Input: The objective of these micro-targeted attacks against the Defense sector is likely theft of Intellectual Property more than ad fraud and indicates motive and sophistication characteristic of advanced threat actors.


Input: Since these attacks were blocked by Invincea prior to compromise of the machine or network, we can not confirm the specific IP the perpetrators are after–only the Tactics, Techniques, and Protocols (TTPs) used which we describe herein, similar to methods used to provide backdoor access and command and control over compromised networks.

methods

backdoor access and command and control over compromised networks

provide


Input: While we discovered these attacks across multiple Defense companies, we expect it will not be long, if not already, before other highly targeted segments including Federal, Financial Services, Manufacturing, and HealthCare are victimized with the same micro-targeted malvertising.


Input: The campaign described here does not represent a single flaw, 0-day, or unpatched bug, but rather a significant development in the adversary's capabilities and strategy to leverage legitimate online advertising platforms on well-known ad supported websites via a technique called Real-Time Ad Bidding.


Input: In other words, this problem will not be patched on Tuesday.


Input: UPDATE: We have updated this document to include a new section on a campaign of distributing CryptoWall ransomware via malvertising.


Input: While the attack vector is the same, we believe this to be motivated by cybercrime rather than theft of IP from Defense companies.


Input: Malvertising has seen meteoric rise in 2014.


Input: Threat actors create a corporate front, advertise on commonly visited sites, then later switch out the landing pages for their ads to pages that host exploit kits, or simply create a temporary redirection from their usual content to the malicious landing page.

Threat actors

the landing pages for their ads

pages that host exploit kits

a temporary redirection from their usual content to the malicious landing page

switch

create

out

to


Input: These exploit kits are hosted on compromised web servers across the world.


Input: In other words, they leverage legitimate ad-supported popular websites together with compromised websites for hosting exploit landing pages, defeating black-listing techniques.


Input: The lifetime of these ads and landing pages are measured in hours.


Input: In the campaign described here, Operation DeathClick, traditional malvertising has been armed with a micro-targeting system using IP address ranges, geographically narrowed down to zip codes, and interests of the user (recorded in cookies) to target specific companies, company types, and user interests/preferences.

traditional malvertising

a micro-targeting system using IP address ranges, geographically narrowed down to zip codes, and interests of the user (recorded in cookies)

target specific companies, company types, and user interests/preferences

been armed

with

to


Input: They are employing the tactics of real-time ad bidding to guarantee malicious ad delivery to intended targets of the campaign–building on a decade of work in real-time analytics for online ad placement, but for nefarious purposes.


Input: The threat actors redirect their ads for just minutes at a time and then abandon their exploit kit pages forever.


Input: This means that list-based threat intelligence feeds are rendered ineffective.


Input: The domains used do not appear in any proxy blacklist, and the malware droppers delivered by the exploit pages always employ different signatures, evading traditional network and endpoint detection technology.


Input: Ad delivery networks today are not incentivized to address the problem in a credible manner as they derive revenue from the criminal enterprise, while not being held accountable.


Input: Turning a blind eye to the problem is rewarded economically.


Input: Meanwhile the perpetrators are able to use traditional malvertising and ad fraud bots to fund the criminal enterprise.


Input: Without cooperation of ad networks to vet the advertisers working through front companies, this attack vector will go unchecked.


Input: And now, with the advent of real-time ad bidding, these threat actors have weaponized ad delivery networks to target victims based on: Real-time ad bidding allows advertisers, and by extension, adversaries, to micro-target ad delivery on an extremely granular basis.

these threat actors

ad delivery networks

target victims

weaponized

to


Input: For example, oppressive regimes trying to gather intelligence on activist protests can deliver ads to people getting email from within a specific locality where they are protesting.


Input: Today, it is commonplace for micro-targeting techniques to be used as part of the toolset in legitimate online advertising.


Input: For instance, a defense contractor, trying to win a new omnibus contract, can deliver targeted ads to online news sites frequented by Government program personnel.


Input: The latest software product release can be delivered to Windows users visiting PC Magazine's website.


Input: A local car dealership can sense when someone is in the market for a new car and can deliver advertising to those users, based solely on browsing history.


Input: Now advanced threat actors are able to target an organization directly via micro-targeted malvertising, based solely on their corporate network IP range.

advanced threat actors

an organization

directly

micro-targeted malvertising

their corporate network IP range

target

via

based solely on


Input: Thus, it doesn't matter where in the world you point your web browser -- an online video poker room, a fantasy football club homepage, a Pakistani news homepage, or even checking your own webmail at a trusted email provider.


Input: Those ad windows can and are being used to deliver malware if the bidding price is right.

Those ad windows

deliver malware

the bidding price is right

being used

to

if


Input: Recently, multiple US Defense/Aerospace contractors were targeted by a malvertising campaign.

multiple US Defense/Aerospace contractors

a malvertising campaign

were targeted


Input: These contractors had deployed world-class enterprise security defense in depth approaches to protect their intellectual property.


Input: They had next generation firewalls that relied on threat intelligence feeds to do auto-blocking of known malicious sites.


Input: They had malware interception technology that relied on known bad hashes to prevent malicious downloads.


Input: The multiple proxies in place subscribed to real time feeds of known bad URLs.


Input: They deployed AV at the gateways and on the endpoints.


Input: But in a two week period, these organizations were hit with dozens of micro-targeted malvertising attacks, each of which would have provided a beachhead for the threat actors from which to compromise the network, if successful.

these organizations

dozens of micro-targeted malvertising attacks

were hit

with


Input: In each instance, the attacks were carried out by targeting these Defense contractors directly via real-time ad bidding.

the attacks

targeting these Defense contractors directly via real-time ad bidding

were carried out

by


Input: Once targeted, an end user only needed to browse to any website, anywhere in the world, which contained a DoubleClick ad-partner embedded window.


Input: Invincea stopped these attacks on the endpoints by containing the delivered exploits in secure virtual containers, while producing the forensics that led to this discovery.


Input: Next we go in some detail about example attacks perpetrated against the defense firms.


Input: It is important to note that the websites we show next that served up targeted malvertising were victims of malvertising campaigns with no knowledge of the malicious ads they were serving up.


Input: These malicious ads were served up by 3rd party networks, who are unwittingly sourcing malicious content.


Input: As we will discuss later, the 3rd party ad networks themselves are falling victim to malicious content campaigns.


Input: A user visited his online fantasy football league homepage at Fleaflicker.com.


Input: As soon as the page loaded, a malicious ad delivered a backdoor Trojan via a Java-based exploit.

a malicious ad

a backdoor Trojan

a Java-based exploit

delivered

via


Input: Figure 1 shows a screenshot of the page that was visited.


Input: You will notice the two inline ad placements for DoubleClick ad delivery.


Input: The malware delivered came from a compromised Polish website, and would have installed a generic backdoor Trojan.

The malware

a generic backdoor Trojan

installed


Input: Note the prominent ad placements by AdChoice, a DoubleClick affiliate.


Input: Figure 2 shows an event tree of the exploit and malware delivered from an ad by visiting Fleaflicker.com.

the exploit and malware

an ad

visiting Fleaflicker.com

delivered

from

by


Input: The event tree in Figure 2 taken from Invincea's Threat Management Console shows the exploited Java process dropped a file called fvJcrgR0.exe, and that it likely came from Pubmatic, an ad delivery network that allows for real time bidding to deliver ads.

the exploited Java process

a file called fvJcrgR0.exe

dropped


Input: In this instance, the Pubmatic server redirected to a Web server in Poland that dropped the malware.

a Web server in Poland

the malware

dropped


Input: The timeline below shows the exact times and URLs visited.


Input: Note the number of re-directs from Fleaflicker.com to different outside properties in Figure 3.


Input: Invincea Threat Management provides a quick way to search for an MD5 hash on third party sites (see Figure 4).


Input: By clicking the VirusTotal link, the analyst will see the following VirusTotal report in Figure 5: From the VirusTotal report in Figure 5, you will see that this malware is a Trojan backdoor that would likely be used to download additional malware or to provide remote persistent access to the attacker.

this malware

a Trojan backdoor

additional malware

remote persistent access

the attacker

is

download

provide

to


Input: An employee at a defense contractor visited a free Texas Poker online game.


Input: The Poker site had advertisements on the page, one of which launched a similar attack as seen in before on other websites visited by employees at this firm.


Input: It should be noted that Gpokr.com no longer appears to be serving advertisements from their site.


Input: At the time of the incident, as seen in the logs below, an ad window was previously present.


Input: In the event tree shown in Figure 7, you will see that the winning bid redirected to a direct-to-IP site instead of a site via domain name.


Input: Also, above is the first indication of specific executable DLL files.


Input: Searches for these filenames returned zero results on VirusTotal.


Input: This event on September 14 (Figure 8) shows that delivery.first-impression.com redirected directly to an IP address, not a domain name to deliver its malicious payload.

delivery.first-impression.com

an IP address, not a domain name

deliver its malicious payload

redirected

to

to


Input: Note the multiple DLL files written to disk and the spawning of rundll32.exe.


Input: At this point, the Invincea-protected host recognized the unauthorized process and reverted itself to a clean state.


Input: In another incident an employee checked their online Earthlink account.


Input: When they replied to an email, a new ad was loaded on a page that attempted to exploit Java.

a new ad

Java

exploit


Input: This malvertising was from the same IP address seen in other incidents.


Input: You will notice the inline advertisements on this page in Figure 9.


Input: The event tree in Figure 10 notes that this was likely a spear-phish attack.

this

a spear-phish attack

was


Input: The timeline will show that when the user replied to an email, the ads on the Earthlink page refreshed, dropping the exploit code via Java.

the ads on the Earthlink page

the exploit code

Java

dropping

via


Input: Note in the timeline in Figure 11, how there was a 7 minute gap between the DoubleClick ad redirect and the delivery.first-impression.com ad.


Input: This is an indication that the page was refreshed or the ad was refreshed on the page.


Input: The same exploit IP address from the Gpokr event is present.


Input: This event is the oldest, happening on September 11.


Input: The three examples above are samples of the more than two dozen micro-targeted attacks we have witnessed and blocked as part of Operation DeathClick since mid-September.


Input: Defense Industrial Base customers witnessed micro-targeted malvertising at a rate six times that of comparable private sector companies with similar defense-in-depth capabilities.


Input: We observed in Operation DeathClick that real-time ad bidding networks are being used by criminal enterprise to target companies with malicious content in order to gain persistent remote access.

real-time ad bidding networks

criminal enterprise

target companies with malicious content

persistent remote access

being used

gain

to


Input: In these third-party arrangements, the content is frequently not vetted because billions of impressions are rendered in real-time.


Input: Most of the content is legitimate ads.


Input: A small fraction is malicious content linking to landing pages that infect users.

malicious content

landing pages that infect users

linking

to


Input: Real-time ad networks are being used, often unwittingly, and some have taken steps to try and combat malicious use of their networks.


Input: The Online Trust Alliance is one such industry group comprised of major software companies and ad networks working together to try and address this problem.


Input: Our goal in this paper is to shed light on the micro-targeting of companies by criminal enterprise employing real-time ad networks, and to aid the industry in collectively addressing this problem.


Input: Real-time ad bidding networks have evolved over the last ten years as a means of micro-targeting customers with advertising content they are more likely to click-on.


Input: From Wikipedia: Real-time bidding (RTB) refers to the means by which ad inventory is bought and sold on a per- impression basis, via programmatic instantaneous auction, similar to financial markets.


Input: [1] With real-time bidding, advertising buyers bid on an impression and, if the bid is won, the buyer's ad is instantly displayed on the publisher's site.


Input: [2] Real-time bidding lets advertisers manage and optimize ads from multiple ad-networks by granting the user access to a multitude of different networks, allowing them to create and launch advertising campaigns, prioritize networks and allocate advertising stock.


Input: Real-time bidding is a dynamic bidding process where each impression is bid for in (near) real time, against a static auction where the impressions are typically bundled in groups of 1,000.


Input: A typical transaction begins with a user visiting a website.


Input: This triggers a bid request that can include various pieces of data such as the user's demographic information, browsing history, location, and the page being loaded.


Input: The request goes from the publisher to an ad exchange, which submits it and the accompanying data to multiple advertisers who automatically submit bids in real time to place their ads.


Input: Advertisers bid on each ad impression as it is served.


Input: The impression goes to the highest bidder and their ad is served on the page.This process is repeated for every ad slot on the page.


Input: Real time bidding transactions typically happen within 100 milliseconds from the moment the ad exchange received the request.


Input: The bidding happens autonomously and advertisers set maximum bids and budgets for an advertising campaign.


Input: The criteria for bidding on particular types of consumers can be very complex, taking into account everything from very detailed behavioral profiles to conversion data.


Input: The following infographic summarizes how advanced adversaries are now micro-targeting companies using malvertising.


Input: The marketplace and auction of ads sounds great for actual ads.


Input: But what if the landing pages that are supposed to be ads are actually malicious PHP pages with embedded malware? The bidding and ad placements work the same, but instead of seeing a flashy ad banner, the highest bidder for the placement serves malware.

the highest bidder for the placement

malware

serves


Input: The price to win the bid to push malvertising to any page you happen to visit ranges from 45 to 75 cents per impression.


Input: A malicious advertiser on a network may serve crafted, seemingly normal ads, a majority of the time.


Input: In fact, the ads are often stolen copies from legitimate advertisers.


Input: This establishes the attacker's legitimacy and trust on the ad network.


Input: Of course with real-time ad bidding, he can simply offer up low bids and his content would consistently lose in the marketplace.


Input: But it is very simple to replace the redirection code to switch from a legitimate ad banner to a drop site that hosts an exploit kit, typically based on Java, Flash, Silverlight, or all three.

replace

the redirection code

switch from a legitimate ad banner to a drop site that hosts an exploit kit, typically based on Java, Flash, Silverlight, or all three

to


Input: Once the malvertiser detects that he has several infected hosts, he removes the redirection code and goes back to serving standard ad banners.


Input: He then'' burns'' his temporary exploit kit drop site, moving his exploits to another location for a new campaign.


Input: This allows the malicious advertiser to perform hit and run attacks, infect whomever he wants at whatever time he wants, and maintain his presence on the advertising marketplace without drawing undue attention to his activities.


Input: In the sections below, we will provide highlights of the RTB industry, its targeting capabilities, and show how malvertisers have been mis-appropriating RTB networks to deliver malware.


Input: The RTB ad networks provide significant micro-targeting capabilities that have long been used to serve legitimate content to users more likely to click on them.


Input: In the following, we describe these capabilities to show the state of the art in RTB network capabilities.


Input: The quoted material below are direct quotes from Real Time Bidding service providers linked.


Input: Emphasis added by Invincea.


Input: Audience Targeting: Bid on the audiences most valuable to you.


Input: Each impression in the PubMatic auction can be enhanced with first- and third-party data; giving buyers targeting capabilities across display, mobile, tablet and video inventory.


Input: Media buyers can also cookie sync with publisher audiences to incorporate CRM, retargeting and exclusion strategies in their digital advertising.


Input: Buyers have access to proprietary audience segments either directly through Private Marketplace deals or through the open market.


Input: With hundreds of parameters available to you, PubMatic has your best audiences waiting for you.


Input: With PubMatic, buyers are able to access pre-defined vertical or audience packages, seasonal packages, publisher and/or site-specific inventory packages as well as pre-selected publisher packages and pricing available in Private Marketplaces.


Input: '' First-Impression Buy-Side offers the granular targeting, tracking, and reporting needed to help our clients make the most of their spend, along with an expert support team to advise when needed.


Input: By leveraging real time buying, First-Impression Buy-Side gives media buyers the full control to maximize the value of an impression.


Input: '' Could Malvertisers Track Exploits and their cost per impression? Yes.


Input: Many RTB networks provide a control panel to track advertising campaigns in real-time, along with notifications that bids have been won and who exactly was served the malware.


Input: Below is a URL redirection log from First-Impression.com from a winning bid by a malvertiser.


Input: In the URL are parameters such as the type of ad, the type of user-agent string of the ad reader specified (which discloses browser and java versions), whether it is a retargeted ad based off of cookies (this one was not), the price paid, which is 65.4 cents, and the notification to the malvertiser that his malvertising was delivered.


Input: DoubleClick discusses their targeting capabilities in online documentation.


Input: Since they specialize in knowing the location of their ad windows, they market those ad spaces to the actual advertisers and malvertisers, along with targeted demographics about the content pages, the visitors to the sites and more.


Input: To showcase the variety of impression-level data available to buyers, consider the data made available through a connection to DoubleClick Ad Exchange's real-time bidding API.


Input: With ADX, a buyer could consider any of the following data passed from the seller with each impression: • Ad slot parameters: visibility (above or below the fold), size, excluded creative attributes, excluded advertiser URLs, allowed vendor or ad technology.


Input: • Geo parameters: country, region, metro, city.


Input: • Content parameters: site URL, site language, seller network, vertical or category.


Input: • User parameters: browser, operating system, anonymous cookie (hashed), cookie age.


Input: Just like when considering one type of data, by using the anonymous cookie parameter, buyers can consider first-party retargeting or third-party audience data from a data provider.


Input: However, they can go further in the evaluation by looking at more of these parameters.


Input: This helps a buyer learn much more about a particular user and a particular impression, gain a smarter answer to the three essential questions and make a more data-driven decision.


Input: This sounds like a great way to advertise if you are in the marketing industry.


Input: Consider how granularly a person can be targeted if this service is used maliciously.


Input: If not targeted by the desktop, how about on the mobile platform? Twitter's Tailored Audiences just got a little more tailored.


Input: Advertisers can now augment their customer data using mobile advertising IDs and mobile phone numbers as a way to reach existing customers and increase audience size.


Input: In essence, the move is an extension of Twitter's Tailored Audiences for CRM retargeting, which allows advertisers to use hashed non-PII email address to retarget existing customers.


Input: (email addresses are twitter IDs- so you could be targeted for ad delivery based on your account name or known phone number) Twitter also rolled out the ability to target lookalike audiences, a function that seems pretty similar to Facebook's tool of the same name.


Input: Twitter's lookalike modeling uses a proprietary algorithm that examines modeled users looking for similarities related to behaviors, interests, location, demographic attributes and engagement patterns.


Input: Twitter described its enhanced as'' part of improved targeting options to help advertisers reach additional users similar to their existing audiences.


Input: '' Tailored Audiences, Twitter's seeming answer to the Facebook Exchange (FBX), officially launched back in December after running retargeting and database matching tests in July.


Input: Twitter has appeared to follow Facebook's lead with a number of its recent roll-outs, including site retargeting, CRM targeting and now retargeting via lookalike audiences.


Input: (Facebook also makes it possible to target users by phone numbers through Custom Audiences.


Input: ) Neustar does provide a real-time bidding ad exchange, but their real market is IP intelligence that they sell to other advertising networks for the purposes of better targeting specific users.


Input: In Europe, laws require that advertising networks allow people to opt out of having tracking cookies, which is how many advertisers used to rely upon for ad campaign targeting.


Input: To get around this, Neustar perfected IP based targeting, which avoids cookies.


Input: They are able to build IP specific browsing profiles based on IP subnets.


Input: In a blog post below, Neustar boasts about their direct to IP range and enterprise advertising.


Input: How can Neustar IP Intelligence target by IP? While IP intelligence has been around for many years, the ability to effectively target advertising by audience, based on IP is very new.


Input: Neustar IP Intelligence is currently working with select DSP platforms to buy impressions off of the exchanges based on the IP address rather than cookies.


Input: This has only been possible with the recent emergence of real time bidding (RTB).


Input: The secret sauce is in understanding the IP and the methodology necessary for targeting ads appropriately against it.


Input: Is an IP Address like a cookie? No, an IP address only identifies devices on a network.


Input: The IP address does not contain any PII and does not track or store any consumer usage or behavioral information.


Input: (But IP ranges are registered by IANA, and you can easily know who owns the ranges) Product Specific Questions Q1: How does the process work? The process works exactly like any advertising network.


Input: Instead of buying inventory based on a cookie, Neustar is buying inventory based on an IP address.


Input: We run the targeting specifics against our proprietary database and create a custom IP list to target against.


Input: Neustar has set up relationships with partners that have built the functionality for this to work end-to-end for our advertisers.


Input: Neustar offers a full service ad network.


Input: Brand marketers who wish to advertise using IP Audience Targeting can work directly with Neustar to determine custom IP placements, run campaigns, optimization, reporting and billing.


Input: Much like any traditional online publisher or online ad network, Neustar manages the entire process.


Input: How does Neustar deliver its ads? We use industry standard methods for delivering our ads, but what makes our approach special is that we bake in the IP data before delivering the inventory with our network partners, which allows us to target display ad campaigns to a specific business or organization.


Input: We obtain inventory from ad exchanges, but have our own ad server.


Input: Zedo, blamed for recent malvertising via DoubleClick, say they are now trying to protect against malvertisers in this blog here.


Input: Less than a week after this announcement, they published another blog post that describes how they can push advertising to specific platforms, devices, as well as specific markets and networks: Users can now target ads to a specific device when trafficking ads.


Input: An option for'' Device Targeting'' is now available under'' Targeting''.


Input: A creative targeted to a specific Device will serve only on that Device.


Input: All major manufacturers/models are supported by this feature.


Input: If a creative is not targeted to any specific device than it will serve on all device.


Input: Apart from device, a user can target various devices based on different categories.


Input: At any given point of time, a user can target multiple manufacturers and categories.


Input: Apart from existing campaign reach report a user can now pull a reach report by creative.


Input: The creative reach report is available along with all the existing parameters and can be pulled by month, week or day.


Input: Creative reach report will show creative wise reach.


Input: It will help to analyze how effective the reach of a creative was.


Input: To be clear, RTB networks are legitimate platforms for displaying ads on ad-supported websites.


Input: They enable micro-targeting of user's interest, delivering content that a viewer would likely want to see.


Input: As we have detailed here, they can also be mis-appropriated unwittingly by malvertisers using these same tools and techniques to target companies with malware for persistent remote access in addition to traditional click fraud, phishing, and identity theft.

malvertisers

these same tools and techniques

target companies with malware for persistent remote access

traditional click fraud, phishing, and identity theft

using

to

in addition to


Input: Below are links to RTB providers to learn more.


Input: Invincea has shown logs from a winning malvertising bid in the price range of 65 cents per impression.


Input: That is one ad, on one page, paid for by the malvertiser's account.


Input: This implies that malvertisers have deep pockets, spending hundreds of dollars on ad impressions.


Input: So how do they get money to spend on these malicious campaigns? Invincea recently saw a malvertiser win a bid and delivered a Java exploit.

a malvertiser

a Java exploit

delivered


Input: This exploit copied a fully functional version of Chrome into the Java cache directory, and that version of Chrome launched in the background and proceeded to visit websites and click on specific ad banners.

This exploit

a fully functional version of Chrome

the Java cache directory

that version of Chrome

specific ad banners

copied

click

into

on


Input: It is presumed that these ad banners paid revenue via referral bonuses to the malvertiser.


Input: By paying 65 cents to install a background web browser that does nothing but click fraud, the malvertiser is able to reap hundreds if not thousands of dollars in advertising referral income.

a background web browser

click fraud

does


Input: It is a pretty good return on investment, which in turn allows the malvertiser to fund his micro-targeted malvertising attack campaign.


Input: It is ironic, however, that click fraud is what is driving the prices of RTB advertising so high.


Input: Malvertising is not only a danger to end users, but it is a danger to the advertising industry as well.


Input: The image from Figure 14 below shows a log file of Chrome, in this instance, renamed Oajvliewxpge.exe, injected via Java to run in the background.


Input: Invincea detected this attack and killed the infection attempt.


Input: This is one instance where the malvertiser wasted his 65 cents.


Input: It should be noted that Invincea is uniquely capable of stopping this type of attack.


Input: The introduction of Chrome as a browser, which is whitelisted by hash across the AV industry, would go unchecked by the AV and whitelisting applications industry.


Input: In this instance, the host was almost converted to a click-fraud bot.

the host

a click-fraud bot

was almost converted

to


Input: But the malware delivery could have been intended for data exfiltration, banking Trojans, or any other more insidious purpose.

the malware delivery

data exfiltration

been intended

for


Input: The ability for advertisers and malvertisers to automatically redirect to self-hosted ad content or exploit pages is driving RTB malvertising.


Input: Invincea has witnessed a rash of exploit kits and landing pages hosted on: In most instances, the landing pages are preconfigured with the exploit kit.

the landing pages

the exploit kit

are preconfigured

with


Input: The malvertiser creates the redirection in his normal ad prior to raising his bids to winning levels.


Input: Once several victims are confirmed, those malicious landing pages have the content erased, and the automatic redirection removed to serve'' normal'' ads again.


Input: Figures 17 through 21 in the following are screenshots from Invincea's Threat Management console from various RTB-based malvertising incidents with highlighted URLs for malvertising delivered via RTB ad bidding.

malvertising

RTB ad bidding

delivered

via


Input: In September and October of 2014, Invincea saw a sharp spike of malvertising delivering CryptoWall ransomware attacks via Real Time Ad Bidding.

malvertising

CryptoWall ransomware attacks

Real Time Ad Bidding

delivering

via


Input: We observed Real Time Ad bidding platforms, including OpenX, GoogleAds, Yahoo, AOL, and first-impression.com, fall victim to the ransomware malvertising scheme by unwittingly delivering the CryptoWall 2.0 ransomware ads.

Real Time Ad bidding platforms, including OpenX, GoogleAds, Yahoo, AOL, and first-impression.com

the CryptoWall 2.0 ransomware ads

delivering


Input: Ransomware is a particularly pernicious form of malware that fully encrypts the victim's disk and data files, including remote storage, then demands payment of anywhere from $300 to $1000 in return for the decryption key.

Ransomware

the victim's disk and data files, including remote storage

encrypts


Input: Users are held hostage from their own work, pictures, personal, and proprietary material.


Input: To learn more about the scourage of ransomware, see this blog.


Input: Based on analysis of Invincea logs in would-be victims targeted by these ads, we have insight into the attacker that is delivering the malicious ads.

the attacker

the malicious ads

is delivering


Input: According to Invincea analysis of ads delivered from first- impression.com, winning ad bids ranging from as low as 30 cents and as high as $1.70, were delivered by a block of unique identifiers.


Input: It is highly likely that the same attackers are using other RTB ad platforms.


Input: This campaign matches the characteristics described by Proofpoint in its blog in terms of the exploitation methods.


Input: Legitimate ad copy is stolen, 3rd party ad networks used to distribute malware, and popular ad- supported websites displaying the malicious ads that exploit unsuspecting visitors with drive-by web exploits.

3rd party ad networks

distribute malware

the malicious ads

unsuspecting visitors

drive-by web exploits

used

exploit

to

with


Input: Merely visiting any ad-supported site may result in a CryptoWall ransomware infection.

visiting any ad-supported site

a CryptoWall ransomware infection

result

in


Input: Cryptowall 2.0 utilizes the TOR network to hide its communications, but it quickly encrypts all local files on the disk, and demands bitcoin payment to unlock the files.

Cryptowall 2.0

the TOR network

hide its communications

it

all local files on the disk

utilizes

encrypts

to


Input: Many companies have fallen prey to this attack over the past few months, making this one of the most successful Ransomware campaigns to date.


Input: Below is a typical Cryptowall 2 infection as seen in the Invincea Management Server logs.


Input: This winning ad placement ran on sports.yahoo.com–an Alexa Top 4 rated site.


Input: Highlighted in order in Figure 22 is the common filename of obupdat.exe, which has ever changing hashes, followed by the TOR port, and the 3rd party ad platform of first-impression.com.


Input: Analysis (Original report): Timeline Analysis (Original Report): Below in Figure 23 is the timeline of the Tor connections and SSL connections employed by CryptoWall.


Input: In addition, you can see the ransom note being written to disk on an infected machine in the audit logs in Figure 24.

the ransom note

disk

an infected machine

being written

to

on


Input: Figure 25 shows the winning malvertising bid via RTB ad delivery from first-impression.com.


Input: Items highlighted in the URL below is userid, and the winning bid price to place malvertising of Cryptowall on sports.yahoo.com, which is 60 cents.

place

malvertising of Cryptowall

sports.yahoo.com

on


Input: In Figure 26 below, we show the unique identifiers for the userID and campaigns to deliver CryptoWall malware that were blocked and audited by Invincea, including the websites that delivered the ads via a third-party ad network over the past month.


Input: To reiterate, neither the websites listed here, nor the 3rd party ad network, necessarily was aware of the malicious ads they were serving to the website visitors.


Input: It is likely they were not aware without ad screening technology.


Input: In each event above, Invincea blocked an attempt to infect an endpoint with Cryptowall 2.0 and prevented CryptoWall from encrypting the user's file system and holding it hostage.


Input: Had the user not been running Invincea, the attack would likely have been successful, and the only way the user would have had to recover the encrypted files would be to pay the attacker the ransom.


Input: This is an effective ransom technique, and one that is paying off well for the attackers, who use the income from the attacks to purchase Real Time Ad Bids on RTB networks to infect more users.


Input: Most RTB ad providers allow for advertisers to host their own ad content.


Input: This allows advertisers to directly collect web impression data of who is hitting which ads, from where, by which IPs, which user- agent strings, and just about anything else you could log about a website visit.


Input: In addition, the advertising network doesn't have to utilize their own disk space to host the image files, the flash videos or other online content.


Input: RTB networks simply do the auctioneering and redirection to the winning content.


Input: It is this weakness in security that malvertisers are taking advantage of.


Input: If ad networks were to switch to a model where all content is actually hosted by them (1st party hosting), in a cloud, then the risk of malvertising would drop dramatically.


Input: The RubiconProject has a Seller's Cloud, which could be a security model for the RTB industry.


Input: It is inherently more secure way of hosting ad content.


Input: Operation DeathClick is an active campaign to micro-target companies via malvertising in order to compromise their networks.

Operation DeathClick

companies

malvertising

compromise their networks

micro-target

via

in order to


Input: Unfortunately, the micro-targeting malvertising technique evades almost all network controls and traditional endpoint anti-virus solutions.

the micro-targeting malvertising technique

almost all network controls and traditional endpoint anti-virus solutions

evades


Input: Invincea can protect users from this attack type among other targeted and opportunistic web-based threats.


Input: For half the price of a candy bar, attackers have the unprecedented ability to deliver malware to you through your web browser simply because of your IP address space and your industry vertical.

attackers

malware

you

your web browser

your IP address space and your industry vertical

deliver

to

through

because of


Input: Most of the attacks featured here were not detected by standard Anti-Virus because the malware hashes constantly change.

Most of the attacks featured here

standard Anti-Virus

the malware hashes constantly change

were not detected

because


Input: Web proxy blocking updates, even in real time, will not stop new malvertising landing pages that appear and disappear within minutes.


Input: Intelligence feeds from the premier intelligence providers, based on hostname, IP, URL or domain will not be able to block malicious malvertisers quickly enough.


Input: Invincea protected users can simply browse and click anything online without fear of compromise or targeted malvertising attacks.


Input: Non-Invincea users can attempt to OptOut of directed targeting where you can.


Input: European privacy laws for forcing most ad providers to offer the opt-out service; however, you often have to visit each ad provider individually to choose to opt out.


Input: Note, that opting out merely places a blocking cookie in your browser.


Input: This means that ad providers will not target or retarget based on cookies.


Input: But as shown above, the new targeted advertising is via IP intelligence.


Input: 10/27: For clarification, Invincea has added additional notes in this version that the websites shown here and the 3rd party real-time ad networks are being used unwittingly and their resources misappropriated by malvertisers to target companies for persistent remote access, click fraud, and other nefarious activities.


Input: This is not a reflection on these companies, nor the services they provide.


Input: This paper highlights the problem for greater awareness so the industry collectively can combat this problem perhaps with more effective screening at the source prior to displaying ads.


Input: In May 2014, the U.S. Department of Justice charged five Chinese nationals for economic espionage against U.S. corporations.


Input: The five known state actors are officers in Unit 61398 of the Chinese People's Liberation Army (PLA).


Input: In response, the Chinese government stated that the claims were'' absurd'' and based on'' fabricated facts''.


Input: China then went even further, stating'' The Chinese government, the Chinese military and their relevant personnel have never engaged or participated in cyber theft of trade secrets.


Input: '' We believe that organizations, be they governments or corporations, global or domestic, must keep up the pressure and hold China accountable until lasting change is achieved.


Input: Not only did the U.S. Government offer in its criminal indictment the foundation of evidence designed to prove China's culpability in electronic espionage, but also illustrated that the charges are only the tip of a very large iceberg.


Input: Those reading the indictment should not conclude that the People's Republic of China (PRC) hacking campaign is limited to five soldiers in one military unit, or that they solely target the United States government and corporations.


Input: Rather, China's decade-long economic espionage campaign is massive and unrelenting.


Input: Through widespread espionage campaigns, Chinese threat actors are targeting companies and governments in every part of the globe.


Input: At CrowdStrike, we see evidence of this activity first-hand as our services team conducts Incident Response investigations and responds to security breaches at some of the largest organizations around the world.


Input: We have first-hand insight into the billions of dollars of intellectual property systematically leaving many of the largest corporations-often times unbeknownst to their executives and boards of directors.


Input: The campaign that is the subject of this report further points to espionage activity outside of Unit 61398, and reveals the activities of Unit 61486.


Input: Unit 61486 is the 12th Bureau of the PLA's 3rd General Staff Department (GSD) and is headquartered in Shanghai, China.


Input: The CrowdStrike Intelligence team has been tracking this particular unit since 2012, under the codename PUTTER PANDA, and has documented activity dating back to 2007.


Input: The report identifies Chen Ping, aka cpyy, and the primary location of Unit 61486.


Input: This particular unit is believed to hack into victim companies throughout the world in order to steal corporate trade secrets, primarily relating to the satellite, aerospace and communication industries.


Input: With revenues totaling $189.2 billion in 2013, the satellite industry is a prime target for espionage campaigns that result in the theft of high-stakes intellectual property.


Input: While the gains from electronic theft are hard to quantify, stolen information undoubtedly results in an improved competitive edge, reduced research and development timetables, and insight into strategy and vulnerabilities of the targeted organization.


Input: Parts of the PUTTER PANDA toolset and tradecraft have been previously documented, both by CrowdStrike, and in open source, where they are referred to as the MSUpdater group.


Input: This report contains details on the tactics, tools, and techniques used by PUTTER PANDA, and provides indicators and signatures that can be leveraged by organizations to protect themselves against this activity.


Input: Our Global Intelligence Team actively tracks and reports on more than 70 espionage groups, approximately half of which operate out of China and are believed to be tied to the Chinese government.


Input: This report is part of our extensive intelligence library and was made available to our intelligence subscribers in April 2014, prior to the US Government's criminal indictment and China's subsequent refusal to engage in a constructive dialog.


Input: Targeted economic espionage campaigns compromise technological advantage, diminish global competition, and ultimately have no geographic borders.


Input: We believe the U.S. Government indictments and global acknowledgment and awareness are important steps in the right direction.


Input: In support of these efforts, we are making this report available to the public to continue the dialog around this ever-present threat.


Input: CrowdStrike has been tracking the activity of a cyber espionage group operating out of Shanghai, China, with connections to the People's Liberation Army Third General Staff Department (GSD) 12th Bureau Military Unit Cover Designator (MUCD) 61486, since 2012.


Input: The attribution provided in this report points to Chen Ping, aka cpyy (born on May 29, 1979), as an individual responsible for the domain registration for the Command and Control (C2) of PUTTER PANDA malware.


Input: In addition to cpyy, the report identifies the primary location of Unit 61486.


Input: PUTTER PANDA is a determined adversary group, conducting intelligence-gathering operations targeting the Government, Defense, Research, and Technology sectors in the United States, with specific targeting of the US Defense and European satellite and aerospace industries.


Input: The PLA's GSD Third Department is generally acknowledged to be China's premier Signals Intelligence (SIGINT) collection and analysis agency, and the 12th Bureau Unit 61486, headquartered in Shanghai, supports China's space surveillance network.


Input: Domains registered by Chen Ping were used to control PUTTER PANDA malware.


Input: These domains were registered to an address corresponding to the physical location of the Shanghai headquarters of 12th Bureau, specifically Unit 61486.


Input: The report illuminates a wide set of tools in use by the actors, including several Remote Access Tools (RATs).

a wide set of tools

the actors

several Remote Access Tools (RATs)

use

including


Input: The RATs are used by the PUTTER PANDA actors to conduct intelligence-gathering operations with a significant focus on the space technology sector.

The RATs

the PUTTER PANDA actors

intelligence-gathering operations

are used

conduct


Input: This toolset provides a wide degree of control over a victim system and can provide the opportunity to deploy additional tools at will.

This toolset

a wide degree of control over a victim system

additional tools

will

provides

deploy

at


Input: They focus their exploits against popular productivity applications such as Adobe Reader and Microsoft Office to deploy custom malware through targeted email attacks.

They

custom malware

targeted email attacks

deploy

through


Input: This report contains additional details on the tactics, tools, and techniques used by PUTTER PANDA, and provides indicators and signatures that can be leveraged by organizations to protect themselves against this activity.


Input: ➔ Putter Panda is a cyber espionage actor that conducts operations from Shanghai, China, likely on behalf of the Chinese People's Liberation Army (PLA) 3rd General Staff Department 12th Bureau Unit 61486.


Input: This unit is supports the space based signals  intelligence (SIGINT) mission.


Input: ➔ The 12th Bureau Unit 61486, headquartered in Shanghai, is widely accepted to be China's primary SIGINT collection and analysis agency, supporting China's space surveillance network.


Input: ➔ This is a determined adversary group, conducting intelligence- gathering operations targeting the Government, Defense, Research, and Technology sectors in the United States, with specific targeting of space, aerospace, and communications.


Input: ➔ They focus their exploits against popular productivity applications such as Adobe Reader and Microsoft Office to deploy custom malware through targeted email attacks.

They

custom malware

targeted email attacks

deploy

through


Input: ➔ CrowdStrike identified Chen Ping, aka cpyy, a suspected member of the PLA responsible for procurement of the domains associated with operations conducted by Putter Panda.


Input: ➔ The group has been operating since at least 2007 and has been observed heavily targeting the US Defense and European satellite and aerospace industries.


Input: ➔ There is infrastructure overlap with Comment Panda, and evidence of interaction between actors tied to both groups.


Input: There are several pieces of evidence to indicate that the activity tracked by CrowdStrike as PUTTER PANDA is attributable to a set of actors based in China, operating on behalf of the Chinese People's Liberation Army (PLA).


Input: Specifically, an actor known as cpyy (Chen Ping) appears to have been involved in a number of historical PUTTER PANDA campaigns, during which time he was likely working in Shanghai within the 12th Bureau, 3rd General Staff Department (GSD).


Input: PUTTER PANDA has several connections to actors and infrastructure tied to COMMENT PANDA, a group previously attributed to Unit 61398 of the PLA.


Input: Although some of the domains used for command and control of the tools described later in this report appear to be legitimate sites that have been compromised in some way, many of them appear to have been originally registered by the operators.

some of the domains

command and control of the tools described later in this report

used

for


Input: Table 1 shows the domains that appear to have been registered by these actors, and the original email address used where known.


Input: The most significant finding is that an actor known as cpyy appears to have registered a significant number of C2 domains.


Input: This actor is discussed in the next section.


Input: Many of the domains have had their registrant information changed, likely in an attempt to obfuscate the identity of the operators.


Input: For instance, several domains originally registered by cpyy had their email address updated to van.dehaim @gmail.com around the end of 2009; for siseau.com the change occurred between July 2009 and November 2009, and for vssigma.com, the change occurred between August 2009 and December 2009.


Input: Historical registrant information for anfoundation.us, rwchateau.com, and succourtion.org was not available prior to 2010, but it is likely that these domains were also originally registered to a personally attributable email account.


Input: Similarly, several domains registered to mike.johnsonmj @yahoo.com have had their registrant email updated during March 2014 (see Table 2).


Input: These registrant changes may indicate an increased awareness of operational security (OPSEC) from the PUTTER PANDA actors.


Input: The recent changes to the domains shown in Table 2 may indicate that the operators are preparing new campaigns that make use of this infrastructure, or they are attempting to disassociate all these.


Input: Although no attributable information was found on the email addresses associated with the domains described above (aside from cpyy and httpchen–see below), several other domains were found to have been registered by some of these addresses.


Input: These are shown in Table 3, and may be used for command and control of PUTTER PANDA tools.

These

command and control of PUTTER PANDA tools

be used

for


Input: domains from a single email address, perhaps due to OPSEC concerns or issues with the specific email account.


Input: The subdomains associated with these domains via DNS records, along with some of the domain names themselves, point to some areas of interest for the PUTTER PANDA operators (see also Droppers in the following Technical Analysis section): • Space, satellite, and remote sensing technology (particularly within Europe); • Aerospace, especially European aerospace companies; • Japanese and European telecommunications.


Input: It is likely that PUTTER PANDA will continue to attack targets of this nature in future intelligence- gathering operations.


Input: Based on passive DNS records, several PUTTER PANDA associated domains have resolved to IP address 100.42.216.230: Additionally, several subdomains of ujheadph.com resolved to this IP: Another subdomain of ujheadph.com has been observed in connection with distinctive traffic originating from the 3PARA RAT (described below), making it probable that this domain is also associated with PUTTER PANDA.


Input: The decipherment.net domains resolved to this IP address from 11 October 2012 to at least 25 February 2013, and the botanict.com domain resolved from 11 October 2012 to 24 March 2013.


Input: During part of this timeframe (30 June 2012-30 October 2012), a domain associated with COMMENT PANDA resolved to this same IP address: login.


Input: Additionally, for a brief period in April 2012, update8.firefoxupdata.com also resolved to this IP address.


Input: The use of the same IP address during the same time suggests that there is perhaps some cooperation or shared resources between COMMENT PANDA and PUTTER PANDA.


Input: Although not as conclusive as the links to COMMENT PANDA, IP address 31.170.110.163 was associated with VIXEN PANDA domain blog.


Input: strancorproduct.info from November to December 2013.


Input: In February 2014, this IP address was also associated with PUTTER PANDA domain ske.hfmforum.


Input: com.


Input: While not directly overlapping, this potential infrastructure link is interesting, as VIXEN PANDA has previously displayed TTPs similar to COMMENT PANDA (other CrowdStrike reporting describes VIXEN PANDA malware that extracts C2 commands embedded between delimiters in web content), and has extensively targeted European entities.


Input: 11 Several email addresses have been associated with cpyy, who also appears to use the alternate handles cpiyy and cpyy.chen: The cpyy.net domain lists'' Chen Ping'' as the registrant name, which may be cpyy's real name, as this correlates with the initials'' cp'' in'' cpyy''.


Input: A personal blog for cpyy was found at http: //cpiyy.blog.163.com/.


Input: The profile on this blog (shown in Figure 2 below) indicates that the user is male, was born on 25 May 1979, and works for the'' military/police'' (其他- 军人/警察).


Input: This blog contains two postings in the'' IT'' category that indicate at least a passing interest in the topics of networking and programming.


Input: A related CSDN profile for user cpiyy indicates that cpyy was working on or studying these topics in 2002 and 2003.


Input: Another personal blog for cpyy (http: //www.tianya.cn/1569234/bbs) appears to have last been updated in 2007.


Input: This states that the user lives in Shanghai, and has a birthdate identical to that in the 163.com blog.


Input: cpyy was also active on a social networking site called XCar, stating that he lived in Shanghai as early as 2005 through 2007; he said in a post,'' Soldier's duty is to defend the country, as long as our country is safe, our military is excellent'', indicating a feeling of patriotism that could be consistent with someone who chose a military or police-based career.


Input: On the XCar forum, cpyy.chen used a subforum called POLO (hacker slang for'' Volkswagen cars'') to communicate with other users Linxder, peggycat,'' Naturally do not understand romance'' (天生不懂浪漫),'' a wolf'' (一只大灰狼),'' large tile'' (大瓦片),'' winter'' (冬夜),'' chunni'' (春妮), papaya, kukuhaha, Cranbing,'' dusty sub'' (多尘子), z11829,'' ice star harbor'' (冰星港),'' polytechnic Aberdeen'' (理工仔),'' I love pineapple pie'' (我爱菠罗派), and'' she's distant'' in 2007.


Input: Although superficially the discussion is about cars, there is a repeated word in the text,'' milk yellow package'' or'' custard package'' or'' yoke package'' (奶黄包).


Input: This could be a hacker slang word, but it is unclear as to the definition.


Input: The conversation alludes to Linxder being the'' teacher'' or'' landlord'' and the other aforementioned users are his'' students''.


Input: Linxder references how he has'' found jobs'' for them.


Input: It is possible that this is a reference to hacking jobs wrapped up in car metaphors.


Input: Linxder is the handle of an actor associated with the likely Shanghai-based COMMENT PANDA group.


Input: Linxder, cpyy, and xiaobai have all discussed programming and security related topics on cpyy's site, cpyy.org, which hosted a discussion forum for the 711 Network Security Team (see below).


Input: cpyy also appears to have a keen interest in photography; his 163.com blog includes several photographs taken by cpyy in the blog postings and albums section.


Input: Some of these photographs also appear in a Picasa site (examples are shown in Figures 5 and 6) belonging to a user cpyy.chen.


Input: An album in this site named'' me'' has several shots of what is likely cpyy himself, from 2005, 2006, and 2007, shown to the right: An account on rootkit.com, a popular low-level software security site, existed for user cpyy and was accessed in at least May 2004.


Input: This account was registered with primary email address cpyy @cpyy.net and backup email address cpyy @hotmail.com; it listed a date of birth as 24 May 1979, consistent with cpyy's other profiles.


Input: The IP address 218.242.252.214 was associated with this account; it is owned by the Oriental Cable Network Co., Ltd., an ISP located in Shanghai.


Input: Registration on this forum shows that cpyy had an interest in security-related programming topics, which is backed up by the postings on his personal blog and CSDN account.


Input: One of the sites registered to cpyy was used to host a web-based email service, along with a forum on www.


Input: cpyy.net.


Input: Both of these services were apparently run by the 711 Network Security Team (711网络安全小组), a group that is now likely defunct, but has previously published security-based articles that have been re-posted on popular Chinese hacking sites such as xfocus.net.


Input: One of these articles, entitled'' IMD-based packet filtering firewall to achieve the principles'', is apparently authored by xiaobai, with email address xiaobai @openfind.com.cn; it was published on the'' GRATEFUL'' (饮水思源) security digest list that is hosted by Shanghai Jiao Tong University (SJTU).


Input: This digest list/bulletin board was also frequented by ClassicWind, an actor possibly linked to the Shanghai-based, PLA-sponsored adversary group COMMENT PANDA, as described in.


Input: This Tipper also indicates that'' the Chinese Communist Party (CCP) and the People's Liberation Army (PLA) aggressively target SJTU and its School of Information Security Engineering (SISE) as a source of research and student recruitment to conduct network offense and defense campaigns'', so it is possible that the 711 Network Security Team members came to the attention of the Chinese state via this institution.


Input: An additional connection to SJTU comes from a C2 domain, checalla.com, used with the 4H RAT in 2008.


Input: This domain was registered to httpchen @gmail.


Input: com at the time, and this address was also used to make a posting on the GRATEFUL BBS (shown in Figure 7).


Input: The posting indicates that httpchen is located at the 闵行 (Minhang) campus of SJTU and was posting using IP address 58.196.156.15, which is associated with the China Education and Research Network (CERNET), a nationwide network managed by the Chinese Ministry of Education.


Input: It also states that httpchen is studying at the school of Information Security Engineering within SJTU.


Input: Several pieces of evidence indicate that cpyy probably has connections to, or is part of, the Chinese military–specifically the PLA Army.


Input: In addition to his declaration on his personal blog that he works for the'' military/ police'', and contacts with actors such as Linxder that have been previously associated with hacking units within the PLA, cpyy's Picasa site contains several photographs that hint at military connections.


Input: First, a monochrome picture from the 大学时代 ('' college'') album posted in February 2007 shows several uniformed individuals: It is not clear whether this picture includes cpyy, or just friends/ associates/relatives.


Input: A picture from the 中学时代 ('' high school'') album posted in February 2007 shows a male–likely cpyy based on the clothing shown in the second picture, which matches the pictures of cpyy shown above–performing exercise in front of a group of likely soldiers and an officer: Although somewhat unclear, pictures from the album 2002年的生日 ('' 2002 birthday''), also posted in February 2007, show the celebrant (likely cpyy) in khaki clothes that are possibly military wear.


Input: The most compelling pictures, however, are found in the 宿舍 and 办公室 albums ('' dormitory'' and'' office'').


Input: A shot of probably cpyy's dormitory room shows in the background two military hats that appear to be Type 07 PLA Army officer peak hats: 18 This album also contains a shot of the exterior of a building with several large satellite dishes outside: This same building and the satellite dishes also appear in the'' office'' album.


Input: The reflection effects observed on the windows of this building could be due to coatings applied to resist eavesdropping via laser microphones and to increase privacy, which would be consistent with a military installation conducting sensitive work.


Input: Above is an image from the same album of what appears to be a larger dish, in front of the Oriental Pearl Tower, a significant landmark in Shanghai: As mentioned above, checalla.com was used for command and control with the PUTTER PANDA 4H RAT in 2008.


Input: This domain was registered to httpchen @gmail.com, and in May 2009 the domain registration details were updated to include a Registrant Address of'' shanghai yuexiulu 46 45 202 #''.


Input: A search for this location reveals an area of Shanghai shown in Figure 8.


Input: Figure 9 shows an enlargement of satellite imagery from within this area, depicting a facility containing several satellite dishes within green areas, sports courts and a large office building.


Input: Satellite imagery from 2009 showing another aspect of this office building, along with a likely vantage point and direction of camera, alongside probably cpyy's photograph from the same angle, is shown in Figure 10: Based on the Shanghai location, and common features, it is highly likely that the location shown above is the same as that photographed by cpyy and shown in the'' office'' and'' dormitory'' albums.


Input: Further confirmation can be found from photos uploaded by a user on Panoramio who tags the image as being located in Chabei, Shanghai, China (31° 17' 18.86'' N 121° 27' 9.83'' E).


Input: This image is exceptionally similar to building shown in cpyy's'' office'' album (see Figure 11 below).


Input: According to a public report on the Chinese PLA's General Staff Department (GSD), the 12th Bureau of the 3rd GSD is headquartered in the Zhabei district of Shanghai and'' appears to have a functional mission involving satellites, likely inclusive of intercept of satellite communications and possibly space-based SIGINT collection''.


Input: The same report also lists a Military Unit Cover Designator (MUCD) of 61486 for this bureau.


Input: A webpage published on a Chinese government site detailing theatrical performances involving members of the PLA lists an address of'' 闸北区粤秀路46号'' (46 Yue Xiu Road, Zhabei District) for'' 总参61486部队'' (61486 Forces General Staff).


Input: A search for this location shows an identical area to that shown in Figure 8.


Input: It can therefore be concluded with high confidence that the location shown in cpyy's imagery, along with the satellite images above, is the headquarters of the 12th Bureau, 3rd GSD, Chinese PLA–also known as Unit 61486.


Input: This unit's suspected involvement in'' space surveillance'' and'' intercept of satellite communications'' fits with their observed targeting preferences for Western companies producing technologies in the space and imaging/remote sensing sectors.


Input: The size and number of dishes present in the area is also consistent with these activities.


Input: Observed build times for the PUTTER PANDA tools described in this report range from 2007 to late 2013, indicating that the actors have conducted several campaigns against their objectives over a period of several years.


Input: A build time analysis of all known samples is shown in Figure 1 below, relative to China time.


Input: Although this shows that there is some bias in the build time distribution to daylight or working hours in China, which is more significant if a possible three-shift system of hours is considered (0900-1200, 1400-1700, and 2000-2300), this evidence is not conclusive.


Input: There is also some evidence that build times are manipulated by the adversary; for example, the sample with MD5 hash bc4e9dad71b844dd3233cfbbb96c1bd3 has a build time of 18 July 2013, but was supposedly first submitted to VirusTotal on 9 January 2013.


Input: This shows that the attackers–at least in 2013–were aware of some operational security considerations and were likely taking deliberate steps to hide their origins.


Input: There is strong evidence to tie cpyy, an actor who appears to have been involved in historical PUTTER PANDA operations, to the PLA army and a location in Shanghai that is operated by the 12th Bureau, 3rd GSD of the PLA (Unit 61486).


Input: Another actor tied to this activity, httpchen, has declared publically that he was attending the School of Information Security Engineering at SJTU.


Input: This university has previously been posited as a recruiting ground for the PLA to find personnel for its cyber intelligence gathering units, and there is circumstantial evidence linked cpyy to other actors based at SJTU.


Input: Given the evidence outlined above, CrowdStrike attributes the PUTTER PANDA group to PLA Unit 61486 within Shanghai, China with high confidence.


Input: It is likely that this organization is staffed in part by current or former students of SJTU, and shares some resources and direction with PLA Unit 61398 (COMMENT PANDA).


Input: Several RATs are used by PUTTER PANDA.

Several RATs

PUTTER PANDA

are used


Input: The most common of these, the 4H RAT and the 3PARA RAT, have been documented previously by CrowdStrike in previous CrowdStrike Intelligence reporting.


Input: This analysis will be revisited below, along with an examination of two other PUTTER PANDA tools: pngdowner and httpclient.


Input: Two droppers have been associated with the PUTTER PANDA toolset; these are also briefly examined below.

Two droppers

the PUTTER PANDA toolset

been associated

with


Input: This RAT was first analyzed by CrowdStrike in April 2012, but a historical analysis shows that it has been in use since at least 2007 by the PUTTER PANDA actors.


Input: A listing of metadata for known samples, including C2 information, is shown in Appendix 1.


Input: The operation of this RAT is described in detail in other CrowdStrike reporting, but is useful to revisit here to highlight the characteristics of the RAT: • C2 occurs over HTTP, after connectivity has been verified by making a distinctive request (to the URI/search? qu= at www.google.com).

HTTP

connectivity has been verified by making a distinctive request (to the URI/search? qu= at www.google.com)

occurs

over

after


Input: • A victim identifier is generated from the infected machine's hard disk serial number, XOR'ed with the key ldd46! yo, and finally nibble-wise encoded as upper-case ASCII characters in the range (A-P)–e.g., the byte value 0x1F becomes'' BP''.

A victim identifier

the infected machine's hard disk serial number

is generated

from


Input: • A series of HTTP requests characterizes the RAT's C2.

A series of HTTP requests

the RAT's C2

characterizes


Input: The initial beacon uses a request with four parameters (h1, h2, h3, and h4)–as shown in Figure 8–to register the implant with the C2 server.

The initial beacon

a request with four parameters (h1, h2, h3, and h4)

register the implant with the C2 server

uses

to


Input: • Communication to and from the C2 server is obfuscated using a 1-byte XOR with the key 0xBE.

Communication to and from the C2 server

a 1-byte XOR with the key 0xBE

is obfuscated

using


Input: • The commands supported by the RAT enable several capabilities, including: The 3PARA RAT was described in some detail in other CrowdStrike reporting, which examined a DLL-based sample with an exported filename of ssdpsvc.dll.

The commands

the RAT

supported


Input: Other observed exported filenames are msacem.dll and mrpmsg.dll, although the RAT has also been observed in plain executable (EXE) format.


Input: On startup, the RAT attempts to create a file mapping named & *SDKJfhksdf89*DIUKJDSF & *sdfsdf78sdfsdf.

the RAT

a file mapping named & *SDKJfhksdf89*DIUKJDSF & *sdfsdf78sdfsdf

create


Input: This is used to prevent multiple instances of the RAT being executed simultaneously.

This

prevent multiple instances of the RAT being executed simultaneously

is used

to


Input: The RAT will then use a byte-wise subtraction- based algorithm (using a hard-coded modulo value) to decode C2 server details consisting of a server hostname and port number, in this example nsc.adomhn. com, port 80.

The RAT

a byte-wise subtraction- based algorithm (using a hard-coded modulo value)

decode C2 server details consisting of a server hostname and port number, in this example nsc.adomhn. com, port 80

use

to


Input: The decoding algorithm is illustrated in Figure 10 below.


Input: The key and modulo values vary on a per-sample basis.


Input: Decoded C2 settings, along with sample metadata, are listed in Appendix 2.


Input: The RAT is programmed in C++ using Microsoft Visual Studio, and it makes use of the object-oriented and parallel programming features of this environment; Standard Template Library (STL) objects are used to represent data structures such as strings and lists, and custom objects are used to represent some of the C2 command handlers (e.g., CCommandCMD).


Input: Several threads are used to handle different stages of the C2 protocol, such as receiving data from the server, decrypting data, and processing commands.

receiving

decrypting

processing

data

the server

data

commands

from


Input: Standard Windows primitives such as Events are used to synchronize across these threads, with a shared global structure used to hold state.


Input: Once running, the RAT will load a binary representation of a date/time value from a file C: \RECYCLER\restore.dat, and it will sleep until after this date/time has passed.

the RAT

a binary representation of a date/time value

a file C: \RECYCLER\restore.dat

it

this date/time has passed

load

sleep

from

until after


Input: Database provides a mechanism for the operators to allow the RAT to remain dormant until a fixed time, perhaps to allow a means of regaining access if other parts of their toolset are removed from a victim system.

the RAT

dormant

a fixed time

remain

until


Input: As with the 4H RAT, the C2 protocol used by the 3PARA RAT is HTTP based, using both GET and POST requests.

the C2 protocol

the 3PARA RAT

HTTP based

GET

POST requests

used

is

using


Input: An initial request is made to the C2 server (illustrated in Figure 11 above), but the response value is effectively ignored; it is likely that this request serves only as a connectivity check, as further C2 activity will only occur if this first request is successful.

An initial request

the C2 server

this request

a connectivity check

is made

serves

to

as


Input: In this case, the RAT will transmit some basic victim information to the C2 server along with a 256-byte hash of the hard-coded string HYF54 &% 9 & jkMCXuiS.

the RAT

some basic victim information to the C2 server

a 256-byte hash of the hard-coded string HYF54 &% 9 & jkMCXuiS

transmit

along with


Input: It is likely that this request functions as a means to authenticate the RAT to the C2 server and register a new victim machine with the controller.

this request

a new victim machine

the controller

register

with


Input: A sample request and its structure are shown in Figure 12.


Input: If this request is also successful, the RAT will attempt to retrieve tasking from the controller using a further distinctive HTTP request shown in Figure 13, repeating this request every two seconds until valid tasking is returned.

the RAT

tasking

the controller

a further distinctive HTTP request shown in Figure 13

retrieve

from

using


Input: Returned tasking is decrypted using the DES algorithm in CBC mode with a key derived from the MD5 hash of the string HYF54 &% 9 & jkMCXuiS (as used in the secondary beacon shown above).


Input: If this fails, the RAT will fall back to decoding the data using an 8-byte XOR with a key derived from data returned from the HashData API with the same key string.


Input: Output data produced by tasking instructions is encrypted in the same manner as it was decrypted and sent back to the C2 server via HTTP POST request to a URI of the form /microsoft/errorpost/ default.aspx? ID=, where the ID value is a random number in decimal representation–as with the initial request shown in Figure 4.

Output data produced by tasking instructions

the same manner as it was decrypted

the C2 server

HTTP POST request to a URI of the form /microsoft/errorpost/ default.aspx? ID=

is encrypted

sent

in

back to

via


Input: The set of commands supported by the RAT is somewhat limited, indicating that perhaps the RAT is intended to be used as a second-stage tool, or as a failsafe means for the attackers to regain basic access to a compromised system (which is consistent with its support for sleeping until a certain date/time).

The set of commands

the RAT

a certain date/time

supported

sleeping

until


Input: Some of the supported commands are implemented using C++ classes derived from a base CCommand class: •C CommandAttribe–Retrieve metadata for files on disk, or set certain attributes such as creation/ modification timestamps.


Input: • CCommandCD–Change the working directory for the current C2 session.


Input: •C CommandCMD–Execute a command, with standard input/output/error redirected over the C2 channel.


Input: • CCommandNOP–List the current working directory.


Input: However, other commands are not implemented in this way.


Input: These other commands contain functionality to: • Pause C2 activity for a random time interval.


Input: • Shutdown C2 activity and exit.


Input: •P rovide a date and time before which beaconing will not resume, recorded in the file C: \RECYCLER\ restore.dat as noted above.


Input: The use of C++ classes that inherit from a base class to carry out some of the tasking commands, along with the use of concurrency features, indicates that the developers of the RAT put some thought into the architecture and design of their tool, although the decision to implement some commands outside of the class-based framework is curious, and may indicate multiple developers worked on the RAT (or a single developer with shifting preferences for his coding style).


Input: The pngdowner malware is a simple tool constructed using Microsoft Visual Studio and implemented via single C++ source code file.


Input: This sample contains a PDB path of Y: \Visual Studio 2005\Projects\branch-downer\ downer\Release\downer.pdb, but other similar paths Z: \Visual Studio 2005\Projects\pngdowner\Release\ pngdowner.pdb and Z: \Visual Studio 2005\Projects\downer\Release\downer.pdb have also been observed in other samples.


Input: Appendix 3 lists metadata for known pngdowner samples.


Input: Initially, the malware will perform a connectivity check to a hard-coded URL (http: //www.microsoft.com), using a constant user agent Mozilla/4.0 (Compatible; MSIE 6.0;).

the malware

a connectivity check

a hard-coded URL (http: //www.microsoft.com)

a constant user agent Mozilla/4.0 (Compatible; MSIE 6.0;)

perform

to

using


Input: If this request fails, the malware will attempt to extract proxy details and credentials from Windows Protected Storage, and from the IE Credentials Store using publicly known methods15, using the proxy credentials for subsequent requests if they enable outbound HTTP access.

the malware

proxy details and credentials

Windows Protected Storage

the IE Credentials Store

publicly known methods15

extract

from

from

using


Input: An initial request is then made to the hard-coded C2 server and initial URI–forming a URL of the form (in this sample) http: //login.stream-media.net/files/xx11/index.asp? 95027775, where the numerical parameter represents a random integer.

An initial request

the hard-coded C2 server and initial URI

is then made

to


Input: A hard-coded user agent of myAgent is used for thisrequest, and subsequent communication with the C2 server.


Input: Content returned from this request to the C2 server will be saved to a file named index.dat in the user's temporary directory (i.e.,% TEMP%).


Input: This file is expected to contain a single line, specifying a URL and a filename.


Input: The malware will then attempt to download content from the specified URL to the filename within the user's temporary directory, and then execute this file via the WinExec API.

The malware

content

the specified URL

the filename within the user's temporary directory

this file

the WinExec API

download

execute

from

to

via


Input: If this execution attempt succeeds, a final C2 request will be made–in this case to a URL using the same path as the initial request (and a similarly random parameter), but with a filename of success.asp.

a final C2 request

a URL using the same path as the initial request (and a similarly random parameter)

be made

to


Input: Content returned from this request will be saved to a file, but then immediately deleted.


Input: Finally, the malware will delete the content saved from the first request, and exit.

the malware

the content saved from the first request

delete


Input: The limited functionality, and lack of persistence of this tool, implies that it is used only as a simple download- and-execute utility.

it

a simple download- and-execute utility

is used

as


Input: Although the version mentioned here uses C++, along with Visual Studios Standard Template Library (STL), older versions of the RAT (such as MD5 hash b54e91c234ec0e739ce429f47a317313), built in 2011, use plain C. This suggests that despite the simple nature of the tool, the developers have made some attempts to modify and perhaps modernize the code.


Input: Both versions contain debugging/progress messages such as'' down file success''.


Input: Although these are not displayed to the victim, they were likely used by the developers as a simple means to verify functionality of their code.


Input: Like pngdowner, the httpclient malware is a simple tool that provides a limited range of functionality and uses HTTP for its C2 channel.

the httpclient malware

HTTP

its C2 channel

uses

for


Input: This malware also initially performs a connectivity check to www.microsoft.com using the hard-coded user agent Mozilla/4.0 (Compatible; MSIE 6.0;), although in this variant no attempt is made to extract proxy credentials.

This malware

a connectivity check

the hard-coded user agent Mozilla/4.0 (Compatible; MSIE 6.0;)

performs

to

using


Input: The malware will then connect to its configured C2 infrastructure (file.anyoffice.info) and perform a HTTP request of the form shown in Figure 14 below: Content returned from the C2 server is deobfuscated by XOR'ing the content with a single byte, 0x12.

The malware

its configured C2 infrastructure (file.anyoffice.info)

a HTTP request of the form shown in Figure 14 below

connect

perform

to


Input: The decoded data is then checked for the string runshell.


Input: If this string is not present, the C2 request is repeated every 0.5 seconds.

the C2 request

0.5 seconds

is repeated

every


Input: Otherwise, a shell process is started (i.e., cmd.exe), with input/output redirected over the C2 channel.

a shell process

input/output redirected over the C2 channel

is started

with


Input: Shell commands from the server are followed by an encoded string $$$, which indicates that the shell session should continue.


Input: If the session is ended, two other commands are supported: m2b (upload file) and b2m (download file).

two other commands

file

file

are supported

upload

download


Input: Slight variations on the C2 URLs are used for different phases of the C2 interaction: Given the lack of a persistence mechanism and low level of sophistication, it is likely that httpclient–like pngdowner–is used as a second-stage or supplementary/backup tool.


Input: Appendix 4 lists metadata for observed httpclient samples.


Input: Other CrowdStrike reporting describes a dropper used by PUTTER PANDA (abc.scr) to install the 4H RAT.

a dropper

PUTTER PANDA

the 4H RAT

used

install


Input: This dropper uses RC4 to decrypt an embedded payload from data in an embedded resource before writing the payload to disk and executing it.

This dropper

the payload

disk

it

writing

executing

to


Input: Several instances of this dropper have been observed, most commonly in association with the 4H RAT, but also in relation to other tools that will be described in forthcoming reporting.


Input: Another dropper has been observed, exclusively installing the pngdowner malware (example MD5 hash 4c50457c35e2033b3a03fcbb4adac7b7).

Another dropper

the pngdowner malware (example MD5 hash 4c50457c35e2033b3a03fcbb4adac7b7)

installing


Input: This dropper is simplistic in nature, and is compiled from a single C++ source code file.


Input: It contains a Word document in plaintext (written to BienvenueaSahajaYogaToulouse.


Input: doc), along with an executable (Update.exe) and DLL (McUpdate.dll).


Input: The executable and DLL are both contained within the .data

The executable and DLL


Input: section of the dropper, obfuscated with a 16-byte XOR key (consisting of the bytes 0xA0–0xAF).

obfuscated

with

a 16-byte XOR key (consisting of the bytes 0xA0–0xAF)


Input: Both the document and executable are written to disk and the executed via the ShellExecute API (using the verb'' open'').

Both the document and executable

disk

the ShellExecute API (using the verb'' open'')

are written

executed

to

via


Input: The executable is also installed into the ASEP registry key HKCU\Software\Microsoft\Windows\ CurrentVersion\Run, with a value named McUpdate.

The executable

the ASEP registry key HKCU\Software\Microsoft\Windows\ CurrentVersion\Run

a value named McUpdate

is also installed

into

with


Input: Finally, the dropper deletes itself via a batch file.

the dropper

itself

a batch file

deletes

via


Input: The dropped executable (MD5 hash 38a2a6782e1af29ca8cb691cf0d29a0d) primarily aims to inject the specified DLL (McUpdate.dll, MD5 hash 08c7b5501df060ccfc3aa5c8c41b452f) into a process that would normally be accessing the network, likely in order to disguise the malicious activity.

The dropped executable (MD5 hash 38a2a6782e1af29ca8cb691cf0d29a0d)

the specified DLL (McUpdate.dll, MD5 hash 08c7b5501df060ccfc3aa5c8c41b452f)

a process that would normally be accessing the network

the malicious activity

inject

disguise

into


Input: Module names corresponding to Outlook Express (msinm.exe), Outlook (outlook.exe), Internet Explorer (iexplore.exe), and Firefox (firefox.exe) are used.


Input: If Internet Explorer is used, then the malware will attempt to terminate processes corresponding to two components of Sophos Anti-Virus (SAVAdminService.exe and SavService.exe).

the malware

processes corresponding to two components of Sophos Anti-Virus (SAVAdminService.exe and SavService.exe)

terminate


Input: Four examples of these droppers were located, using a mixture of decoy PDF and Microsoft Word documents (shown below in Figures 15-18).

these droppers

a mixture of decoy PDF and Microsoft Word documents

using


Input: The common theme throughout these documents is space technology (BienvenueaSahajaYogaToulouse.doc does not follow this trend, but could be targeted at workers at the Toulouse Space Centre, the'' largest space centre in Europe''), indicating that the attackers have a keen interest in this sector, which is also reflected in the choice of name for some of the C2 domains used (see the Attribution section above).


Input: A number of specific and generic detection methods are possible for this RAT, both on a host and on the network.


Input: These are detailed below, and are designed to expand upon the indicators reported in other CrowdStrike reporting.


Input: The following Windows registry artifacts are indicative of a compromised host: redacted) The presence of the following file system artifacts is indicative of a compromised host: A file mapping named & *SDKJfhksdf89*DIUKJDSF & *sdfsdf78sdfsdf also indicates the victim machine is compromised with PUTTER PANDA malware.


Input: In addition the domains listed in the Appendices and in the Attribution section, the generic signatures below can be used to detect activity from the malware described in this report.


Input: In addition to the indicators described above, PUTTER PANDA have some distinct generic TTPs: PUTTER PANDA are a determined adversary group who have been operating for several years, conducting intelligence-gathering operations with a significant focus on the space sector.


Input: Although some of their tools are simplistic, taken as a whole their toolset provides a wide degree of control over a victim system and can provide the opportunity to deploy additional tools at will.

their toolset

a wide degree of control over a victim system

additional tools

will

provides

deploy

at


Input: Research presented in this report shows that the PUTTER PANDA operators are likely members of the 12th Bureau, 3rd General Staff Department (GSD) of the People's Liberation Army (PLA), operating from the unit's headquarters in Shanghai with MUCD 61486.


Input: Strategic objectives for this unit are likely to include obtaining intellectual property and industrial secrets relating to defense technology, particularly those to help enable the unit's suspect mission to conduct space surveillance, remote sensing, and interception of satellite communications.


Input: PUTTER PANDA is likely to continue to aggressively target Western entities that hold valuable information or intellectual property relevant to these interests.


Input: The detection and mitigation guidance given in this report will help to minimize the risk of a successful compromise by these actors, and future CrowdStrike reports will examine other elements of the PUTTER PANDA toolset.


Input: CrowdStrike Falcon Intelligence portal provides enterprises with strategic, customized, and actionable intelligence.


Input: Falcon Intelligence enables organizations to prioritize resources by determining targeted versus commodity attacks, saving time and focusing resources on critical threats.


Input: With unprecedented insight into adversary tools, tactics, and procedures (TTPs) and multi-source information channels, analysts can identify pending attacks and automatically feed threat intelligence via API to SIEM and thirdparty security tools.


Input: Access to CrowdStrike Falcon Intelligence is geared toward all levels of an organization, from the executivewho needs to understand the business threat and strategic business impact, to the front-line securiyt professional struggling to! ght through an adversary's attack against the enterprise.


Input: CrowdStrike Falcon Intelligence is a web-based intelligence subscription that includes full access to a variety of feature sets, including: CrowdStrike Falcon Host is an endpoint threat detection and response product that identifies unknown malware, detects zero-day threats, and prevents damage from targeted attacks in real-time.


Input: Falcon Host is comprised of two core components, the cloud-based management console and the on-premises host-based sensor that continuously monitors threat activity at the endpoint to prevent damage in real-time.


Input: Falcon Host leverages a lightweight kernel-mode sensor that shadows, captures, and correlates low- level operating system events to instantly identify the adversary tradecraft and activities through Stateful Execution Inspection (SEI) at the endpoint and Machine Learning in the cloud.


Input: As opposed to focusing on malware signatures, indicators of compromise, exploits, and vulnerabilities, Falcon Host instead identifies mission objectives of the adversary leveraging the Kill Chain model and provides realtime detection by focusing on what the attacker is doing, as opposed to looking nfor a specific, easily changeable indicator used in an attack.


Input: Without performing intrusive and performance- impacting scans of the system, Falcon Host's highly efficient real-time monitoring of all system activity is the only security solution that provides maximum visibility into all adversary activities, including Adversary-in-Motion: reconnaissance, exploitation, privilege escalation, lateral movement, and exfiltration.


Input: Falcon Host delivers insight into past and current attacks not only on a single host, but also across devices and networks.


Input: Stateful Execution inspection Stateful Execution Inspection (SEI) tracks execution state and links together various stages of the kill chain, from initial code execution to data exfiltration.


Input: CrowdStrike's Real-time Stateful Execution Engine performs inspection and analysis to understand the full context of a cyber attack.


Input: SEI is critical to understanding the entire attack life cycle and preventing the damage from advanced malware and targeted attacks.


Input: Existing security technologies that focus solely on malware signatures, incidators of compromise, exploits, and vulnerabilities fail to protect against the majority of attacks as they are blind to the full scope of adversary activity.


Input: CrowdStrike is a global provider of security technology and services focused on identifying advanced threats and targeted attacks.


Input: Using big-data technologies, CrowdStrike's next-generation threat protection platform leverages real-time Stateful Execution Inspection (SEI) at the endpoint and Machine Learning in the cloud instead of solely focusing on malware signatures, indicators of compromise, exploits, and vulnerabilities.


Input: The CrowdStrike Falcon Platform is a combination of big data technologies and endpoint security driven by advanced threat intelligence.


Input: CrowdStrike Falcon enables enterprises to identify unknown malware, detect zero-day threats, pinpoint advanced adversaries and attribution, and prevent damage from targeted attacks in real time.


Input: CrowdStrike Services is a wholly owned subsidiary of CrowdStrike responsible for proactively defending against and responding to cyber incidents with pre and post Incident Response services.


Input: CrowdStrike's seasoned team of Cyber Intelligence professionals, Incident Responders, and Malware Researchers consists of a number of internationally recognized authors, speakers, and experts who have worked on some of the most publicized and challenging intrusions and malware attacks in recent years.


Input: The CrowdStrike Services team leverages our Security Operations Center to monitor the full CrowdStrike Falcon Platform and provide cutting-edge advanced adversary intrusion detection services.


Input: The full spectrum of proactive and response services helps customers respond tactically as well as continually mature and strategically evolve Incident Response program capabilities.


Input: Context Information Security distribute Context Threat Intelligence (CTI) reporting under the Traffic Light Protocol (TLP), a method of classifying a document in order to promote the distribution of sensitive information between individuals, organisations or communities in a controlled and trusted way, based on the originator's wishes.


Input: The various levels of the TLP are represented by the following colours: Sources may use TLP: RED when information can not be effectively acted upon by additional parties, and could lead to impacts on a party's privacy, reputation, or operations if misused.


Input: Recipients may not share TLP: RED information with any parties outside of the specific exchange, meeting, or conversation in which it is originally disclosed.


Input: TLP: RED information will be passed verbally or in person.


Input: Sources may use TLP: AMBER when information requires support to be effectively acted upon, but carries risks to privacy, reputation, or operations if shared outside of the organisations involved.


Input: Recipients may only share TLP: AMBER information with members of their own organisation who need to know, and only as widely as necessary to act on that information.


Input: Sources may use TLP: GREEN when information is useful for the awareness of all participating organisations as well as with peers within the broader community or sector.


Input: Recipients may share TLP: GREEN information with peers and partner organisations within their sector or community, but not via publicly accessible channels such as publication or posting publicly on the Internet.


Input: Sources may use TLP: WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release.


Input: Subject to standard copyright rules, TLP: WHITE information may be distributed freely, without restriction.


Input: On 2nd January 2014 a Systems Administrator at the Monju fast breeder reactor facility in Japan noticed suspicious connections emanating from a machine in the control room, coinciding with what was a seemingly routine software update to a free media player.


Input: Among other items, staff training documents and more than 40,000 emails were stored on the machine and thought to be harvested by the attacker.

Among other items, staff training documents and more than 40,000 emails

the attacker

harvested


Input: The Japanese Atomic Energy Agency is investigating further.


Input: The attack appears to have been the result of the attackers having compromised the'GOM Player' update server and having it act as a'watering hole', meaning that machines which access the site are delivered malware.

the attackers

the'GOM Player' update server

it

a'watering hole'

machines which access the site

malware

compromised

act as

are delivered


Input: Gom Player originates in South Korea and in some parts of Asia it is a popular alternative to Windows Media Player.


Input: It is unclear whether every machine trying to download an update received this malware or whether only machines which fitted a certain profile were infected.


Input: Technical analysis of the implant on the compromised machine has shown it to be a variant of a Trojan which has been in the wild for some years now and continues to be effective.

it

a variant of a Trojan

be


Input: The'Gh0st RAT' has been used extensively in attacks linked to the Chinese state, though it is important to remember that the code is publicly available and can be modified and used by anyone.


Input: The targeting of a Japanese nuclear facility however, is consistent with Chinese state intelligence requirements.


Input: If this is the work of a Chinese group then we feel the targeting may go much further than the Civil Nuclear sector and thus be of interest to the wider Energy Sector and industry as a whole.


Input: In order to inform the Energy Sector and beyond about this attack, we have compiled a technical summary of the attack and have provided a number of Indicators Of Compromise (IOCs) which can be used to aid detection.


Input: It is likely that the attackers would redeploy their implant against other targets, albeit with a delivery mechanism more tailored to the location of the intended victims.


Input: Based on open source reporting, it appears that the intrusion took place via the compromise of the GOM Player update server (app.gomlab.com), where attackers may have gained entry via a PHP-based webshell, hidden within an image, present on the host since October 2011.

compromise

gained

the GOM Player update server (app.gomlab.com)

attackers

entry

a PHP-based webshell

via


Input: The observed malicious activity relates to the modification of a file that controls GOM Player updates, spanning the date range 27th December 2013 to 16th January 2014, during which time these alterations are reported to have only manifested themselves for visitors on certain IP ranges; evidence supporting this claim has not yet been made public.

these alterations

themselves

visitors on certain IP ranges

manifested

for


Input: If this was indeed the case, then the nature of this attack is certainly more targeted than one that would cover the entire userbase of the GOM Player product, with victims comprising of the Japanese Government in addition to those at the Monju nuclear facility.


Input: The modified file redirected the GOM Player update process to another compromised server (www.fudousankaitori.jp (203.189.101.35)), where a file containing both the legitimate update and the malware was deliver to the victim.

a file containing both the legitimate update and the malware

the victim

was deliver

to


Input: Deployed to the system via a compressed bundle containing the official GOM Player setup binary and a self-extracting RAR archive containing the malicious files, the malware consists of a number of individual pieces.

Deployed

to

via

the system

a compressed bundle containing the official GOM Player setup binary and a self-extracting RAR archive containing the malicious files

the malware


Input: Upon extraction from the RAR archive, the installer component (0ae82fd94836815a1e8d284ccb75109d) is automatically launched alongside the GOM Player update, distracting victims from the malicious activity taking place.

the installer component (0ae82fd94836815a1e8d284ccb75109d)

the GOM Player update

is automatically launched

alongside