589da586844d7f0818ce684948eea a0e9f5d64349fb13191bc781f81f42e1 JA3s b742b407517bac9536a77a7b0fee28e9 ae4edc6faf64d08308082ad26be60767 By using JA3/S signatures, we can discover various malware C2 servers and not just Cobalt Strike.


Salesforce provides a thorough collection of signatures that belong to many different applications here.


Some other example signatures with well known JA3 fingerprints are: Trickbot: 6734f37431670b3ab4292b8f60f29984 AsyncRat: fc54e0d16d9764783542f0146a98b300 Dridex: 51c64c77e60f3980eea90869b68c58a8 JA3 of Python usually hosting Empire or PoshC2: db42e3017c8b6d160751ef3a04f695e7 TOR client: e7d705a3286e19ea42f587b344ee6865 Another very good website to test the JA3 signature against a large database is ja3er.


JARM Similar to JA3/JA3S, JARM has the ability to fingerprint the TLS values of the remote server.


It does this by interacting with the target server sending 10 TLS Client


Hello packets and recording the specific attributes from the replies.


It will then hash the result values and create the final JARM fingerprint.


Unlike JA3/S, JARM is an active way of fingerprinting remote server applications.


John Althouse has created a medium post that accurately conveys the differences between JA3/S and JARM: “JARM actively scans the server and builds a fingerprint of the server application.


Whereas JA3/S is passive, just listening, not reaching out, JARM is active, actively probing the target.


And is able to build a fingerprint of the server application where JA3S could not.”


According to research and further changes on the JAVA TLS version as mentioned below, the JARM fingerprint that corresponds to a default configuration of the Cobalt Strike is: 07d14d16d21d21d00042d41d00041de5fb3038104f457d92ba02e9311512c2 Cobalt Strike is dependent on Java to run both the client graphical user interface (GUI) and the team server.


When we scan a Cobalt Strike server using JARM, the results we get back are dependent on the Java version that is used.


According to Cobalt Strike’s documentation, OpenJDK 11 is the preferred version that needs to be installed by the operators.


This makes it easier to identify a potential Cobalt Strike server, however, defenders should be aware that this outcome alone is prone to false positives.


This is because many other legitimate servers on the internet use this version of Java to operate their web applications.


On April 20th, 2021 Java Disabled TLS 1.0 and TLS 1.1 in favor of TLS 1.2 or above.


Following this change, the JARM fingerprint for Cobalt Strike servers changed: From: 07d14d16d21d21d07c42d41d00041d24a458a375eef0c576d23a7bab9a9fb1


To: 07d14d16d21d21d00042d41d00041de5fb3038104f457d92ba02e9311512c2 This change was highlighted by @bodziurity and @WLesicki in a collaborative effort: Cobalt Strike has a post dedicated to JARM that goes into detail on how JARM works and how the specific hash value is created based on the Java version.


Looking into our reporting for this hash value will return four of our cases.


All these cases involve Cobalt Strike as the post-exploitation method.


To generate a JARM fingerprint against a server, you can run the JARM python tool: python3 jarm.py


[target] -p


[port] While JARM’s offer another tool to help reveal adversary infrastructure they are not an indicator that can be used in isolation.


JARM signatures can be masked, Dagmawi Mulugeta presented at HiTB Amsterdam in 2021 a tool that enables red teams or adversaries to mask the JARM signatures of their infrastructure.


Called JARM Randomizer the tool can be configured as a proxy in front of the Cobalt Strike server to serve up false data to potential internet scanners.


Other JARMs can be found at: https://github.com/cedowens/C2-JARM.


Arkime (Moloch) and JA3/S We included Arkime as it integrates with JA3/JA3S and other plugins to enhance network analysis.


Arkime is a tool that we use a lot to investigate network activity and gather indicators.


It can index network traffic and make events easily searchable.


Arkime is simple to set up and excellent for reviewing traffic.


Arkime makes use of additional analysis tools by including them as plugins.


More on this and other tools in the next report.


All for now That wraps up Cobalt Strike, a Defender’s Guide Part 2.


Would you like to see something specific in Part 3?


Contact us here or on Twitter with suggestions.


Thanks for reading and hope this helps!


Please see the bottom of our first report for more detections & rules.


The post Cobalt Strike, a Defender’s Guide – Part 2 appeared first on The DFIR Report.


Original release date: July 19, 2021 | Last revised: August 20, 2021SummaryThis advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK:registered:) framework, Version 9, and MITRE D3FEND:trade_mark: framework, version 0.9.2-BETA-3.

AA21200B Chinese StateSponsored Cyber Operations Observed TTPs


See the ATT&CK for Enterprise for all referenced threat actor tactics and techniques and the D3FEND framework for referenced defensive tactics and techniques.


The National Security Agency, Cybersecurity and Infrastructure Security Agency (CISA), and Federal Bureau of Investigation (FBI) assess that People’s Republic of China state-sponsored malicious cyber activity is a major threat to U.S. and Allied cyberspace assets.


Chinese state-sponsored cyber actors aggressively target U.S. and allied political, economic, military, educational, and critical infrastructure (CI) personnel and organizations to steal sensitive data, critical and emerging key technologies, intellectual property, and personally identifiable information (PII).


Some target sectors include managed service providers, semiconductor companies, the Defense Industrial Base (DIB), universities, and medical institutions.


These cyber operations support China’s long-term economic and military development objectives.


This Joint Cybersecurity Advisory (CSA) provides information on tactics, techniques, and procedures (TTPs) used by Chinese state-sponsored cyber actors.


This advisory builds on previous NSA, CISA, and FBI reporting to inform federal, state, local, tribal, and territorial (SLTT) government, CI, DIB, and private industry organizations about notable trends and persistent TTPs through collaborative, proactive, and retrospective analysis.


To increase the defensive posture of their critical networks and reduce the risk of Chinese malicious cyber activity, NSA, CISA, and FBI urge government, CI, DIB, and private industry organizations to apply the recommendations listed in the Mitigations section of this advisory and in Appendix A: Chinese State-sponsored Cyber Actors' Observed Procedures.


Note: NSA, CISA, and FBI encourage organization leaders to review CISA Joint Insights: Chinese Malicious Cyber Activity: Threat Overview for Leaders for information on this threat to their organization.


Technical DetailsTrends in Chinese State-Sponsored Cyber Operations NSA, CISA, and FBI have observed increasingly sophisticated Chinese state-sponsored cyber activity targeting U.S. political, economic, military, educational, and CI personnel and organizations.


NSA, CISA, and FBI have identified the following trends in Chinese state-sponsored malicious cyber operations through proactive and retrospective analysis: Acquisition of Infrastructure and Capabilities.


Chinese state-sponsored cyber actors remain agile and cognizant of the information security community’s practices.


These actors take effort to mask their activities by using a revolving series of virtual private servers (VPSs) and common open-source or commercial penetration tools. Exploitation of Public Vulnerabilities.


Chinese state-sponsored cyber actors consistently scan target networks for critical and high vulnerabilities within days of the vulnerability’s public disclosure.


In many cases, these cyber actors seek to exploit vulnerabilities in major applications, such as Pulse Secure, Apache, F5 Big-IP, and Microsoft products.


For information on Common Vulnerabilities and Exposures (CVE) known to be exploited by malicious Chinese state-sponsored cyber actors, see: CISA-FBI Joint CSA AA20-133A: Top 10 Routinely Exploited Vulnerabilities, CISA Activity Alert: AA20-275A: Potential for China Cyber Response to Heightened U.S.-China Tensions, and NSA CSA U/OO/179811-20: Chinese State-Sponsored Actors Exploit Publicly Known Vulnerabilities.


Encrypted Multi-Hop Proxies.


Chinese state-sponsored cyber actors have been routinely observed using a VPS as an encrypted proxy.


The cyber actors use the VPS as well as small office and home office (SOHO) devices as operational nodes to evade detection.


Observed Tactics and Techniques Chinese state-sponsored cyber actors use a full array of tactics and techniques to exploit computer networks of interest worldwide and to acquire sensitive intellectual property, economic, political, and military information.


Appendix B: MITRE ATT&CK Framework lists the tactics and techniques used by Chinese state-sponsored cyber actors.


A downloadable JSON file is also available on the NSA Cybersecurity GitHub page.


Refer to Appendix A: Chinese State-Sponsored Cyber Actors’ Observed Procedures for information on procedures affiliated with these tactics and techniques as well as applicable mitigations.


Figure 1: Example of tactics and techniques used in various cyber operations.


Mitigations NSA, CISA, and FBI urge federal and SLTT government, CI, DIB, and private industry organizations to apply the following recommendations as well as the detection and mitigation recommendations in Appendix A, which are tailored to observed tactics and techniques: Patch systems and equipment promptly and diligently.


Focus on patching critical and high vulnerabilities that allow for remote code execution or denial-of-service on externally facing equipment and CVEs known to be exploited by Chinese state-sponsored cyber actors.


Consider implementing a patch management program that enables a timely and thorough patching cycle.


Note: for more information on CVEs routinely exploited by Chinese state-sponsored cyber actors refer to the resources listed in the Trends in Chinese State-Sponsored Cyber Operations section.


Enhance monitoring of network traffic, email, and endpoint systems.


Review network signatures and indicators for focused activities, monitor for new phishing themes, and adjust email rules accordingly.


Follow the best practices of restricting attachments via email and blocking URLs and domains based upon reputation.


Ensure that log information is aggregated and correlated to enable maximum detection capabilities, with a focus on monitoring for account misuse.


Monitor common ports and protocols for command and control (C2) activity.


SSL/TLS inspection can be used to see the contents of encrypted sessions to look for network-based indicators of malware communication protocols.


Implement and enhance network and endpoint event analysis and detection capabilities to identify initial infections, compromised credentials, and the manipulation of endpoint processes and files.


Use protection capabilities to stop malicious activity.


Implement anti-virus software and other endpoint protection capabilities to automatically detect and prevent malicious files from executing.


Use a network intrusion detection and prevention system to identify and prevent commonly employed adversarial malware and limit nefarious data transfers.


Use a domain reputation service to detect suspicious or malicious domains.


Use strong credentials for service accounts and multi-factor authentication (MFA) for remote access to mitigate an adversary's ability to leverage stolen credentials, but be aware of MFA interception techniques for some MFA implementations.:black_small_square: Resources Refer to us-cert.cisa.gov/china, https://www.ic3.gov/Home/IndustryAlerts, and https://www.nsa.gov/What-We-Do/Cybersecurity/Advisories-Technical-Guidance/ for previous reporting on Chinese state-sponsored malicious cyber activity.


Disclaimer of Endorsement The information and opinions contained in this document are provided "as is" and without any warranties or guarantees.


Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not constitute or imply its endorsement, recommendation, or favoring by the United States Government, and this guidance shall not be used for advertising or product endorsement purposes.


Purpose


This document was developed by NSA, CISA, and FBI in furtherance of their respective cybersecurity missions, including their responsibilities to develop and issue cybersecurity specifications and mitigations.


This information may be shared broadly to reach all appropriate stakeholders.


This document is marked TLP:WHITE.


Disclosure is not limited.


Sources may use TLP:WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release.


Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction.


For more information on the Traffic Light Protocol, see http://www.us-cert.gov/tlp/. Trademark Recognition MITRE and ATT&CK are registered trademarks of The MITRE Corporation.


• D3FEND is a trademark of The MITRE Corporation.


Microsoft, Microsoft Exchange, Office 365, Microsoft Office, OneDrive, Outlook, OWA, PowerShell, Windows Defender, and Windows are registered trademarks of Microsoft Corporation.


Pulse Secure is a registered trademark of Pulse Secure, LLC.


Apache is a registered trademark of Apache Software Foundation.


• F5 and BIG-IP are registered trademarks of F5 Networks.


• Cobalt Strike is a registered trademark of Strategic Cyber LLC.


GitHub is a registered trademark of GitHub, Inc. •


JavaScript is a registered trademark of Oracle Corporation.


Python is a registered trademark of Python Software Foundation.


Unix is a registered trademark of The Open Group.


Linux is a registered trademark of Linus Torvalds.


Dropbox is a registered trademark of Dropbox, Inc. APPENDIX A: Chinese State-Sponsored Cyber Actors’ Observed Procedures Note: D3FEND techniques are based on the Threat Actor Procedure(s) and may not match automated mappings to ATT&CK techniques and sub-techniques.


Tactics: Reconnaissance [TA0043] Table 1: Chinese state-sponsored cyber actors’ Reconnaissance TTPs with detection and mitigation recommendations Threat Actor Technique / Sub-Techniques Threat Actor Procedure(s) Detection and Mitigation Recommendations Defensive Tactics and Techniques


Active Scanning [T1595] Chinese state-sponsored cyber actors have been assessed to perform reconnaissance on Microsoft:registered: 365 (M365), formerly Office:registered: 365, resources with the intent of further gaining information about the networks.


These scans can be automated, through Python:registered: scripts, to locate certain files, paths, or vulnerabilities.


The cyber actors can gain valuable information on the victim network, such as the allocated resources, an organization’s fully qualified domain name, IP address space, and open ports to target or exploit.


Minimize the amount and sensitivity of data available to external parties, for example: Scrub user email addresses and contact lists from public websites, which can be used for social engineering, Share only necessary data and information with third parties, and Monitor and limit third-party access to the network.


Active scanning from cyber actors may be identified by monitoring network traffic for sources associated with botnets, adversaries, and known bad IPs based on threat intelligence.


Detect: Network Traffic Analysis Connection Attempt Analysis


[D3-CAA] Isolate: Network Isolation Inbound Traffic Filtering [D3-ITF] Gather Victim Network Information


[T1590] Tactics: Resource Development [TA0042] Table II:


Chinese state-sponsored cyber actors’ Resource Development TTPs with detection and mitigation recommendations Threat Actor Technique / Sub-Techniques Threat Actor Procedure(s) Detection and Mitigation Recommendations Defensive Tactics and Techniques Acquire Infrastructure [T1583] Chinese state-sponsored cyber actors have been observed using VPSs from cloud service providers that are physically distributed around the world to host malware and function as C2 nodes.


Adversary activities occurring outside the organization’s boundary of control and view makes mitigation difficult.


Organizations can monitor for unexpected network traffic and data flows to and from VPSs and correlate other suspicious activity that may indicate an active threat.


N/A Stage Capabilities [T1608] Obtain Capabilities


[T1588]: Tools [T1588.002] Chinese state-sponsored cyber actors have been observed using Cobalt Strike:registered: and tools from GitHub:registered: on victim networks.


Organizations may be able to identify malicious use of Cobalt Strike by: Examining network traffic using Transport Layer Security (TLS) inspection to identify Cobalt Strike.


Look for human generated vice machine-generated traffic, which will be more uniformly distributed.


Looking for the default Cobalt Strike TLS certificate.


Look at the user agent that generates the TLS traffic for discrepancies that may indicate faked and malicious traffic.


Review the traffic destination domain, which may be malicious and an indicator of compromise.


Look at the packet's HTTP host header.


If it does not match with the destination domain, it may indicate a fake Cobalt Strike header and profile.


Check the Uniform Resource Identifier (URI) of the flow to see if it matches one associated with Cobalt Strike's malleable C2 language.


If discovered, additional recovery and investigation will be required.


N/A Tactics: Initial Access [TA0001] Table III: Chinese state-sponsored cyber actors’ Initial Access TTPs with detection and mitigation recommendations Threat Actor Technique / Sub-Techniques Threat Actor Procedure(s) Detection and Mitigation Recommendations Detection and Mitigation Recommendations Drive By Compromise


[T1189] Chinese state-sponsored cyber actors have been observed gaining access to victim networks through watering hole campaigns of typo-squatted domains.


Ensure all browsers and plugins are kept up to date.


Use modern browsers with security features turned on.


Restrict the use of unneeded websites, block unneeded downloads/attachments, block unneeded JavaScript:registered:, restrict browser extensions, etc. Use adblockers to help prevent malicious code served through advertisements from executing.


Use script blocking extensions to help prevent the execution of unneeded JavaScript, which may be used during exploitation processes.


Use browser sandboxes or remote virtual environments to mitigate browser exploitation.


Use security applications that look for behavior used during exploitation, such as Windows Defender:registered: Exploit Guard (WDEG).


Detect: Identifier Analysis Homoglyph Detection


[D3-HD] URL Analysis [D3-UA] File Analysis Dynamic Analysis [D3-DA] Isolate: Execution Isolation Hardware-based Process Isolation [D3-HBPI] Executable Allowlisting


[D3-EAL] Network Isolation DNS Denylisting [D3-DNSDL] Outbound Traffic Filtering [D3-OTF] Exploit Public-Facing Application [T1190] Chinese state-sponsored cyber actors have exploited known vulnerabilities in Internet-facing systems.[1]


For information on vulnerabilities known to be exploited by Chinese state-sponsored cyber actors, refer to the Trends in Chinese State-Sponsored Cyber Operations section for a list of resources.


Chinese state-sponsored cyber actors have also been observed: Using short-term VPS devices to scan and exploit vulnerable Microsoft Exchange:registered: Outlook Web Access (OWA:registered:) and plant webshells.


Targeting on-premises Identity and Access Management (IdAM) and federation services in hybrid cloud environments to gain access to cloud resources.


Deploying a public proof of concept (POC) exploit targeting a public-facing appliance vulnerability.


Review previously published alerts and advisories from NSA, CISA, and FBI, and diligently patch vulnerable applications known to be exploited by cyber actors.


Refer to the Trends in Chinese State-Sponsored Cyber Operations section for a non-inclusive list of resources.


Additional mitigations include: Consider implementing Web Application Firewalls (WAF), which can prevent exploit traffic from reaching an application.


Segment externally facing servers and services from the rest of the network with a demilitarized zone (DMZ).


Use multi-factor authentication (MFA) with strong factors and require regular re-authentication.


Disable protocols using weak authentication.


Limit access to and between cloud resources with the desired state being a Zero Trust model.


For more information refer to NSA Cybersecurity Information Sheet: [Embracing a Zero Trust Security Model].


When possible, use cloud-based access controls on cloud resources (e.g., cloud service provider (CSP)-managed authentication between virtual machines).


Use automated tools to audit access logs for security concerns.


Where possible, enforce MFA for password resets.


Do not include Application Programing Interface (API) keys in software version control systems where they can be unintentionally leaked. Harden:


Application Hardening [D3-AH]


Platform Hardening Software Update [D3-SU] Detect: File Analysis


[D3-FA] Network Traffic Analysis Client-server Payload Profiling [D3-CSPP] Process Analysis Process Spawn Analysis Process Lineage Analysis [D3-PLA] Isolate: Network Isolation Inbound Traffic Filtering [D3-ITF]


Phishing [T1566]: Spearphishing Attachment [T1566.001] Spearphishing Link


[T1566.002] Chinese state-sponsored cyber actors have been observed conducting spearphishing campaigns.


These email compromise attempts range from generic emails with mass targeted phishing attempts to specifically crafted emails in targeted social engineering lures.


These compromise attempts use the cyber actors’ dynamic collection of VPSs, previously compromised accounts, or other infrastructure in order to encourage engagement from the target audience through domain typo-squatting and masquerading.


These emails may contain a malicious link or files that will provide the cyber actor access to the victim’s device after the user clicks on the malicious link or opens the attachment.


Implement a user training program and simulated spearphishing emails to discourage users from visiting malicious websites or opening malicious attachments and re-enforce the appropriate user responses to spearphishing emails.


Quarantine suspicious files with antivirus solutions.


Use a network intrusion prevention system (IPS) to scan and remove malicious email attachments.


Block uncommon file types in emails that are not needed by general users (.exe, .jar,.vbs)


Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using Sender Policy Framework


[SPF]) and integrity of messages (using Domain Keys Identified Mail


[DKIM]).


Enabling these mechanisms within an organization (through policies such as Domain-based Message Authentication, Reporting, and Conformance


[DMARC]) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation.


Determine if certain websites that can be used for spearphishing are necessary for business operations and consider blocking access if activity cannot be monitored well or if it poses a significant risk.


Prevent users from clicking on malicious links by stripping hyperlinks or implementing "URL defanging" at the Email Security Gateway or other email security tools.


Add external sender banners to emails to alert users that the email came from an external sender.


Harden:


Message Hardening Message Authentication [D3-MAN] Transfer Agent Authentication


[D3-TAAN] Detect: File Analysis Dynamic Analysis


[D3-DA] Identifier Analysis Homoglyph Detection [D3-HD] URL Analysis [D3-UA] Message Analysis Sender MTA Reputation Analysis


[D3-SMRA] Sender Reputation Analysis [D3-SRA] External Remote Services


[T1133] Chinese state-sponsored cyber actors have been observed: Exploiting vulnerable devices immediately after conducting scans for critical zero-day or publicly disclosed vulnerabilities.


The cyber actors used or modified public proof of concept code in order to exploit vulnerable systems.


Targeting Microsoft Exchange offline address book (OAB) virtual directories (VDs).


Exploiting Internet accessible webservers using webshell small code injections against multiple code languages, including net, asp, apsx, php, japx, and cfm.


Note: refer to the references listed above in Exploit Public-Facing Application [T1190] for information on CVEs known to be exploited by malicious Chinese cyber actors.


Note: this technique also applies to Persistence [TA0003].


Many exploits can be mitigated by applying available patches for vulnerabilities (such as CVE-2019-11510, CVE-2019-19781, and CVE-2020-5902) affecting external remote services.


Reset credentials after virtual private network (VPN) devices are upgraded and reconnected to the external network.


Revoke and generate new VPN server keys and certificates (this may require redistributing VPN connection information to users).


Disable Remote Desktop Protocol (RDP) if not required for legitimate business functions.


Restrict VPN traffic to and from managed service providers (MSPs)


using a dedicated VPN connection.


Review and verify all connections between customer systems, service provider systems, and other client enclaves.


Harden: Software Update [D3-SU] Detect: Network Traffic Analysis Connection Attempt Analysis


[D3-CAA] Platform Monitoring [D3-PM] Process Analysis Process Spawn Analysis


[D3-SPA] Process Lineage Analysis [D3-PLA] Valid Accounts


[T1078]: Default Accounts [T1078.001] Domain Accounts [T1078.002] Chinese state-sponsored cyber actors have been observed: gaining credential access into victim networks by using legitimate, but compromised credentials to access OWA servers, corporate login portals, and victim networks.


Note: this technique also applies to Persistence


[TA0003], Privilege Escalation [TA0004], and Defense Evasion [TA0005].


Adhere to best practices for password and permission management.


Ensure that MSP accounts are not assigned to administrator groups and restrict those accounts to only systems they manage Do not store credentials or sensitive data in plaintext.


Change all default usernames and passwords.


Routinely update and secure applications using Secure Shell (SSH).


Update SSH keys regularly and keep private keys secure.


Routinely audit privileged accounts to identify malicious use. Harden: Credential Hardening Multi-factor Authentication [D3-MFA] Detect: User Behavior Analysis


[D3-UBA] Authentication Event Thresholding [D3-ANET] Job Function Access Pattern Analysis


[D3-JFAPA] Tactics: Execution


[TA0002] Table IV: Chinese state-sponsored cyber actors’ Execution TTPs with detection and mitigation recommendations Threat Actor Technique / Sub-Techniques Threat Actor Procedure(s) Detection and Mitigation Recommendations Defensive Tactics and Techniques Command and Scripting Interpreter


]: PowerShell:registered: [T1059.001] Windows:registered: Command Shell [T1059.003] Unix:registered: Shell


[T1059.004] Python


[T1059.006] JavaScript [T1059.007] Network Device CLI [T1059.008] Chinese state-sponsored cyber actors have been observed: Using cmd.exe, JavaScript/Jscript Interpreter, and network device command line interpreters (CLI).


Using PowerShell to conduct reconnaissance, enumeration, and discovery of the victim network.


Employing Python scripts to exploit vulnerable servers.


Using a UNIX shell in order to conduct discovery, enumeration, and lateral movement on Linux:registered: servers in the victim network.


PowerShell Turn on PowerShell logging.


(Note: this works better in newer versions of PowerShell.


NSA, CISA, and FBI recommend using version 5 or higher.)


Push Powershell logs into a security information and event management (SIEM) tool.


Monitor for suspicious behavior and commands.


Regularly evaluate and update blocklists and allowlists.


Use an antivirus program, which may stop malicious code execution that cyber actors attempt to execute via PowerShell.


Remove PowerShell if it is not necessary for operations.


Restrict which commands can be used.


Windows Command Shell Restrict use to administrator, developer, or power user systems.


Consider its use suspicious and investigate, especially if average users run scripts.


Investigate scripts running out of cycle from patching or other administrator functions if scripts are not commonly used on a system, but enabled. Monitor for and investigate other unusual or suspicious scripting behavior.


Unix Use application controls to prevent execution.


Monitor for and investigate unusual scripting behavior.


Use of the Unix shell may be common on administrator, developer, or power user systems.


In this scenario, normal users running scripts should be considered suspicious.


If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions should be considered suspicious.


Python Audit inventory systems for unauthorized Python installations.


Blocklist Python where not required.


Prevent users from installing Python where not required.


JavaScript Turn off or restrict access to unneeded scripting components.


Blocklist scripting where appropriate.


For malicious code served up through ads, adblockers can help prevent that code from executing.


Network Device Command Line Interface (CLI) Use TACACS+ to keep control over which commands administrators are permitted to use through the configuration of authentication and command authorization.


Use an authentication, authorization, and accounting (AAA) systems to limit actions administrators can perform and provide a history of user actions to detect unauthorized use and abuse.


Ensure least privilege principles are applied to user accounts and groups.


Platform Hardening [D3-PH] Detect: Process Analysis Script Execution Analysis


[D3-SEA] Isolate: Execution Isolation Executable Allowlisting


[D3-EAL] Scheduled Task/Job [T1053] Cron


[T1053.003] Scheduled Task


[T1053.005] Chinese state-sponsored cyber actors have been observed using Cobalt Strike, webshells, or command line interface tools, such as schtask or crontab to create and schedule tasks that enumerate victim devices and networks.


Note: this technique also applies to Persistence [TA0003] and Privilege Escalation [TA0004].


• Monitor scheduled task creation from common utilities using command-line invocation and compare for any changes that do not correlate with known software, patch cycles, or other administrative activity.


• Configure event logging for scheduled task creation and monitor process execution from svchost.exe (Windows 10) and Windows Task Scheduler (Older version of Windows) to look for changes in %systemroot%\System32\Tasks that do not correlate with known software, patch cycles, or other administrative activity.


Additionally monitor for any scheduled tasks created via command line utilities—such as PowerShell or Windows Management Instrumentation (WMI)—that do not conform to typical administrator or user actions.


Detect: Platform Monitoring Operating System Monitoring [D3-OSM] Scheduled Job Analysis [D3-SJA] System Daemon Monitoring [D3-SDM] System File Analysis


[D3-SFA] Isolate: Execution Isolation Executable Allowlisting


[D3-EAL] User Execution [T1204] Malicious Link [T1204.001] Malicious File [T1204.002] Chinese state-sponsored cyber actors have been observed conducting spearphishing campaigns that encourage engagement from the target audience.


These emails may contain a malicious link or file that provide the cyber actor access to the victim’s device after the user clicks on the malicious link or opens the attachment.


Use an antivirus program, which may stop malicious code execution that cyber actors convince users to attempt to execute.


Prevent unauthorized execution by disabling macro scripts from Microsoft Office files transmitted via email.


Consider using Office Viewer software to open Microsoft Office files transmitted via email instead of full Microsoft Office suite applications.


Use a domain reputation service to detect and block suspicious or malicious domains.


Determine if certain categories of websites are necessary for business operations and consider blocking access if activity cannot be monitored well or if it poses a significant risk.


Use browser and application sandboxes or remote virtual environments to mitigate browser or other application exploitation.


Detect: File Analysis Dynamic Analysis


[D3-DA] File Content Rules [D3-FCR] Identifier Analysis Homoglyph Detection


[D3-HD] URL Analysis [D3-UA] Network Traffic Analysis DNS Traffic Analysis


[D3-DNSTA] Isolate: Execution Isolation Hardware-based Process Isolation [D3-HBPI] Executable Allowlisting


[D3-EAL] Network Isolation DNS Denylisting [D3-DNSDL] Outbound Traffic Filtering [D3-OTF] Tactics: Persistence [TA0003] Table V: Chinese state-sponsored cyber actors’


Persistence TTPs with detection and mitigation recommendations Threat Actor Technique / Sub-Techniques Threat Actor Procedure(s)


Detection and Mitigation Recommendations Defensive Tactics and Techniques Hijack Execution Flow


[T1574]: DLL Search Order Hijacking [T1574.001] Chinese state-sponsored cyber actors have been observed using benign executables which used Dynamic Link Library (DLL) load-order hijacking to activate the malware installation process.


Note: this technique also applies to Privilege Escalation [TA0004] and Defense Evasion [TA0005].


Disallow loading of remote DLLs.


Enable safe DLL search mode.


Implement tools for detecting search order hijacking opportunities.


Use application allowlisting to block unknown DLLs.


Monitor the file system for created, moved, and renamed DLLs.


Monitor for changes in system DLLs not associated with updates or patches.


Monitor DLLs loaded by processes (e.g., legitimate name, but abnormal path).


Detect: Platform Monitoring Operating System Monitoring Service Binary Verification


[D3-SBV] Process Analysis File Access Pattern Analysis


[D3-FAPA] Isolate: Execution Isolation Executable Allowlisting


[D3-EAL] Modify Authentication Process


[T1556] Domain Controller Authentication [T1556.001] Chinese state-sponsored cyber actors were observed creating a new sign-in policy to bypass MFA requirements to maintain access to the victim network.


Note: this technique also applies to Defense Evasion


[TA0005] and Credential Access


Monitor for policy changes to authentication mechanisms used by the domain controller.


Monitor for modifications to functions exported from authentication DLLs (such as cryptdll.dll and samsrv.dll).


Configure robust, consistent account activity audit policies across the enterprise and with externally accessible services.


Look for suspicious account behavior across systems that share accounts, either user, admin, or service accounts (for example, one account logged into multiple systems simultaneously, multiple accounts logged into the same machine simultaneously, accounts logged in at odd times or outside of business hours).


Correlate other security systems with login information (e.g., a user has an active login session but has not entered the building or does not have VPN access).


Monitor for new, unfamiliar DLL files written to a domain controller and/or local computer.


Monitor for and correlate changes to Registry entries.


Detect: Process Analysis


[D3-PA] User Behavior Analysis Authentication Event Thresholding


[D3-ANET] User Geolocation Logon Pattern Analysis


[D3-UGLPA] Server Software Component [T1505]: Web Shell [T1505.003] Chinese state-sponsored cyber actors have been observed planting web shells on exploited servers and using them to provide the cyber actors with access to the victim networks.


Use Intrusion Detection Systems (IDS) to monitor for and identify China Chopper traffic using IDS signatures. Monitor and search for predictable China Chopper shell syntax to identify infected files on hosts.


Perform integrity checks on critical servers to identify and investigate unexpected changes.


Have application developers sign their code using digital signatures to verify their identity. Identify and remediate web application vulnerabilities or configuration weaknesses.


Employ regular updates to applications and host operating systems.


Implement a least-privilege policy on web servers to reduce adversaries’ ability to escalate privileges or pivot laterally to other hosts and control creation and execution of files in particular directories.


If not already present, consider deploying a DMZ between web-facing systems and the corporate network.


Limiting the interaction and logging traffic between the two provides a method to identify possible malicious activity.


Ensure secure configuration of web servers.


All unnecessary services and ports should be disabled or blocked.


Access to necessary services and ports should be restricted, where feasible.


This can include allowlisting or blocking external access to administration panels and not using default login credentials.


Use a reverse proxy or alternative service, such as mod_security, to restrict accessible URL paths to known legitimate ones.


Establish, and backup offline, a “known good” version of the relevant server and a regular change management policy to enable monitoring for changes to servable content with a file integrity system.


Employ user input validation to restrict exploitation of vulnerabilities.


Conduct regular system and application vulnerability scans to establish areas of risk.


While this method does not protect against zero-day exploits, it will highlight possible areas of concern.


Deploy a web application firewall and conduct regular virus signature checks, application fuzzing, code reviews, and server network analysis.


Detect: Network Traffic Analysis Client-server Payload Profiling [D3-CSPP] Per Host Download-Upload Ratio Analysis


[D3-PHDURA] Process Analysis Process Spawn Analysis Process Lineage Analysis [D3-PLA] Isolate: Network Isolation Inbound Traffic Filtering [D3-ITF] Create or Modify System Process


[T1543]: Windows Service [T1543.003] Chinese state-sponsored cyber actors have been observed executing malware shellcode and batch files to establish new services to enable persistence.


Note: this technique also applies to Privilege Escalation [TA0004].


Only allow authorized administrators to make service changes and modify service configurations.


Monitor processes and command-line arguments for actions that could create or modify services, especially if such modifications are unusual in your environment.


Monitor WMI and PowerShell for service modifications.


Detect: Process Analysis Process Spawn Analysis


[D3-PSA] Tactics: Privilege Escalation [TA0004] Table VI: Chinese state-sponsored cyber actors’ Privilege Escalation TTPs with detection and mitigation recommendations Threat Actor Technique / Sub-Techniques Threat Actor Procedure(s) Detection and Mitigation Recommendations Defensive Tactics and Techniques Domain Policy Modification


[T1484] Group Policy Modification


[T1484.001] Chinese state-sponsored cyber actors have also been observed modifying group policies for password exploitation.


[TA0005]. Identify and correct Group Policy Object (GPO) permissions abuse opportunities (e.g., GPO modification privileges) using auditing tools.


Monitor directory service changes using Windows event logs to detect GPO modifications.


Several events may be logged for such GPO modifications.


Consider implementing WMI and security filtering to further tailor which users and computers a GPO will apply to.


Detect: Network Traffic Analysis Administrative Network Activity Analysis


[D3-ANAA] Platform Monitoring Operating System Monitoring System File Analysis [D3-SFA] Process Injection


[T1055]: Dynamic Link Library Injection [T1055.001] Portable Executable Injection


[T1055.002] Chinese state-sponsored cyber actors have been observed: Injecting into the rundll32.exe process to hide usage of Mimikatz, as well as injecting into a running legitimate explorer.exe process for lateral movement.


Using shellcode that injects implants into newly created instances of the Service Host process (svchost)


Note: this technique also applies to


Defense Evasion


Use endpoint protection software to block process injection based on behavior of the injection process.


Monitor DLL/Portable Executable (PE) file events, specifically creation of these binary files as well as the loading of DLLs into processes.


Look for DLLs that are not recognized or not normally loaded into a process.


Monitor for suspicious sequences of Windows API calls such as CreateRemoteThread, VirtualAllocEx, or WriteProcessMemory and analyze processes for unexpected or atypical behavior such as opening network connections or reading files.


To minimize the probable impact of a threat actor using Mimikatz, always limit administrative privileges to only users who actually need it; upgrade Windows to at least version 8.1 or 10; run Local Security Authority Subsystem Service (LSASS) in protected mode on Windows 8.1 and higher; harden the local security authority (LSA) to prevent code injection.


Execution Isolation Hardware-based Process Isolation [D3-HBPI] Mandatory Access Control


[D3-MAC] Tactics: Defense Evasion


[TA0005] Table VII:


Chinese state-sponsored cyber actors’ Defensive Evasion TTPs with detection and mitigation recommendations Threat Actor Technique / Sub-Techniques Threat Actor Procedure(s) Detection and Mitigation Recommendations Defensive Tactics and Techniques Deobfuscate/Decode Files or Information [T1140] Chinese state-sponsored cyber actors were observed using the 7-Zip utility to unzip imported tools and malware files onto the victim device.


Monitor the execution file paths and command-line arguments for common archive file applications and extensions, such as those for Zip and RAR archive tools, and correlate with other suspicious behavior to reduce false positives from normal user and administrator behavior.


Consider blocking, disabling, or monitoring use of 7-Zip. Detect:


Process Analysis Process Spawn Analysis [D3-PSA] Isolate: Execution Isolation Executable Denylisting


[D3-EDL] Hide Artifacts


[T1564] Chinese state-sponsored cyber actors were observed using benign executables which used DLL load-order hijacking to activate the malware installation process.


Monitor files, processes, and command-line arguments for actions indicative of hidden artifacts, such as executables using DLL load-order hijacking that can activate malware.


Monitor event and authentication logs for records of hidden artifacts being used.


Monitor the file system and shell commands for hidden attribute usage.


Detect: Process Analysis File Access Pattern Analysis


[D3-EAL] Indicator Removal from Host [T1070] Chinese state-sponsored cyber actors have been observed deleting files using rm or del commands.


Several files that the cyber actors target would be timestomped, in order to show different times compared to when those files were created/used.


Make the environment variables associated with command history read only to ensure that the history is preserved.


Recognize timestomping by monitoring the contents of important directories and the attributes of the files.


Prevent users from deleting or writing to certain files to stop adversaries from maliciously altering their ~/.bash_history or ConsoleHost_history.txt files.


Monitor for command-line deletion functions to correlate with binaries or other files that an adversary may create and later remove.


Monitor for known deletion and secure deletion tools that are not already on systems within an enterprise network that an adversary could introduce.


Monitor and record file access requests and file handles.


An original file handle can be correlated to a compromise and inconsistencies between file timestamps and previous handles opened to them can be a detection rule.


Detect: Platform Monitoring Operating System Monitoring System File Analysis


[D3-SFA] Process Analysis File Access Pattern Analysis


[D3-EAL] Obfuscated Files or Information [T1027] Chinese state-sponsored cyber actors were observed Base64 encoding files and command strings to evade security measures.


Consider utilizing the Antimalware Scan Interface (AMSI) on Windows 10 to analyze commands after being processed/interpreted.


[D3-FAPA] Signed Binary Proxy Execution


[T1218] Mshta [T1218.005] Rundll32 [T1218.011] Chinese state-sponsored cyber actors were observed using Microsoft signed binaries, such as Rundll32, as a proxy to execute malicious payloads.


Monitor processes for the execution of known proxy binaries (e.g., rundll32.exe) and look for anomalous activity that does not follow historically good arguments and loaded DLLs associated with the invocation of the binary.


[D3-FAPA] Process Spawn Analysis [D3-PSA] Tactics: Credential Access [TA0006] Table VIII:


Chinese state-sponsored cyber actors’ Credential Access TTPs with detection and mitigation recommendations Threat Actor Technique / Sub-Techniques Threat Actor Procedure(s) Detection and Mitigation Recommendations Defensive Tactics and Techniques Exploitation for


Credential Access


[T1212] Chinese state-sponsored cyber actors have been observed exploiting Pulse Secure VPN appliances to view and extract valid user credentials and network information from the servers.


Update and patch software regularly.


Use cyber threat intelligence and open-source reporting to determine vulnerabilities that threat actors may be actively targeting and exploiting; patch those vulnerabilities immediately.


Platform Hardening Software Update [D3-SU] Credential Hardening Multi-factor Authentication [D3-MFA] OS Credential Dumping [T1003] • LSASS Memory [T1003.001] • NTDS


[T1003.003] Chinese state-sponsored cyber actors were observed targeting the LSASS process or Active directory (NDST.DIT) for credential dumping.


Monitor process and command-line arguments for program execution that may be indicative of credential dumping, especially attempts to access or copy the NDST.DIT.


Ensure that local administrator accounts have complex, unique passwords across all systems on the network.


Limit credential overlap across accounts and systems by training users and administrators not to use the same passwords for multiple accounts.


Consider disabling or restricting NTLM.


Consider disabling WDigest authentication.


Ensure that domain controllers are backed up and properly secured (e.g., encrypt backups).


Implement Credential Guard to protect the LSA secrets from credential dumping on Windows 10.


This is not configured by default and requires hardware and firmware system requirements.


Enable Protected Process Light for LSA on Windows 8.1 and Windows Server 2012 R2.


Harden: Credential Hardening [D3-CH] Detect: Process Analysis File Access Pattern Analysis


[D3-FAPA] System Call Analysis [D3-SCA] Isolate: Execution Isolation Hardware-based Process Isolation [D3-HBPI] Mandatory Access Control [D3-MAC] Tactics: Discovery [TA0007] Table IX: Chinese state-sponsored cyber actors’


Discovery TTPs with detection and mitigation recommendations Threat Actor Technique / Sub-Techniques Threat Actor Procedure(s)


Detection and Mitigation Recommendations Defensive Tactics and Techniques File and Directory Discovery


[T1083] Chinese state-sponsored cyber actors have been observed using multiple implants with file system enumeration and traversal capabilities.


Monitor processes and command-line arguments for actions that could be taken to gather system and network information.


WMI and PowerShell should also be monitored.


Detect: User Behavior Analysis Job Function Access Pattern Analysis


[D3-JFAPA] Process Analysis Database Query String Analysis


[D3-DQSA] File Access Pattern Analysis


[D3-FAPA] Process Spawn Analysis [D3-PSA] Permission Group Discovery [T1069] Chinese state-sponsored cyber actors have been observed using commands, including net group and net localgroup, to enumerate the different user groups on the target network.


Remote access tools with built-in features may interact directly with the Windows API to gather information.


Information may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell.


[D3-PSA] System Call Analysis


[D3-SCA] User Behavior Analysis [D3-UBA] Process Discovery [T1057] Chinese state-sponsored cyber actors have been observed using commands, including tasklist, jobs, ps, or taskmgr, to reveal the running processes on victim devices.


Normal, benign system and network events that look like process discovery may be uncommon, depending on the environment and how they are used.


[D3-SCA] User Behavior Analysis [D3-UBA] Network Service Scanning [T1046] Chinese state-sponsored cyber actors have been observed using Nbtscan and nmap to scan and enumerate target network information.


• Ensure that unnecessary ports and services are closed to prevent discovery and potential exploitation.


• Use network intrusion detection and prevention systems to detect and prevent remote service scans such as Nbtscan or nmap.


• Ensure proper network segmentation is followed to protect critical servers and devices to help mitigate potential exploitation.


[D3-CAA] Isolate: Network Isolation Inbound Traffic Filtering [D3-ITF] Remote System Discovery


[T1018] Chinese state-sponsored cyber actors have been observed using Base-64 encoded commands, including ping, net group, and net user to enumerate target network information.


Monitor for processes that can be used to discover remote systems, such as ping.exe and tracert.exe, especially when executed in quick succession.


[D3-PSA] User Behavior Analysis Job Function Access Pattern Analysis


[D3-JFAPA] Tactics: Lateral Movement


[TA0008] Table X: Chinese state-sponsored cyber actors’ Lateral Movement TTPs with detection and mitigation recommendations Threat Actor Technique / Sub-Techniques Threat Actor Procedure(s)


Detection and Mitigation Recommendations Defensive Tactics and Techniques Exploitation of Remote Services [T1210] Chinese state-sponsored cyber actors used valid accounts to log into a service specifically designed to accept remote connections, such as telnet, SSH, RDP, and Virtual Network Computing (VNC).


The actor may then perform actions as the logged-on user.


Chinese state-sponsored cyber actors also used on-premises Identity and Access Management (IdAM) and federation services in hybrid cloud environments in order to pivot to cloud resources.


Chinese state-sponsored cyber actors used valid accounts to log into a service specifically designed to accept remote connections, such as telnet, SSH, RDP, and Virtual Network Computing (VNC).


Disable or remove unnecessary services.


Minimize permissions and access for service accounts.


Perform vulnerability scanning and update software regularly.


Use threat intelligence and open-source exploitation databases to determine services that are targets for exploitation.


Detect: Network Traffic Analysis Remote Terminal Session Detection


[D3-RTSD] User Behavior Analysis [D3-UBA] Isolate: Execution Isolation Mandatory Access Control [D3-MAC] Tactics:


Collection [TA0009] Table XI: Chinese state-sponsored cyber actors’ Collection TTPs with detection and mitigation recommendations Threat Actor Technique / Sub-Techniques Threat Actor Procedure(s) Detection and Mitigation Recommendations Defensive Tactics and Techniques Archive Collected Data [T1560] Chinese state-sponsored cyber actors used compression and encryption of exfiltration files into RAR archives, and subsequently utilizing cloud storage services for storage.


Scan systems to identify unauthorized archival utilities or methods unusual for the environment.


Monitor command-line arguments for known archival utilities that are not common in the organization's environment.


[D3-FAPA] Process Spawn Analysis [D3-PSA] Isolate: Execution Isolation Executable Denylisting [D3-EDL] Clipboard Data [T1115] Chinese state-sponsored cyber actors used RDP and execute rdpclip.exe to exfiltrate information from the clipboard.


Access to the clipboard is a legitimate function of many applications on an operating system.


If an organization chooses to monitor for this behavior, then the data will likely need to be correlated against other suspicious or non-user-driven activity (e.g. excessive use of pbcopy/pbpaste (Linux) or clip.exe (Windows) run by general users through command line).


If possible, disable use of RDP and other file sharing protocols to minimize a malicious actor's ability to exfiltrate data.


Detect: Network Traffic Analysis Remote Terminal Session Detection [D3-RTSD] Isolate: Network Isolation Inbound Traffic Filtering [D3-ITF] Outbound Traffic Filtering [D3-OTF] Data Staged [T1074] Chinese state-sponsored cyber actors have been observed using the mv command to export files into a location, like a compromised Microsoft Exchange, IIS, or emplaced webshell prior to compressing and exfiltrating the data from the target network.


Processes that appear to be reading files from disparate locations and writing them to the same directory or file may be an indication of data being staged, especially if they are suspected of performing encryption or compression on the files, such as using 7-Zip, RAR, ZIP, or zlib.


Monitor publicly writeable directories, central locations, and commonly used staging directories (recycle bin, temp folders, etc.) to regularly check for compressed or encrypted data that may be indicative of staging.


[D3-FAPA] Email Collection [T1114] Chinese state-sponsored cyber actors have been observed using the New-MailboxExportRequest PowerShell cmdlet to export target email boxes.


Audit email auto-forwarding rules for suspicious or unrecognized rulesets.


Encrypt email using public key cryptography, where feasible.


Use MFA on public-facing mail servers.


Credential Hardening Multi-factor Authentication [D3-MFA] Message Hardening Message Encryption [D3-MENCR] Detect: Process Analysis


[D3-PA] Tactics: Command and Control


[TA0011] Table XII: Chinese state-sponsored cyber actors’ Command and Control TTPs with detection and mitigation recommendations Threat Actor Technique / Sub-Techniques Threat Actor Procedure(s) Detection and Mitigation Recommendations Defensive Tactics and Techniques Application Layer


Protocol


[T1071] Chinese state-sponsored cyber actors have been observed: Using commercial cloud storage services for command and control.


Using malware implants that use the Dropbox:registered: API for C2 and a downloader that downloads and executes a payload using the Microsoft OneDrive:registered: API.


Use network intrusion detection and prevention systems with network signatures to identify traffic for specific adversary malware.


Detect: Network Traffic Analysis Client-server Payload Profiling [D3-CSPP] File Carving [D3-FC] Isolate: Network Isolation DNS Denylisting [D3-DNSDL] Ingress Tool Transfer


[T1105] Chinese state-sponsored cyber actors have been observed importing tools from GitHub or infected domains to victim networks.


In some instances.


Chinese state-sponsored cyber actors used the Server Message Block (SMB) protocol to import tools into victim networks.


Perform ingress traffic analysis to identify transmissions that are outside of normal network behavior.


Do not expose services and protocols (such as File Transfer Protocol


[FTP]) to the Internet without strong business justification.


Use signature-based network intrusion detection and prevention systems to identify adversary malware coming into the network.


Isolate: Network Isolation Inbound Traffic Filtering [D3-ITF]


Non-Standard Port [T1571] Chinese state-sponsored cyber actors have been observed using a non-standard SSH port to establish covert communication channels with VPS infrastructure.


Use signature-based network intrusion detection and prevention systems to identify adversary malware calling back to C2.


Configure firewalls to limit outgoing traffic to only required ports based on the functions of that network segment.


Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port.


Detect: Network Traffic Analysis Client-server Payload Profiling [D3-CSPP] Protocol Metadata Anomaly Detection


[D3-PMAD] Isolate: Network Isolation Inbound Traffic Filtering [D3-ITF] Outbound Traffic Filtering [D3-OTF] Protocol Tunneling [T1572] Chinese state-sponsored cyber actors have been observed using tools like dog-tunnel and dns2tcp.exe to conceal C2 traffic with existing network activity.


Monitor systems for connections using ports/protocols commonly associated with tunneling, such as SSH (port 22).


Also monitor for processes commonly associated with tunneling, such as Plink and the OpenSSH client.


Analyze packet contents to detect application layer protocols that do not follow the expected protocol standards.


Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server) Detect: Network Traffic Analysis Protocol Metadata Anomaly Detection


Proxy [T1090]: Multi-Hop Proxy [T1090.003] Chinese state-sponsored cyber actors have been observed using a network of VPSs and small office and home office (SOHO) routers as part of their operational infrastructure to evade detection and host C2 activity.


Some of these nodes operate as part of an encrypted proxy service to prevent attribution by concealing their country of origin and TTPs.


Monitor traffic for encrypted communications originating from potentially breached routers to other routers within the organization.


Compare the source and destination with the configuration of the device to determine if these channels are authorized VPN connections or other encrypted modes of communication.


Alert on traffic to known anonymity networks (such as Tor) or known adversary infrastructure that uses this technique.


Use network allow and blocklists to block traffic to known anonymity networks and C2 infrastructure.


Detect: Network Traffic Analysis Protocol Metadata Anomaly Detection


[D3-PMAD] Relay Pattern Analysis


[D3-RPA] Isolate: Network Isolation Outbound Traffic Filtering [D3-OTF] Appendix B: MITRE ATT&CK Framework Figure 2: MITRE ATT&CK Enterprise tactics and techniques used by Chinese state-sponsored cyber actors (Click here for the downloadable JSON file.)


Contact InformationTo report suspicious or criminal activity related to information found in this Joint Cybersecurity Advisory, contact your local FBI field office at www.fbi.gov/contact-us/field, or the FBI’s 24/7 Cyber Watch (CyWatch) at (855) 292-3937 or by e-mail at CyWatch@fbi.gov.


To request incident response resources or technical assistance related to these threats, contact CISA at Central@cisa.dhs.gov.


For NSA client requirements or general cybersecurity inquiries, contact the NSA Cybersecurity Requirements Center at 410-854-4200 or Cybersecurity_Requests@nsa.gov.


Media Inquiries / Press Desk: • NSA Media Relations, 443-634-0721, MediaRelations@nsa.gov • CISA Media Relations, 703-235-2010, CISAMedia@cisa.dhs.gov • FBI National Press Office, 202-324-3691, npo@fbi.gov References [1] FireEye:


This is Not a Test: APT41 Initiates Global Intrusion Campaign Using Multiple Exploits Revisions July 19, 2021:


Initial Version This product is provided subject to this Notification and this Privacy & Use policy.


On May 11th, 2023, the very popular WordPress plugin Essential Addons for Elementor released a patch for a critical privilege escalation vulnerability, initially discovered by PatchStack.

Vulnerability in Essential Addons for Elementor Leads to Mass Infection


The technical details of this vulnerability can be found on their recent blog post.