Input: The installer component is referred to by the author as'miansha' which, according to an East Asia Cyber Threat Intelligence Researcher, is likely Miǎnshā (免杀), a phrase commonly used by People's Republic of China (PRC) hackers to mean'anti Antivirus detection' or'Antivirus avoidance'; Symantec have named the detection for this code'Backdoor.Miancha', where Miǎnchá (免查, likely shorthand for 免杀查) similarly means'Antivirus avoidance'.

Miǎnshā (免杀)

a phrase commonly used by People's Republic of China (PRC) hackers

'anti Antivirus detection' or'Antivirus avoidance'

Miǎnchá (免查, likely shorthand for 免杀查)

'Antivirus avoidance'

mean

similarly means


Input: The installer is responsible for the malware persistence mechanism, adding entries to the registry in the following locations, depending on Windows Version: The installer will also determine the system architecture (32- or 64-bit) and then deobfuscate the relevant loader DLL to the path'C: \Windows\temp\install.ocx', ensuring the malware is launched on system start-up.

The installer

responsible for the malware persistence mechanism

entries

the registry

the following locations

The installer

the system architecture (32- or 64-bit)

the relevant loader DLL to the path'C: \Windows\temp\install.ocx'

the malware is launched on system start-up

is

adding

determine

deobfuscate

ensuring

to

in


Input: Oddly, this file is padded with null bytes, resulting in a 25 megabyte file.


Input: The main implant code is stored in files named instructions.pdf and instructions64.pdf; not PDF documents but instead DLLs obfuscated with a one-byte XOR with 0x14, similar to the malware loader DLLs.

DLLs

a one-byte XOR with 0x14

obfuscated

with


Input: The loader, referred to by the malware author as 壳 (shell), reads and deobfuscates the main implant code which then communicates with the attacker-controlled server at testqweasd.tk (211.43.220.89) on TCP port 443.

The loader

the main implant code

the attacker-controlled server at testqweasd.tk (211.43.220.89)

TCP port 443

reads

deobfuscates

communicates

with

on


Input: The main implant code is referred to as 白加黑 ('Black on White'), a term used in the PRC hacking community to denote the act of Antivirus avoidance through the loading of malicious'black' code via non-malicious or trusted'white' code.

白加黑 ('Black on White')

a term used in the PRC hacking community

the act of Antivirus avoidance through the loading of malicious'black' code via non-malicious or trusted'white' code

denote


Input: This is a practice recently illustrated through the deployment of the PlugX trojan, utilising DLL load order hijacking alongside a signed (trusted) executable.

DLL load order

a signed (trusted) executable

hijacking

alongside


Input: Analysis of this malware revealed it to be a variant of the Gh0st RAT, often used by Chinese actors (including those who are state-motivated or directly state-sponsored).


Input: This specific variant shows similarities to that used during the VOHO campaign, where Gh0st RAT was spread via watering hole attacks utilising vulnerable websites belonging to financial services and technology companies.

Gh0st RAT

watering hole attacks utilising vulnerable websites belonging to financial services and technology companies

was spread

via


Input: Specifically, the initial five bytes of the communications (often used to denote a campaign or victim) are'HTTPS', amended from the original'Gh0st'; the same as the traffic produced by the VOHO Gh0st variant.


Input: In addition to delivering system-specific details back to the attacker, Gh0st RAT provides the capability to deploy additional malware, enabling the harvesting of sensitive data and enabling the further propagation throughout the infected network.

delivering

deploy

harvesting

enabling

system-specific details

the attacker

Gh0st RAT

additional malware

sensitive data

the further propagation throughout the infected network

back to


Input: To enable rapid response, the following Snort signature can be deployed: Additionally, the following Yara signature should identify both encoded payloads and the active implant in memory:


Input: The Darkhotel APT is a threat actor possessing a seemingly inconsistent and con- tradictory set of characteristics, some advanced and some fairly rudimentary.


Input: In- hospitably operating for almost a decade, the threat actor is currently active.


Input: The actor's offensive activity can be tied to specific hotel and business center Wi‑Fi and physical connections, some of it is also tied to p2p/file sharing networks, and they have been known to spear-phish targets as well.

they

targets

spear-phish


Input: Darkhotel tools are detected as'' Tapaoux'','' Pioneer'','' Karba'', and'' Nemim'', among other names.


Input: The following list presents a set of characteristics for the crew: When unsuspecting guests, including situationally aware corporate executives and high-tech entrepreneurs, travel to a variety of hotels and connect to the internet, they are infected with a rare APT Trojan posing as any one of several major software releases.

they

a rare APT Trojan

any one of several major software releases

are infected

posing

with

as


Input: These might be GoogleToolbar, Adobe Flash, Windows Messenger, etc.


Input: This first stage of malware helps the attackers to identify more significant victims, leading to the selective download of more advanced stealing tools.

the attackers

more significant victims

more advanced stealing tools

identify

download


Input: At the hotels, these installs are selectively distributed to targeted individuals.

these installs

targeted individuals

are selectively distributed

to


Input: This group of attackers seems to know in advance when these individuals will arrive and depart from their high-end hotels.


Input: So, the attackers lay in wait until these travelers arrive and connect to the Internet.


Input: The FBI issued advisories about similar hotel incidents; Australian government offi- cials produced similar, newsworthy accounts when they were infected.


Input: While an FBI announcement related to attacks on hotel guests overseas appeared in May 2012, related Darkhotel samples were already circulating back in 2007.


Input: And available Darkhotel server log data records connections as early as Jan 1, 2009.


Input: Addition- ally, seeding p2p networks with widely spread malware and 0-day spear-phishing attacks demonstrate that the Darkhotel APT maintains an effective toolset and a long-running operation behind the questionable hospitality it shows its guests.

seeding

p2p networks

widely spread malware and 0-day spear-phishing attacks

with


Input: The Darkhotel APT's precise malware spread was observed in several hotels' networks, where visitors connecting to the hotel's Wi-Fi were prompted to install software updates to popular software packages.

visitors connecting to the hotel's Wi-Fi

install software updates to popular software packages

were prompted

to


Input: Of course, these packages were really installers for Darkhotel APT's backdoors, added to legitimate installers from Adobe and Google.

these packages

really installers for Darkhotel APT's backdoors

were


Input: Digitally signed Darkhotel backdoors were installed alongside the legitimate packages.

Digitally signed Darkhotel backdoors

the legitimate packages

were installed

alongside


Input: The most interesting thing about this delivery method is that the hotels require guests to use their last name and room number to login, yet only a few guests received the Darkhotel package.

only a few guests

the Darkhotel package

received


Input: When visiting the same hotels, our honeypot research systems couldn't attract a Darkhotel attack.


Input: This data is inconclusive, but it points to misuse of check-in information.


Input: The Darkhotel actor maintained an effective intrusion set at hotel networks, providing ample access to unexpected points of attack over several years.


Input: These staging points also provide the attackers with access to check-in/check-out and identity information of visitors to high-end and luxury hotels.


Input: As a part of an ongoing investigation, our research led us to embedded iframes within hotel networks that redirected individuals' web browsers to phony install- ers.

embedded iframes within hotel networks

individuals' web browsers

phony install- ers

redirected

to


Input: The attackers were very careful with the placement of these iframes and executables on trusted resources-the hotels' network login portals themselves.


Input: The attackers were also very careful to immediately delete all traces of their tools as soon as an attack was carried out successfully.

The attackers

all traces of their tools

an attack was carried out successfully

delete

as soon as


Input: Those portals are now reviewed, cleaned and undergoing a further review and hardening process.


Input: We observed traces of a couple of these incidents in late 2013 and early 2014 on a victim hotel's network.


Input: The attackers set up the environment and hit their individual targets with precision.

The attackers

their individual targets

precision

hit

with


Input: As soon as their target's stay was over and the attack-frame was closed, the attackers deleted their iframe placement and backdoored executables from the hotel network.

the attackers

their iframe placement and backdoored executables

the hotel network

deleted

from


Input: The attackers successfully de- leted traces of their work from earlier attacks in another hotel, but their offensive techniques were the same.

The attackers

traces of their work

earlier attacks in another hotel

de- leted

from


Input: Outside reports of the same activity at other hotels provide enough data to confirm the same careful operations there.


Input: The attack technique blurs the line between a couple of common APT tactics; fairly inaccurate'' watering holes'' or'' strategic web compromises'' and more accurate spearphishing techniques.


Input: In this case, the Darkhotel attackers wait for their victim to connect to the Internet over the hotel Wi-Fi or the cable in their room.


Input: There is a very strong likelihood the targets will connect over these resourc- es, and the attackers rely on that likelihood, much like at a watering hole.


Input: But the attackers also maintain truly precise targeting information over the victim's visit, much like they would know a victim's email address and content interests in a spearphishing attack.

the attackers

truly precise targeting information

the victim's visit

maintain

over


Input: While setting up the attack, the Darkhotel attackers knew the target's expected arrival and departure times, room number, and full name, among other data.


Input: This data enables the attackers to present the malicious iframe precisely to that individual target.

the attackers

the malicious iframe

that individual target

present

precisely to


Input: So, here we have yet another unique characteristic of this attacker-they employ a loosely certain but highly precise offensive approach.


Input: An example of the Darkhotel APT's indiscriminate malware spreading is dem- onstrated by the way it seeds Japanese p2p sharing sites, where the malware is delivered as a part of a large (approximately 900mb) rar archive.

it

Japanese p2p sharing sites

the malware

a part of a large (approximately 900mb) rar archive

seeds

is delivered

as


Input: The archive is also spread over bittorrent, as detailed below.

The archive

bittorrent

is also spread

over


Input: Darkhotel uses this method to distribute their Karba Trojan.

Darkhotel

this method

distribute their Karba Trojan

uses

to


Input: These Japanese archives, translated for Chinese speaking viewers, appear to be sexual in nature, part of an anime sex/military comic scene, exposing the likely interests of potential targets.


Input: This Darkhotel package was downloaded over 30,000 times in less than six months.

This Darkhotel package

over 30,000 times

less than six months

was downloaded

in


Input: The p2p bittorrent Darkhotel offering is listed here, posted on 2013.11.22.


Input: It was spread throughout 2014.


Input: This torrent serves up an almost 900 mb file.


Input: The rar archive decompresses to a directory full of encrypted zips, the associated decryptor and a password file for decrypting the zips.


Input: But what looks like the AxDecrypt.exe decryptor is bound to both the true decryptor and the dropper for the Darkhotel Catch.exe Karba Trojan.

the AxDecrypt.exe decryptor

the dropper for the Darkhotel Catch.exe Karba Trojan

is bound

to


Input: When a user downloads the torrent and decrypts the zip files, the trojan surrepti- tiously is installed and run on the victim system.

the trojan

the victim system

is installed and run

on


Input: Catch.exe, detected as Backdoor.Win32.Agent.dgrn, communicates with the fol- lowing Darkhotel command and control servers: Other examples of this Darkhotel backdoor bound within a shared torrent include adult content Japanese anime and more.

Catch.exe

the fol- lowing Darkhotel command and control servers

this Darkhotel backdoor

a shared torrent

detected

communicates

bound

as

with

within


Input: There are tens of thousands of down- loads of these individual torrents.


Input: The associated Darkhotel backdoor was hosted on bittorrent, emule, etc, under a variety of comic names.

The associated Darkhotel backdoor

bittorrent, emule, etc,

a variety of comic names

was hosted

on

under


Input: Examples include comics and anime offerings.


Input: Related Darkhotel command and control server domains include: Darkhotel campaigns involving typical spear-phished Tapaoux implants publicly appeared in bits and pieces several times over the past five years.

Related Darkhotel command and control server domains

Darkhotel campaigns

typical spear-phished Tapaoux implants

include

involving


Input: These subproject efforts targeted defense industrial base (DIB), government, and NGO organizations.


Input: Email content on topics like nuclear energy and weaponry capabilities was used as a lure.


Input: Early accounts were posted on contagio describing attacks on NGO organi- zations and government policy makers.


Input: This spear-phishing activity continues into 2014.

This spear-phishing activity

continues

into


Input: The attacks follow the typical spear-phishing process and in the past couple of months, exploited systems retrieved downloader executables from web servers like Over the past few years the group has emailed links that redirect targets' brows- ers to Internet Explorer 0-day exploits.

The attacks

the typical spear-phishing process

exploited systems

downloader executables

web servers

the group

links

targets' brows- ers

Internet Explorer 0-day exploits

follow

retrieved

emailed

redirect

from

to


Input: Sometimes the attachment itself includes an Adobe 0-day exploit.

the attachment itself

an Adobe 0-day exploit

includes


Input: This crew occasionally deploys 0-day exploits, but burns them when required.


Input: In the past few years, they deployed 0-day spear-phishing attacks targeting Adobe products and Microsoft Internet Explorer, including cve20100188.

they

0-day spear-phishing attacks

Adobe products and Microsoft Internet Explorer, including cve20100188

deployed

targeting


Input: In early 2014, our researchers exposed their use of cve20140497, a Flash 0-day described on Securelist in early February.


Input: The crew spear-phished a set of target systems connected to the Internet through Chinese ISPs, and developed capabilities within the 0-day exploits to handle hardened Windows 8.1 systems.

The crew

a set of target systems connected to the Internet through Chinese ISPs

spear-phished


Input: It's interesting that the Flash objects were embedded in Korean documents titled'' List of the latest Japanese AV wind and how to use torrents.docx'' (loose English translation).

the Flash objects

Korean documents titled'' List of the latest Japanese AV wind and how to use torrents.docx'' (loose English translation)

were embedded

in


Input: The dropped downloader (d8137ded710d83e2339a97ee78494c34) delivered malcode similar to the'' Information Stealer'' component functionality summarized below, and detailed in Appendix D.

The dropped downloader (d8137ded710d83e2339a97ee78494c34)

malcode similar to the'' Information Stealer'' component functionality summarized below, and detailed in Appendix D

delivered


Input: The Darkhotel actors typically sign their backdoors with digital certificates of one kind or another.


Input: However, the certificates originally chosen by this crew are very interesting because of their weak keys and likely abuse by attackers.


Input: Here is a listing of the certs that were commonly used to sign Darkhotel malcode, requiring advanced mathematical capabilities to factorize the keys at the time.


Input: They are not the only certificates used by the group.


Input: More recent activity suggests that the group has stolen certificates to sign their code.


Input: All related cases of signed Darkhotel malware share the same Root Certificate Authority and Intermediate Certificate Authority that issued certificates with weak md5 keys (RSA 512 bits).


Input: We are confident that our Darkhotel threat actor fraudulently duplicated these certificates to sign its malware.


Input: These keys were not stolen.


Input: Many of the certificates were noted in a 2011 FoxIT post'' RSA512 Certificates Abused in the Wild''.


Input: To further support this speculation please note the nonspecific Microsoft Security Advisory below, the Mozilla advisory addressing the issue at the time, and the Entrust responses.


Input: From Microsoft's security advisory from Thursday, November 10, 2011:'' Microsoft is aware that DigiCert Sdn.


Input: Bhd, a Malaysian subordinate certifica- tion authority (CA) under Entrust and GTE CyberTrust, has issued 22 certifi- cates with weak 512 bit keys.


Input: These weak encryption keys, when broken, could allow an attacker to use the certificates fraudulently to spoof content, perform phishing attacks, or perform maninthemiddle attacks against all Web browser users including users of Internet Explorer.

an attacker

the certificates

fraudulently

spoof content

perform phishing attacks

perform maninthemiddle attacks against all Web browser users including users of Internet Explorer

use

to


Input: While this is not a vulnerability in a Microsoft product, this issue affects all supported releases of Microsoft Windows.


Input: There is no indication that any certificates were issued fraudulently.


Input: Instead, cryptographically weak keys have allowed some of the certificates to be dupli- cated and used in a fraudulent manner.


Input: Microsoft is providing an update for all supported releases of Microsoft Windows that revokes the trust in DigiCert Sdn.


Input: Bhd.


Input: The update revokes the trust of the following two intermediate CA certificates: Digisign Server ID–(Enrich), issued by Entrust.net Certification Authority (2048) Digisign Server ID (Enrich), issued by GTE CyberTrust Global Root'' From Mozilla's 2011 response:'' While there is no indication they were issued fraudulently, the weak keys have allowed the certificates to be compromised.


Input: Furthermore, certificates from this CA contain several technical issues.


Input: They lack an EKU extension specifying their intended usage and they have been issued without revocation information.


Input: '' From Entrust's response:'' There is no evidence that the Digicert Malaysia certificate authorities have been compromised.


Input: '' Here are some notes on the costs and technical requirements of attacking these certificates.


Input: The computing power required to crack and factor an RSA 512 bit key was $5000 and the period of time required was about 2 weeks.


Input: (see http: //lukenotricks.


Input: blogspot.co.at/2010/03/rsa512factoringservicetwoweeks.html) In October 2012, Tom Ritter reported that it would cost about $120- $150, per- haps even as little as $75.


Input: Going even further back, there was much discussion about the technical meth- ods of cracking these keys: DJ Bernstein's 2001 paper on building a machine reducing the cost of integer factorization with Number Field Sieve techniques, breaking 1024 bit RSA keys.


Input: RSA's reaction and 2002 statement on whether or not 1024 bit RSA keys are broken:'' NIST offered a table of proposed key sizes for discussion at its key man- agement workshop in November 2001 [7].


Input: For data that needs to be protected no later than the year 2015, the table indicates that the RSA key size should be at least 1024 bits.


Input: For data that needs to be protected longer, the key size should be at least 2048 bits.


Input: '' Recent Tapaoux attacks and backdoors include malware signed with strong SHA1/RSA 2048 bit certificates, suggesting certificate theft.


Input: One of the most interesting components that we discovered as a part of this cam- paign was the use of a digitallysigned advanced keylogger.

One of the most interesting components that we discovered as a part of this cam- paign

the use of a digitallysigned advanced keylogger

was


Input: It is clean, wellwritten, kernel level malcode.


Input: The languages of its strings are a mix of English and Korean.


Input: It is signed with the familiar'' belinda.jablonski @syniverse.com'' digital certificate.


Input: This keylogger is dropped by code running within svchost.exe on WinXP SP3, which maintains an interesting debug string: It probably was developed as a part of a mid-to-late 2009 project: e: \project\2009\x\totalsource\32bit\ndiskpro\src\ioman.c This driver package is built to resemble a legitimate low-level Microsoft system device.

This keylogger

code running within svchost.exe on WinXP SP3

This driver package

resemble a legitimate low-level Microsoft system device

is dropped

is built

by

to


Input: It is installed as a system kernel driver'' Ndiskpro'' service, described as a'' Microcode Update Device''.

It

a system kernel driver'' Ndiskpro'' service

is installed

as


Input: It is slightly surprising that no rootkit functionality hides this service: When loaded, the NDISKPRO.SYS driver hooks both INT 0x01 and INT 0xff, and retrieves keystroke data directly from port 0x60, the motherboard keyboard con- troller itself.

the NDISKPRO.SYS driver

both INT 0x01 and INT 0xff

keystroke data

port 0x60, the motherboard keyboard con- troller itself

hooks

retrieves

directly from


Input: It buffers, then communicates logged user data to the running user mode component.


Input: This component then encrypts and writes the retrieved values ondisk to a randomly named .tmp, file like ffffz07131101.tmp.

This component

the retrieved values ondisk

a randomly named .tmp, file like ffffz07131101.tmp

encrypts

writes

to


Input: This file is located in the same directory as the original dropper, which maintains persistence across reboots with a simple addition to the HKCU run key.

the original dropper

persistence

reboots

a simple addition to the HKCU run key

maintains

across

with


Input: This keylogger module encrypts and stores gathered data in a log file, as men- tioned previously.

This keylogger module

gathered data

a log file

encrypts

stores

in


Input: Its encryption algorithm is similar to RC4.


Input: The interesting part is that the module randomly generates the key and stores it in an unexpected place: in the middle of the log file name.


Input: Hence, the numeric part of the filename is used as a seed for the pseudorandom number generator.


Input: The rand function is statically linked to ensure same results on different computers.


Input: The Darkhotel toolset consists of multiple components that have been slightly modified over time.


Input: These tools are dropped by hotel installers spoofing legiti- mate software installers, bound within torrent bundles, or dropped by exploits or hypertext linked from spear-phishing emails.

These tools

hotel installers

legiti- mate software installers

torrent bundles

exploits

spear-phishing emails

are dropped

spoofing

bound

dropped

hypertext linked

within

from


Input: More advanced tools, like the keylogger decribed above, are later downloaded to the victim system by one of these implants.

More advanced tools, like the keylogger decribed above

the victim system

one of these implants

are later downloaded

to


Input: In a recent case, word docs embed- ded with 0-day flash swf files either dropped these backdoors or downloaded and executed backdoors from remote web servers.

word docs

0-day flash swf files

these backdoors

backdoors

remote web servers

embed- ded

dropped

downloaded

executed

with

from


Input: These tools pull down the keylog- ger, steal information from the system, or download other tools.

These tools

the keylog- ger

information

the system

other tools

pull down

steal

download

from


Input: The most interesting behaviors of these components include This module is quite small (27Kb) and comes as a part of WinRar SFX file that drops and starts the module from% APPDATA% \Microsoft\Crypto\DES64v7\msieckc.exe.

WinRar SFX file

the module

% APPDATA% \Microsoft\Crypto\DES64v7\msieckc.exe

drops

starts

from


Input: This module is designed to update malicious components through recurring checks at the C & C server.

This module

malicious components

recurring checks at the C & C server

update

through


Input: It is also capable of removing some older components, the names of which are hardcoded in the body of the malware.

It

some older components

removing


Input: The module adds autorun registry settings to enable an automatic start during system boot.

The module

autorun registry settings

enable an automatic start during system boot

adds

to


Input: One of the most interesting functions of this executable is its unusual delay and persistence.

One of the most interesting functions of this executable

its unusual delay and persistence

is


Input: If a special file exists on the system, the module will not start calling back to C & C server until the special file is 180 days old.


Input: So, if some other critical malicious component was removed during this period, current module backs up and restores access to the system within 6 months.

current module

access to the system within 6 months

backs up and restores


Input: The component gathers system information and sends it to the Darkhotel com- mand and control servers as detailed in Appendix D. This module is relatively large (455Kb) and comes as a part of a WinRar SFX file that drops and starts the module from% APPDATA% \Microsoft\Display\DmaUp3. exe.

The component

system information

it

the Darkhotel com- mand and control servers

a WinRar SFX file

the module

% APPDATA% \Microsoft\Display\DmaUp3. exe

gathers

sends

drops

starts

to

from


Input: The main purpose of the module is to collect various secrets stored on a lo- cal system and upload them to Darkhotel command and control servers: This module is designed to terminate itself on Windows with the system de- fault codepage set to Korean.

the module

various secrets stored on a lo- cal system

them

Darkhotel command and control servers

This module

itself

Windows with the system de- fault codepage set to Korean

collect

upload

terminate

to

on


Input: This malware is 220Kb in size.


Input: It was built as MFC framework application with a lot of extra calls that should have complicated the analysis of the sample.

a lot of extra calls

the analysis of the sample

complicated


Input: It mim- ics a GUI desktop application but it does not create any visible windows or dialogs to interact with local users.

It

a GUI desktop application

mim- ics


Input: The Trojan collects data about the system and anti malware software installed on it, and uploads that data to Darkhotel command and control servers.

The Trojan

data

the system

anti malware software installed on it

that data

Darkhotel command and control servers

collects

uploads

about

to


Input: More technical details are provided in Appendix D. This malware is 63kb in size.


Input: It is bound to a variety of other software packages that vary in name, but the host package is consistently detected as'' Virus.Win32.

It

a variety of other software packages that vary in name

is bound

to


Input: Pioneer.dx''.


Input: It drops the igfxext.exe'' selective infector'' component to disk and runs it.

It

the igfxext.exe'' selective infector'' component

disk

it

drops

runs

to


Input: This component is a virus, and is used to selectively infiltrate into other comput- ers via USB or network shares.

This component

other comput- ers

USB

network shares

infiltrate

into

via


Input: First, the virus retrieves all available disks and starting from disk number 4 (D:\) to disk number 20 (Z:\), finds executable files and infects them.

the virus

all available disks

executable files

them

retrieves

finds

infects


Input: The code simply brute forces the list of mapped removable drives.

The code

the list of mapped removable drives

brute forces


Input: During its infection routine, the infector changes the entrypoint of executable files, creates an .rdat section, and inserts a small loader in the section, then puts its main payload in the overlay.

the infector

the entrypoint of executable files

an .rdat section

a small loader

the section

its main payload

the overlay

changes

creates

inserts

puts

in

in


Input: Every infected file has functionality described in TrojanDropper & Injector section, so it can collect information about the comput- er, send it to the C2 and download other Darkhotel components as commanded.

Every infected file

functionality described in TrojanDropper & Injector section

it

information about the comput- er

it

the C2

other Darkhotel components

commanded

has

collect

send

download

to

as


Input: Observed downloaded components are signed with a familiar expired certificate from www.esupplychain.com.tw, issued by Cybertrust SureServer CA.


Input: Again, further technical details are provided in Appendix D. Almost every backdoor in this set maintains an internal campaign code or id, used in initial c2 communications as described above.

Almost every backdoor in this set

an internal campaign code or id, used in initial c2 communications as described above

maintains


Input: Some IDs appear to be related to geographic interests, others do not seem obvious.


Input: We gathered a list of Darkhotel campaign IDs shown below.


Input: Internal IDs and c2 resources overlap across these com- ponents, there is no pattern of distribution according to connectback resources.


Input: The most common id is'' DEXT87'': This infrastructure team appears to employ a lesser skillset than top notch campaigns, maintaining weak server configurations with limited monitoring and defensive reactions, and making some simple mistakes.


Input: However, they are ef- fective at maintaining a fully available infrastructure to support new and existing infections.


Input: Overall, victims in our sinkhole logs and KSN data were found across the globe, with the majority in Japan, Taiwan, China, Russia, Korea and Hong Kong.


Input: The following C & C domains have been sinkholed and redirected to the Kaspersky Sinkhole Server Our Kaspersky Security Network detected Darkhotel infections across thousands of machines, mostly related to the Darkhotel p2p campaigns.


Input: These geolocation estimates probably provide the most accurate picture of where Darkhotel activity is occurring.


Input: Here is a pie chart to better visualize the proportions of attack activity throughout the world.


Input: As you can see, over 90% of it occurs in the top five countries: Japan, followed by Taiwan, China, Russia and Korea.


Input: Because the operators very actively build up new command and control serv- ers, it is difficult to sinkhole enough domains to get an accurate overall picture of victim system location based on this data.

the operators

new command and control serv- ers

build up


Input: Also, many researcher systems are connected to the sinkholed domains.


Input: However, this graph of current sinkhole callbacks presents a low confidence distribution of victim geolocation, with India, Japan, Ireland, Korea, China and Taiwan in the top slots.


Input: Removing India and Ireland, the set more closely matches our KSN data.


Input: Many of these c2s maintain a common directory path that serves a ddrlog.

Many of these c2s

a common directory path that serves a ddrlog

maintain


Input: The ddrlogs appear to maintain callback data that the attackers want to set aside in error logs.


Input: Many of the callback URLs have errors, many are from unwanted IP ranges, and others are clearly unwanted researcher sandbox system callbacks.


Input: A description of the detailed connectback URL values and their xor/base64 encoding scheme is included in the'' Interesting Malware Trojan.Win32.Karba.e'' technical notes in Appendix D. The Darkhotel c2 maintain these directory structures to store and serve ddrlog content: The following structures appear to be common across servers, but do not pro- duce ddrlog and do not maintain an /error/ directory: Two ddrlog files report entries starting January 1, 2009 at 9:16 a.m. All of the logs maintain a significant number of entries, almost 50,000, with a simple stamp'' B'' or'' L''.

The Darkhotel c2

these directory structures

store and serve ddrlog content

maintain

to


Input: Those records are formatted in the following manner: Only 120 IP addresses perform the'' B'' checkin, and 90% of these are from the range 150.70.97.x.


Input: This entire range is owned by Trend Micro in Tokyo, JP.


Input: A handful of the remaining addresses, like 222.150.70.228, appear to come from other ranges owned by Trend Micro in JP.


Input: One outlier comes from an El Sal- vadoran ISP, and another is connected to a Japanese ISP.


Input: Approximately 20,000 IP addresses perform the'' L'' checkin.


Input: Other ddrlogs may include'' A'' tags as well.


Input: The'' A'' tag labels unwanted checkins from untargeted locations, like Hungary and Italy.


Input: The'' B'' tag labels unwanted checkins from Trend Micro IP ranges.


Input: The'' L'' tag labels unwanted checkins from a variety of ranges, but includes odd IP like the loopback address, 127.0.0.1, clearly an error.


Input: Entries in these logs include callback URLs that have spaces and unusual charac- ters that do not conform to the required base64 character dictionary.


Input: Typical main page: For begatrendstone.com, we have the following directory structure: The group encrypts victim data on their servers with single user/passkey combi- nations across multiple victims.

The group

victim data

their servers

single user/passkey combi- nations across multiple victims

encrypts

on

with


Input: When an unauthorized user attempts to access a Darkhotel web interface for victim management without the correct passkey, the html page and table layout renders properly, but all the data values on the page are returned as garbled ciphertext.


Input: New victim systems appear to be systematically vetted.

New victim systems

be systematically vetted


Input: The attackers maintain a web interface to vet these new victim systems.

The attackers

a web interface

vet these new victim systems

maintain

to


Input: The attackers first and foremost list and sort victim systems according to their latest c2 checkin.

The attackers

victim systems

their latest c2 checkin

list and sort

according to


Input: Collected data probably is presented in order of importance: Here is an example of one of these web pages: Clearly, some automated analysis activity involving researchers' sandbox tools are filling up these logs.


Input: From June 2013 to April 2014 (approximately an 11 month period), in only 15 ddrlog files, we observe almost 7,000 connections from research sandbox systems.


Input: The network connections provide a1= through a3= values identifying a QEMU based sandbox, all sourced from only 485 WAN IP ad- dresses.


Input: Under 30 lan IPs are recorded, all in the same 172.16.2.14126 range.


Input: This system (s) uses a'' Dave'' user account and'' HOMEOFFD5F0AC'' Windows system name.


Input: These characteristics correspond with network activity generated by GFI Soft- ware's'' CWsandbox'' tools, now owned by'' ThreatTrack Security''.


Input: For the past seven years, a strong threat actor named Darkhotel, also known as Tapaoux, has carried out a number of successful attacks against a wide range of victims from around the world.


Input: It employs methods and techniques which go well beyond typical cybercriminal behavior.


Input: The Darkhotel crew's skillset allows it to launch interesting cryptographical at- tacks, for instance factoring 512 bit RSA keys.


Input: Its use of 0-days is another indica- tor of a strong threat actor.


Input: The targeting of top executives from various large companies around the world during their stay at certain'' Dark Hotels'' is one of the most interesting aspects of this operation.


Input: The exact method of targeting is still unknown-for instance, why some people are targeted while others are not.


Input: The fact that most of the time the victims are top executives indicates the attackers have knowledge of their victims whereabouts, including name and place of stay.


Input: This paints a dark, dangerous web in which unsuspecting travelers can easily fall.


Input: While the exact reason why some hotels function as an attacker vector are unknown, certain suspicions ex- ist, indicating possibly a much larger compromise.


Input: We are still investigating this aspect of the operation and will publish more information in the future.


Input: A further interesting trait is the deployment of multiple types of campaigns, both targeted and botnet.


Input: This is becoming more and more common on the APT scene, where targeted attacks are used to compromise high profile victims and botnet style operations are used for massive surveillance or performing other tasks such as launching DDoS attacks on hostile parties or simply upgrading victims to more sophisticated espionage tools.

targeted attacks

high profile victims

botnet style operations

massive surveillance

DDoS attacks

hostile parties

victims

more sophisticated espionage tools

compromise

are used

launching

upgrading

for

on

to


Input: We expect the Darkhotel crew to continue their activities against DIB, Govern- ment and NGO sectors.


Input: The appendix released with this paper provides technical indicators of compromise which should help victims identify the malicious traffic and enable targets to protect themselves better against attack.


Input: Complex malware known as Regin is the suspected technology behind sophisticated cyberattacks conducted by U.S. and British intelligence agencies on the European Union and a Belgian telecommunications company, according to security industry sources and technical analysis conducted by The Intercept.


Input: Regin was found on infected internal computer systems and email servers at Belgacom, a partly state-owned Belgian phone and internet provider, following reports last year that the company was targeted in a top-secret surveillance operation carried out by British spy agency Government Communications Headquarters, industry sources told The Intercept.

Regin


Input: The malware, which steals data from infected systems and disguises itself as legitimate Microsoft software, has also been identified on the same European Union computer systems that were targeted for surveillance by the National Security Agency.

The malware

data

infected systems

itself

legitimate Microsoft software

steals

disguises

from

as


Input: The hacking operations against Belgacom and the European Union were first revealed last year through documents leaked by NSA whistleblower Edward Snowden.


Input: The specific malware used in the attacks has never been disclosed, however.


Input: The Regin malware, whose existence was first reported by the security firm Symantec on Sunday, is among the most sophisticated ever discovered by researchers.


Input: Symantec compared Regin to Stuxnet, a state-sponsored malware program developed by the U.S. and Israel to sabotage computers at an Iranian nuclear facility.


Input: Sources familiar with internal investigations at Belgacom and the European Union have confirmed to The Intercept that the Regin malware was found on their systems after they were compromised, linking the spy tool to the secret GCHQ and NSA operations.


Input: Ronald Prins, a security expert whose company Fox IT was hired to remove the malware from Belgacom's networks, told The Intercept that it was'' the most sophisticated malware'' he had ever studied.


Input: '' Having analyzed this malware and looked at the [previously published] Snowden documents,'' Prins said,'' I'm convinced Regin is used by British and American intelligence services.


Input: '' A spokesman for Belgacom declined to comment specifically about the Regin revelations, but said that the company had shared'' every element about the attack'' with a federal prosecutor in Belgium who is conducting a criminal investigation into the intrusion.


Input: '' It's impossible for us to comment on this,'' said Jan Margot, a spokesman for Belgacom.


Input: '' It's always been clear to us the malware was highly sophisticated, but ever since the clean-up this whole story belongs to the past for us.


Input: '' In a hacking mission codenamed Operation Socialist, GCHQ gained access to Belgacom's internal systems in 2010 by targeting engineers at the company.

GCHQ

access to Belgacom's internal systems

gained


Input: The agency secretly installed so-called malware'' implants'' on the employees' computers by sending their internet connection to a fake LinkedIn page.


Input: The malicious LinkedIn page launched a malware attack, infecting the employees' computers and giving the spies total control of their systems, allowing GCHQ to get deep inside Belgacom's networks to steal data.

a malware attack

the employees' computers

total control of their systems

GCHQ

data

infecting

giving

steal


Input: The implants allowed GCHQ to conduct surveillance of internal Belgacom company communications and gave British spies the ability to gather data from the company's network and customers, which include the European Commission, the European Parliament, and the European Council.

The implants

surveillance of internal Belgacom company communications

data

conduct

gather


Input: The software implants used in this case were part of the suite of malware now known as Regin.


Input: One of the keys to Regin is its stealth: To avoid detection and frustrate analysis, malware used in such operations frequently adhere to a modular design.

avoid

frustrate

detection

analysis

malware


Input: This involves the deployment of the malware in stages, making it more difficult to analyze and mitigating certain risks of being caught.


Input: Based on an analysis of the malware samples, Regin appears to have been developed over the course of more than a decade; The Intercept has identified traces of its components dating back as far as 2003.


Input: Regin was mentioned at a recent Hack.lu conference in Luxembourg, and Symantec's report on Sunday said the firm had identified Regin on infected systems operated by private companies, government entities, and research institutes in countries such as Russia, Saudi Arabia, Mexico, Ireland, Belgium, and Iran.


Input: The use of hacking techniques and malware in state-sponsored espionage has been publicly documented over the last few years: China has been linked to extensive cyber espionage, and recently the Russian government was also alleged to have been behind a cyber attack on the White House.


Input: Regin further demonstrates that Western intelligence agencies are also involved in covert cyberespionage.


Input: GCHQ declined to comment for this story.


Input: The agency issued its standard response to inquiries, saying that'' it is longstanding policy that we do not comment on intelligence matters'' and'' all of GCHQ's work is carried out in accordance with a strict legal and policy framework, which ensures that our activities are authorised, necessary and proportionate.


Input: '' The NSA said in a statement,'' We are not going to comment on The Intercept's speculation.


Input: '' The Intercept has obtained samples of the malware from sources in the security community and is making it available for public download in an effort to encourage further research and analysis.


Input: (To download the malware, click here.


Input: The file is encrypted; to access it on your machine use the password'' infected.


Input: '') What follows is a brief technical analysis of Regin conducted by The Intercept's computer security staff.


Input: Regin is an extremely complex, multi-faceted piece of work and this is by no means a definitive analysis.


Input: In the coming weeks, The Intercept will publish more details about Regin and the infiltration of Belgacom as part of an investigation in partnership with Belgian and Dutch newspapers De Standaard and NRC Handelsblad.


Input: In Nordic mythology, the name Regin is associated with a violent dwarf who is corrupted by greed.


Input: It is unclear how the Regin malware first got its name, but the name appeared for the first time on the VirusTotal website on March 9th 2011.


Input: Der Spiegel reported that, according to Snowden documents, the computer networks of the European Union were infiltrated by the NSA in the months before the first discovery of Regin.


Input: Industry sources familiar with the European Parliament intrusion told The Intercept that such attacks were conducted through the use of Regin and provided samples of its code.


Input: This discovery, the sources said, may have been what brought Regin to the wider attention of security vendors.


Input: Also on March 9th 2011, Microsoft added related entries to its Malware Encyclopedia: Two more variants of Regin have been added to the Encyclopedia, Regin.B and Regin.C.


Input: Microsoft appears to detect the 64-bit variants of Regin as Prax.A and Prax.B.


Input: None of the Regin/Prax entries are provided with any sort of summary or technical information.


Input: The following Regin components have been identified: The first stage are drivers which act as loaders for a second stage.

The first stage

loaders for a second stage

act as


Input: They have an encrypted block which points to the location of the 2nd stage payload.


Input: On NTFS, that is an Extended Attribute Stream; on FAT, they use the registry to store the body.


Input: When started, this stage simply loads and executes Stage 2.

this stage

Stage 2

loads and executes


Input: The Regin loaders that are disguised as Microsoft drivers with names such as: Mimicking Microsoft drivers allows the loaders to better disguise their presence on the system and appear less suspicious to host intrusion detection systems.

The Regin loaders

Microsoft drivers

Microsoft drivers

the loaders

their presence on the system

less suspicious

host intrusion detection systems

are disguised as

Mimicking

disguise

appear

to


Input: When launched, it cleans traces of the initial loader, loads the next part of the toolkit and monitors its execution.

it

traces of the initial loader

the next part of the toolkit

its execution

cleans

loads

monitors


Input: On failure, Stage 2 is able to disinfect the compromised device.

On

failure

Stage 2

the compromised device

disinfect


Input: The malware zeroes out its PE (Portable Executable, the Windows executable format) headers in memory, replacing'' MZ'' with its own magic marker 0xfedcbafe.

The malware

its PE (Portable Executable, the Windows executable format) headers in memory

'' MZ''

its own magic marker 0xfedcbafe

zeroes out

replacing

with


Input: This component consists of a service orchestrator working in Windows' kernel.


Input: It initializes the core components of the architecture and loads the next parts of the malware.

It

the core components of the architecture

the next parts of the malware

initializes

loads


Input: This stage is composed of a service orchestrator located in user land, provided with many modules which are loaded dynamically as needed.


Input: These modules can include data collectors, a self-defense engine which detects if attempts to detect the toolkit occur, functionality for encrypted communications, network capture programs, and remote controllers of different kinds.

These modules

data collectors

a self-defense engine

attempts to detect the toolkit

communications

network capture programs

remote controllers of different kinds

include

detects

encrypted


Input: The Intercept's investigation revealed a sample uploaded on VirusTotal on March 14th 2012 that presents the unique 0xfedcbafe header, which is a sign that it might have been loaded by a Regin driver and it appears to provide stealth functionality for the tool kit.

a sample

a Regin driver

it

stealth functionality

the tool kit

loaded

provide

for


Input: In order to access information stored in the computer's memory, programs use objects that reference specific locations in memory called pointers.

access

information stored in the computer's memory

programs


Input: This binary file contains some of such pointers initialized, which corroborates the hypothesis that the file was dumped from memory during a forensic analysis of a compromised system.

the file

memory

was dumped

from


Input: The sample has the following SHA256 hash: This sample gives a sense of the sophistication of the actors and the length of the precautions they have been taking in order to operate as stealthily as possible.


Input: When a Windows kernel driver needs to allocate memory to store some type of data, it creates so called kernel pools.


Input: Such memory allocations have specific headers and tags that are used to identify the type of objects contained within the block.


Input: For example such tags could be Proc, Thrd or File, which respectively indicate that the given block would contain a process, thread or file object structure.


Input: When performing forensic analysis of a computer's memory, it is common to use a technique called pool scanning to parse the kernel memory, enumerate such kernel pools, identify the type of content and extract it.


Input: Just like Regin loader drivers, this driver repeatedly uses the generic'' Ddk'' tag with ExAllocatePoolWithTag () when allocating all kernel pools: The generic tag which is used throughout the operating system when a proper tag is not specified.


Input: This makes it more difficult for forensic analysts to find any useful information when doing pool scanning, since all its memory allocations will mix with many generic others.


Input: In addition, when freeing memory using ExFreePool (), the driver zeroes the content, probably to avoid leaving traces in pool memory.

the driver

the content

leaving traces in pool memory

zeroes

avoid


Input: The driver also contains routines to check for specific builds of the Windows kernel in use, including very old versions such as for Windows NT4 Terminal Server and Windows 2000, and then adapts its behavior accordingly.

The driver

specific builds of the Windows kernel in use

its behavior

check for

adapts


Input: Windows kernel drivers operate on different levels of priority, from the lowest PASSIVELEVEL to the highest HIGHLEVEL.


Input: This level is used by the processor to know what service give execution priority to and to make sure that the system doesn't try to allocate used resources which could result in a crash.


Input: This Regin driver recurrently checks that the current IRQL (Interrupt Request Level) is set to PASSIVELEVEL using the KeGetCurrentIrql () function in many parts of the code, probably in order to operate as silently as possible and to prevent possible IRQL confusion.

This Regin driver

the current IRQL (Interrupt Request Level)

checks


Input: This technique is another example of the level of precaution the developers took while designing this malware framework.


Input: Upon execution of the unload routine (located at 0xFDEFA04A), the driver performs a long sequence of steps to remove remaining traces and artifacts.

the driver

remaining traces and artifacts

remove


Input: In an interview given to the Belgian magazine MondiaalNiews, Fabrice Clément, head of security of Belgacom, said that the company first identified the attack on June 21, 2013.


Input: In the same interview Clément says that the computers targeted by the attackers included staff workstations as well as email servers.


Input: These statements confirm the timing and techniques used in the attack.


Input: From previously identified Regin samples, The Intercept developed unique signatures which could identify this toolkit.


Input: A zip archive with a sample identified as Regin/Prax was found in VirusTotal, a free, online website which allows people to submit files to be scanned by several anti-virus products.


Input: The zip archive was submitted on 2013-06-21 07:58:37 UTC from Belgium, the date identified by Clément.


Input: Sources familiar with the Belgacom intrusion told The Intercept that this sample was uploaded by a systems administrator at the company, who discovered the malware and uploaded it in an attempt to research what type of malware it was.


Input: The archive contains: Along with other files The Intercept found the output of a forensic tool, GetThis, which is being run on target systems looking for malware.


Input: From the content of the GetThis.log file, we can see that a sample called'' svcsstat.exe'' and located in C: \Windows\System32\ was collected and a copy of it was stored.


Input: The malware in question is'' 0001000000000C1Csvcsstat.exesample''.


Input: This is a 64bit variant of the first stage Regin loader aforementioned.


Input: The archive also contains the output of ProcMon,'' Process Monitor'', a system monitoring tool distributed by Microsoft and commonly used in forensics and intrusion analysis.


Input: This file identifies the infected system and provides a variety of interesting information about the network.


Input: For instance: The following environment variable shows that the system was provided with a Microsoft SQL server and a Microsoft Exchange server, indicating that it might one of the compromised corporate mail server Fabrice Clément mentioned to Mondiaal News: Below is a list of hashes for the files The Intercept is making available for download.


Input: Given that that it has been over a year since the Belgacom operation was publicly outed, The Intercept considers it likely that the GCHQ/NSA has replaced their toolkit and no current operations will be affected by the publication of these samples.


Input: In February 2014, the experts of the G DATA SecurityLabs published an analysis of Uroburos, the rootkit with Russian roots.


Input: We explained that a link exists between Uroburos and the Agent.BTZ malware, which was responsible for'' the most significant breach of U.S. military computers ever.


Input: '' Nine months later, after the buzz around Uroburos, aka Snake or Turla, we now identified a new generation of Agent.BTZ.


Input: We dubbed it ComRAT and, by now, analyzed two versions of the threat (v3.25 and v3.26).


Input: As reported earlier this year, Agent.BTZ used the same encoding key and the installation log file name as Uroburos.


Input: ComRAT, in its version 3.25, shows the same behavior.


Input: Furthermore, the attackers also shared a C & C domain.

the attackers

a C & C domain

shared


Input: The latest version of ComRAT known to us (v3.26) uses a new key and does not create the installation log file, in order to complicate the analysis and to disguise the link between the two cases.

ComRAT

the analysis

complicate


Input: Another very interesting fact: the attackers use COM Object hijacking, the same persistence mechanism as COMpfun, which we described recently.

the attackers

the same persistence mechanism

use


Input: Taken everything into consideration, the indications we saw during our analyzes lead to the supposition that the group behind Agent.BTZ and Uroburos is still active and is pursuing the Agent.BTZ path once more to improve and change the RAT.


Input: The analyzed file is the latest version we identified: v3.26.


Input: The version identification is described in the chapter'' Log files''.


Input: The major difference between this version and the older version (s) will be described there.


Input: The first task of the malware is to install the file credprov.tlb in% APPDATA% \Microsoft\.

the malware

the file credprov.tlb

% APPDATA% \Microsoft\

install

in


Input: This file is the main payload of the malware.


Input: The dropper executes the following command in order to install a second file: The second file is shdocw.tlp.

The dropper

a second file

install


Input: The two files are Microsoft Windows dynamic libraries.


Input: To be started during the boot process of the infected machine, the malware creates the following registry key: This registry key is used to associate the library shdocvw.tlp to the object 42aedc87-2188-41fd-b9a3-0c966feabec1 as previously explained in the article about COMpfun.

started

creates

during

the boot process of the infected machine

the malware

the following registry key


Input: The purpose is to load the library into each and every process executed on the infected system.

load

the library

each and every process executed on the infected system

into


Input: If the version of the malware is older than 3.26, the dropper creates an additional file called winview.ocx.

the dropper

an additional file called winview.ocx

creates


Input: We noticed that the file name is still the same as the file name used by Agent.BTZ in the past.


Input: The file is xored with the following obfuscation key (used by both, Uroburos and Agent.BTZ): Here is the decoded log file content: We can notice that the malware checks if an older version is installed on the system and if this is the case, the dropper removes the older version.

The file

the following obfuscation key

the malware

if an older version is installed on the system

the dropper

the older version

is xored

checks

removes

with


Input: In contrast to this, in our Uroburos analysis, we found out that Uroburos does not install itself in case a version of Agent.BTZ was found on a system.

Uroburos

itself

a version of Agent.BTZ

a system

does not install

was found

on


Input: During the startup of the infected machine, the shdocvw.tlp library is loaded into all processes.

the shdocvw.tlp library

all processes

is loaded

into


Input: If the process is explorer.exe, this library will load the other library called credprov.tlb.

this library

the other library called credprov.tlb

will load


Input: This library is the real payload.


Input: Its features are common for a Remote Administration Tool (RAT): ComRAT's communication to the command and control server is performed by the browser process and not by explorer.exe in order to avoid being blocked by a firewall on the system or any additional security products.

ComRAT's communication to the command and control server

the browser process

being blocked by a firewall on the system or any additional security products

is performed

avoid


Input: The communication between the processes is performed by named pipe.

The communication between the processes

named pipe

is performed


Input: Two log files are created during the malware execution: mskfp32.ocx and msvcrtd.tlb.

Two log files

the malware execution

mskfp32.ocx and msvcrtd.tlb

are created

during


Input: If the malware version is older than 3.26, the xored key is the same as the dropper key.


Input: Concerning the version 3.26, the malware uses a new non-ASCII key.


Input: Here is an example of decoded log file for the version 3.26: We can identify the version of the malware thanks to the PVer flag.


Input: The command and control server information is stored in the registry, not in an XML, and encoded: For example, in the analyzed sample the CC is: weather-online.hopto.org.

The command and control server information

the registry

is stored

in


Input: This domain is far from unknown, as it has been mentioned in BAE System's Uroburos (aka Snake) analysis paper as C & C server domain for the Uroburos malware.


Input: Another connection between the cases.


Input: If the malware version in lower than 3.26, the XML log file contains the command and control server information: Let us summarize the similarities and differences between Agent.BTZ, Uroburos and ComRAT as far as we can: Some parts of the code are exactly the same (appears to be copy & paste).

the XML log file

the command and control server information

contains


Input: That is the reason why the sample is detected as Uroburos (aka Turla).


Input: The same code was used by Agent.BTZ and also the dll loaded into userland during the Uroburos analysis.


Input: Command and control server domains are shared between Uroburos and ComRAT.

Command and control server domains

Uroburos and ComRAT

are shared

between


Input: In version 3.26, the author changed the key and remove the known file name.


Input: This action can be an indication for the developer's effort to hide this connection.


Input: The main difference is the design.


Input: Agent.BTZ is a common RAT, a simple library executed on an infected machine.

Agent.BTZ

a common RAT

is


Input: ComRAT is more complex and cleverer.


Input: The malware is loaded into each and every process of the infected machine and the main part (payload) of the malware is only executed in explorer.exe.

The malware

each and every process of the infected machine

the main part (payload) of the malware

explorer.exe

is loaded

is only executed

into

in


Input: Furthermore, the C & C communication blends into the usual browser traffic and the malware communicates to the browser by named pipe.

the C & C communication

the usual browser traffic

the malware

the browser

named pipe

blends

communicates

into

to

by


Input: It is by far a more complex userland design than Agent.BTZ.


Input: These differences, mainly the more complex design, lead us to give this malware a new name.


Input: The analyzed dropper of v3.25 has a compilation date of February 6th 2014.


Input: The more recent dropper of v3.26, which has all the mentioned changes implemented, reveals a compilation date of January 3rd 2013.


Input: We suspect that this date is spoofed in order to disguise that this is in fact a newer version.

this date

is spoofed


Input: This analysis shows that even after the Uroburos publication in February 2014, the group behind this piece of malware seems to be still active.


Input: In any case, the ComRAT developers implemented new mechanisms, changed keys, removed log files to hide their activities and tried to disguise the connections between the RAT ComRAT, the rootkit Uroburos and the RAT Agent.BTZ as much as possible.


Input: However, we can still follow the evolution of the malware by comparing the versions.


Input: The persistence mechanism discovered in October 2014 makes it possible to intrude into a system in a really discreet manner and we estimate that other actors will use the same persistence mechanism in the near future.


Input: We will definitely keep our ears and eyes open and continue analyzing.


Input: Repressive nation-states have long monitored telecommunica- tions to keep tabs on political dissent.


Input: The Internet and online social networks, however, pose novel technical challenges to this practice, even as they open up new domains for surveil- lance.


Input: We analyze an extensive collection of suspicious files and links targeting activists, opposition members, and non- governmental organizations in the Middle East over the past several years.


Input: We find that these artifacts reflect efforts to at- tack targets' devices for the purposes of eavesdropping, stealing information, and/or unmasking anonymous users.


Input: We describe attack campaigns we have observed in Bahrain, Syria, and the United Arab Emirates, investigating attackers, tools, and tech- niques.


Input: In addition to off-the-shelf remote access trojans and the use of third-party IP-tracking services, we identify commer- cial spyware marketed exclusively to governments, including Gamma's FinSpy and Hacking Team's Remote Control Sys- tem (RCS).


Input: We describe their use in Bahrain and the UAE, and map out the potential broader scope of this activity by conduct- ing global scans of the corresponding command-and-control (C & C) servers.


Input: Finally, we frame the real-world consequences of these campaigns via strong circumstantial evidence linking hacking to arrests, interrogations, and imprisonment.


Input: Computer security research devotes extensive efforts to pro- tecting individuals against indiscriminate, large-scale attacks such as those used by cybercriminals.


Input: Recently, the prob- lem of protecting institutions against targeted attacks conducted by nation-states (so-called'' Advanced Persistent Threats'') has likewise elicited significant research interest.


Input: Where these two problem domains intersect, however-targeted cyber attacks by nation-states against individuals-has received virtually no sig- nificant, methodical research attention to date.


Input: This new prob- lem space poses challenges that are both technically complex and of significant real-world importance.


Input: In this work we undertake to characterize the emergent prob- lem space of nation-state Internet attacks against individuals engaged in pro-democracy or opposition movements.


Input: While we lack the data to do so in a fully comprehensive fashion, we provide extensive detail from both technical and operational perspectives as seen in three countries.


Input: We view such character- izations as the fundamental first step necessary for the rigorous, scientific pursuit of a new problem space.


Input: For our study we draw upon several years of research we have conducted into cases from Bahrain, Syria and the United Arab Emirates.


Input: We frame the nature of these attacks, and the technology and infrastructure used to conduct them, in the con- text of their impacts on real people.


Input: We hope in the process to inspire additional research efforts addressing the difficult prob- lem of how to adequately protect individuals with very limited resources facing powerful adversaries.


Input: As an illustration of this phenomenon, consider the follow- ing anecdote, pieced together from public reports and court documents.


Input: At dawn on 3/12/13, police raided the house of 17-year- old Ali Al-Shofa, confiscated his laptop and phone, and took him into custody.


Input: He was charged with referring to Bahrain's King as a'' dictator'' () and'' fallen one'' () on a pseudonymous Twitter account, @alkawarahnews.


Input: Accord- ing to court documents, Bahrain's Cyber Crime Unit had linked an IP address registered in his father's name to the account on 12/9/12.


Input: Operators of @alkawarahnews later forwarded a suspicious private message to one of the authors.


Input: The message was received on 12/8/12 on a Facebook account linked to the Twitter handle, and contained a link to a protest video, purport- edly sent by an anti-government individual.


Input: The link redirected through iplogger.org, a service that records the IP address of anyone who clicks.


Input: Analytics for the link indicate that it had been clicked once from inside Bahrain.


Input: On 6/25/13, Ali was sentenced to one year in prison.


Input: Ali's case is an example of the larger phenomenon we in- vestigate: attacks against activists, dissidents, trade unionists, human rights campaigners, journalists, and members of NGOs (henceforth'' targets'') in the Middle East.


Input: The attacks we have documented usually involve the use of malicious links or e-mail attachments, designed to obtain information from a device.

The attacks we have documented

the use of malicious links or e-mail attachments

information

a device

involve

obtain

from


Input: On the one hand, we have observed attacks using a wide range of off-the-shelf spyware, as well as publicly available third-party services, like iplogger.org.

attacks

a wide range of off-the-shelf spyware, as well as publicly available third-party services, like iplogger.org

using


Input: On the other hand, some at- tacks use so-called'' lawful intercept'' trojans and related equip- ment, purportedly sold exclusively to governments by compa- nies like Gamma International and Hacking Team.

some at- tacks

so-called'' lawful intercept'' trojans

use


Input: The lat- ter advertises that governments need its technology to'' look through their target's eyes'' rather than rely solely on'' passive monitoring''.


Input: Overall, the attacks we document are rarely technically novel.


Input: In fact, we suspect that the majority of at- tacks could be substantially limited via well-known security practices, settings, and software updates.


Input: Yet, the attacks are noteworthy for their careful social engineering, their links to governments, and their real-world impact.

the attacks

careful social engineering


Input: We obtained the majority of our artifacts by encouraging in- dividuals who might be targeted by governments to provide us with suspicious files and unsolicited links, especially from un- familiar senders.


Input: While this process has provided a rich set of artifacts to analyze, it does not permit us to claim our dataset is representative.


Input: Our analysis links these attacks with a common class of ac- tor: an attacker whose behavior, choice of target, or use of in- formation obtained in the attack, aligns with the interests of a government.


Input: In some cases, such as Ali's, the attackers appear to be governments themselves; in other cases, they appear in- stead to be pro-government actors, ranging from patriotic, not necessarily skilled volunteers to cyber mercenaries.


Input: The phe- nomenon has been identified before, such as in Libya, when the fall of Gaddafi's regime revealed direct government ties to hacking during the 2011 Civil War.


Input: We make the following contributions: • We analyze the technology associated with targeted at- tacks (e.g., malicious links, spyware), and trace it back to its programmers and manufacturers.


Input: While the attacks are not novel-and indeed often involve technology used by the cybercrime underground-they are significant be- cause they have a real-world impact and visibility, and are connected to governments.


Input: In addition, we often find amateurish mistakes in either the attacker's technology or operations, indicating that energy spent countering these threats can realize significant benefits.


Input: We do not, how- ever, conclude that all nation-state attacks or attackers are incompetent, and we suspect that some attacks have evaded our detection.


Input: • When possible, we empirically characterize the attacks and technology we have observed.


Input: We map out global use of two commercial hacking tools by governments by searching through Internet scan data using fingerprints for command-and-control (C & C) servers derived from our spyware analysis.


Input: • We develop strong evidence tying attacks to govern- ment sponsors and corporate suppliers, countering de- nials, sometimes energetic and sometimes indirect, of such involvement [,,,], in contrast to denials or claims of a corporate'' oversight'' board.


Input: Our scan- ning suggests use of'' lawful intercept'' trojans by 11 ad- ditional countries considered governed by'' authoritarian regimes.


Input: '' We believe that activists and journalists in such countries may experience harassment or consequences to life or liberty from government surveillance.


Input: Finally, we do not explore potential defenses appropriate for protecting the target population in this work.


Input: We believe that to do so in a sufficiently well-grounded, meaningful manner first requires developing an understanding of the targets' knowledge of security issues, their posture regarding how they currently protect themselves, and the resources (including potentially ed- ucation) that they can draw upon.


Input: To this end, we are now con- ducting (with IRB approval) in-depth interviews with potential targets along with systematic examination of their Internet de- vices in order to develop such an understanding.


Input: In the past decades, a rich body of academic work has grown to document and understand government Internet censorship, in- cluding nationwide censorship campaigns like the Great Fire- wall of China [,,].


Input: Research on governmental Internet surveillance and activities like law-enforcement interception is a comparatively smaller area.


Input: Some academic work looks at government use of devices to enable censorship, such as key- word blacklists for Chinese chat clients, or the Green Dam censorware that was to be deployed on all new computers sold in China.


Input: We are aware of only limited previous work looking at advanced threat actors targeting activists with hack- ing, though this work has not always been able to establish ev- idence of government connections.


Input: Platforms used by potential targets, such as GMail, Twitter, and Facebook increasingly make transport- layer encryption the default, obscuring communications from most network surveillance.


Input: This use of encryption, along with the global nature of many social movements, and the role of diaspora groups, likely makes hacking increasingly attractive, especially to states who are unable to request or compel content from these platforms.


Input: Indeed, the increasing use of encryption and the global nature of targets have both been cited by pur- veyors of'' lawful intercept'' trojans in their marketing materi- als [,].


Input: In one notable case in 2009, UAE telecom firm Eti- salat distributed a system update to its then 145,000 BlackBerry subscribers that contained spyware to read encrypted Black- Berry e-mail from the device.


Input: The spyware was discovered when the update drastically slowed users' phones.


Input: In con- trast to country-scale distribution, our work looks at this kind of pro-government and government-linked surveillance through highly targeted attacks.


Input: The term APT (Advanced Persistent Threat) refers to a sophisticated cyber-attacker who persistently attempts to tar- get an individual or group.


Input: Work outside the academic community tracking government cyberattacks typically falls under this umbrella.


Input: There has been significant work on APT outside the academic community, especially among se- curity professionals, threat intelligence companies, and human rights groups.


Input: Much of this work has focused on suspected government-on-government or government-on-corporation cy- ber attacks [,].


Input: Meanwhile, a small but growing body of this research deals with attacks carried out by governments against opposition and activist groups operating within, as well as outside their borders.


Input: One of the most notable cases is GhostNet, a large-scale cyber espionage campaign against the Tibetan independence movement [,].


Input: Other work avoids drawing conclusions about the attackers.


Input: Our study is based on extensive analysis of malicious files and suspect communications relevant to the activities of targeted groups in Bahrain, Syria, and the UAE, as documented in Ta- ble 1.


Input: A number of the attacks had significant real-world impli- cations, per Table 2.


Input: In many cases, we keep our descriptions somewhat imprecise to avoid potential leakage of target identi- ties.


Input: We began our work when contacted by individuals con- cerned that a government might have targeted them for cyber- attacks.


Input: As we became more acquainted with the targeted com- munities, in some cases we contacted targeted groups directly; in others, we reached out to individuals with connections to tar- geted groups, who allowed us to examine their communications with the groups.


Input: For Bahrain and Syria, the work encompassed 10,000s of e-mails and instant messages.


Input: For the UAE, the vol- ume is several thousand communications.


Input: This following sections outline recent targeted hacking cam- paigns in Bahrain, Syria and the UAE.


Input: These cases have a com- mon theme: attacks against targets' computers and devices with malicious files and links.


Input: In some cases the attackers employed expensive and'' government exclusive'' malware, while in other cases, attackers used cheap and readily available RATs.

the attackers

expensive and'' government exclusive'' malware

attackers

cheap and readily available RATs

employed

used


Input: Across these cases we find that clever social engineering often plays a central role, which is strong evidence of a well-informed ad- versary.

clever social engineering

a central role

plays


Input: We also, however, frequently find technical and op- erational errors by the attackers that enable us to link attacks to governments.


Input: In general, the attacks we find are not well- detected by anti-virus programs.

the attacks

anti-virus programs

are not well- detected

by


Input: We have analyzed two attack campaigns in the context of Bahrain, where the government has been pursuing a crackdown against an Arab-Spring inspired uprising since 2/14/2011.


Input: The first involved malicious e-mails containing FinSpy, a'' lawful intercept'' trojan sold exclusively to governments.

The first

malicious e-mails containing FinSpy, a'' lawful intercept'' trojan sold exclusively to governments

involved


Input: The second involved specially crafted IP spy links and e-mails de- signed to reveal the IP addresses of operators of pseudonymous accounts.

The second

specially crafted IP spy links and e-mails

the IP addresses of operators of pseudonymous accounts

involved

reveal


Input: Some individuals who apparently clicked on these links were later arrested, including Ali (cf.


Input: §1), whose click appears to have been used against him in court.


Input: While both campaigns point back to the government, we have not as yet identified overlap between the campaigns; targets of FinSpy appeared to reside mainly outside Bahrain, whereas the IP spy links targeted those mainly inside the country.


Input: We examine each campaign in turn.


Input: Beginning in April 2012, the authors received 5 suspicious e-mails from US and UK-based activists and journalists working on Bahrain.


Input: We found that some of the attachments contained a PE (.exe) file designed to appear as an image.

some of the attachments

a PE (.exe) file designed to appear as an image

contained


Input: Their filenames contained a Uni- code right-to-left override (RLO) character, causing Windows to render a filename such as gpj.1bajaR.exe instead as exe.Rajab1.jpg.

Their filenames

a Uni- code right-to-left override (RLO) character

Windows to render a filename such as gpj.1bajaR.exe instead as exe.Rajab1.jpg

contained

causing


Input: The other .rar files contained a Word document with an embedded ASCII-encoded PE file containing a custom macro set to automatically run upon document startup.

The other .rar files

a Word document with an embedded ASCII-encoded PE file

a custom macro set

document startup

contained

automatically run

upon


Input: Under default security settings, Office disables all unsigned macros, so that a user who opens the document will only see an informational message that the macro has been disabled.


Input: Thus, this attack was apparently designed with the belief or hope that targets would have reduced security settings.


Input: Identification as FinSpy: By running the sample using Windows Virtual PC, we found the following string in mem- ory: y: \lsvnbranches\finspyv4.01\finspyv2\.


Input: This string suggests FinSpy, a product of Gamma Inter- national.


Input: The executables used virtualized obfusca- tion, which appeared to be custom-designed.

The executables

virtualized obfusca- tion

used


Input: We de- vised a fingerprint for the obfuscater and located a structurally similar executable by searching a large malware database.


Input: This executable contained a similar string, except it identi- fied itself as FinSpy v3.00, and attempted to connect to tiger.gamma-international.de, a domain registered to Gamma International GmbH.

This executable

tiger.gamma-international.de, a domain registered to Gamma International GmbH

connect

to


Input: Analysis of capabilities: We found that the spyware has a modular design, and can download additional modules from a command & control (C & C) server, including password cap- ture (from over 20 applications) and recording of screenshots, Skype chat, file transfers, and input from the computer's micro- phone and webcam.

the spyware

additional modules

a command & control (C & C) server

password cap- ture (from over 20 applications)

recording of screenshots

Skype chat

file transfers

input from

the computer's micro- phone

webcam

download

including

from


Input: To exfiltrate data back to the C & C server, a module encrypts and writes it to disk in a special folder.

exfiltrate

encrypts

writes

data

the C & C server

a module

it

disk in a special folder

back to

to


Input: The spyware period- ically probes this folder for files that match a certain naming convention, then sends them to the C & C server.

The spyware

this folder

files that match a certain naming convention

them

the C & C server

probes

sends

for

to


Input: It then over- writes the files, renames them several times, and deletes them, in an apparent effort to frustrate forensic analysis.

It

the files

them

several times

them

forensic analysis

over- writes

renames

deletes

frustrate


Input: Analysis of encryption: Because the malware employed myriad known anti-debugging and anti-analysis techniques, it thwarted our attempts to attach debuggers.

the malware

myriad known anti-debugging and anti-analysis techniques

it

our attempts to attach debuggers

employed

thwarted


Input: Since it did not in- clude anti-VM code, we ran it in TEMU, an x86 emulator de- signed for malware analysis.


Input: TEMU captures instruction- level execution traces and provides support for taint-tracking.


Input: We found that FinSpy encrypts data using a custom imple- mentation of AES-256-CBC.

FinSpy

data

a custom imple- mentation of AES-256-CBC

encrypts

using


Input: The 32 byte AES key and 16 byte IV are generated by repeatedly reading the low-order-4-bytes of the Windows clock.

The 32 byte AES key and 16 byte IV

repeatedly reading the low-order-4-bytes of the Windows clock

are generated

by


Input: The key and IV are encrypted using an em- bedded RSA-2048 public key, and stored in the same file as the data.

The key and IV

an em- bedded RSA-2048 public key

are encrypted

using


Input: The private key presumably resides on the C & C server.


Input: The weak AES keys make decryption of the data straightfor- ward.


Input: We wrote a program that generally can find these keys in under an hour, exploiting the fact that many of the system clock readings occur within the same clock-update quantum.


Input: In addition, FinSpy's AES code fails to encrypt the last block of data if less than the AES block size of 128 bits, leaving trail- ing plaintext.


Input: Finally, FinSpy's wire protocol for C & C commu- nication uses the same type of encryption, and thus is subject to the same brute force attack on AES keys.

FinSpy's wire protocol for C & C commu- nication

the same type of encryption

uses


Input: While we suspect FinSpy's cryptographic deficiencies reflect bugs, it is also con- ceivable that the cryptography was deliberately weakened to facilitate one government monitoring the surveillance of oth- ers.


Input: C & C server: The samples communicated with 77.69.140.194, which belongs to a subscriber of Batelco, Bahrain's main ISP.

The samples

communicated

with


Input: Analyzing network traffic between our infected VM and the C & C server revealed that the server used a global IPID, which allowed us to infer server activity by its progression.


Input: In response to our preliminary work an executive at Gamma told the press that Bahrain's FinSpy server was merely a proxy and the real server could have been anywhere, as part of a claim that the Bahrain FinSpy deployment could have been associ- ated with another government.


Input: However, a proxy would show gaps in a global IPID as it forwarded traffic; our frequent observation of strictly consecutive IPIDs thus contradicts this statement.


Input: Exploitation of captured data: Since we suspected the spy- ware operator would likely seek to exploit captured credentials, particularly those associated with Bahraini activist organiza- tions, we worked with Bahrain Watch, an activist organization inside Bahrain.


Input: Bahrain Watch established a fake login page on their website and provided us with a username and pass- word.


Input: From a clean VM, we logged in using these credentials, saving the password in Mozilla Firefox.


Input: We then infected the VM with FinSpy and allowed it to connect to the Bahrain C & C server.

it

the Bahrain C & C server

connect

to


Input: Bahrain Watch's website logs revealed a subsequent hit from 89.148.0.41-made however to the site's home- page, rather than its login page-coming shortly after we had infected the VM.


Input: Decrypting packet captures of the spyware's activity, we found that our VM sent the password to the server exactly one minute earlier: The URL provided to the server did not include the path to the login page, which was inaccessible from the home- page.


Input: This omission reflects the fact that the Firefox password database stores only domain names, not full login page URLs, for each password.


Input: Repeating the experiment again yielded a hit from the same IP address within a minute.


Input: We inspected Bahrain Watch's logs, which showed no subsequent (or previ- ous) activity from that address, nor any instances of the same User Agent string.


Input: In an IP spy attack, the attacker aims to discover the IP address of a victim who is typically the opera- tor of a pseudonymous social media or e-mail account.

the attacker

the IP address of a victim who is typically the opera- tor of a pseudonymous social media or e-mail account

discover


Input: The at- tacker sends the pseudonymous account a link to a webpage or an e-mail containing an embedded remote image, using one of many freely-available services.

The at- tacker

the pseudonymous account a link to a webpage or an e-mail containing an embedded remote image

one of many freely-available services

sends

using


Input: When the victim clicks on the link or opens the e-mail, their IP address is revealed to the at- tacker.

their IP address

the at- tacker

is revealed

to


Input: The attacker then discovers the victim's identity from their ISP.


Input: In one case we identified legal documents that pro- vided a circumstantial link between such a spy link and a sub- sequent arrest.


Input: Figure 2 illustrates the larger ecosystem of these attacks.


Input: The attackers appear to represent a single entity, as the activity all connects back to accounts that sent links shortened using a par- ticular user account al9mood on the bit.ly URL shortening service.


Input: Recall Ali Faisal Al-Shufa (discussed in Section 1), who was accused of sending insulting tweets from an account @alkawarahnews (Al Kawarah News in Figure 2).


Input: An op- erator of the account forwarded us a suspicious private message sent to the Al Kawarah News Facebook account from Red Sky.


Input: Red Sky was purportedly arrested on 10/17/12, was convicted of insulting the King on his Twitter account @RedSky446, and was sentenced to four months prison.


Input: When released, he found that the passwords for his Twitter, Facebook, and e-mail accounts had been changed, and did not know how to recover his accounts.


Input: The message that Red Sky's account sent to Al Kawarah News included a link shortened using Google's goo.gl ser- vice.


Input: We used the goo.gl API to access analytics for the link, finding that it unshortened to iplogger.org/25SX and was created on 12/8/12.


Input: The link had received only one click, which came from Bahrain with the referrer www.facebook.com.


Input: Ali's case files contained a request from the Public Prose- cution for information on an IP address that it had linked to Al Kawarah News about 22 hours after the link was created.


Input: Court documents indicate that ISP data linked the IP address to Ali, and on this basis he was sentenced to one year in prison.


Input: Red Sky also targeted M in Figure 2.


Input: M recalled click- ing on a link from Red Sky while using an Internet connec- tion from one of the houses in M's village.


Input: The house was raided by police on 3/12/13, who were looking for the sub- scriber of the house's internet connection.


Input: Police questioning revolved around Tweets that referred to Bahrain's King as a'' cursed one.


Input: '' Red Sky had earlier targeted other users with IP spy links shortened using the al9mood bit.ly account.

Red Sky

other users

IP spy links shortened using the al9mood bit.ly account

targeted

with


Input: The attack on Jehad Abdulla is noteworthy, as the ac- count's activity aligned with communities typically critical of Bahrain's opposition.


Input: However, the account also directly crit- icized the King on occasion, in one case referring to him as'' weak'' and'' stingy.


Input: '' An account linked to al9mood sent Je- had Abdulla an IP spy link on 10/2/12 in a public message.

An account linked to al9mood

Je- had Abdulla

an IP spy link

a public message

sent

on

in


Input: On 10/16/12, Salman Darwish was arrested for insulting the King using the Jehad Abdulla account.


Input: He was sentenced to one month in prison, partly on the basis of his confession.


Input: Salman's father claims that police denied Salman food, drink, and medi- cal care.


Input: Another account linked to al9mood targeted @YLUBH, the Twitter account of Yokogawa Union, a trade union at the Bahraini branch of a Japanese company.


Input: @YLUBH received at least three IP spy links in late 2012, sent via public Twitter mes sages.

@YLUBH

at least three IP spy links

late 2012

received

in


Input: Yokogawa fired the leader of the trade union, Sami Ab- dulaziz Hassan, on 3/23/13.


Input: It later emerged that Sami was indeed the operator of the @YLUBH account, and that the police had called him in for questioning in relation to its tweets.


Input: Use of embedded remote images: We identified several targets who received spoofed e-mails containing embedded remote images.

several targets

spoofed e-mails containing embedded remote images

received


Input: Figure 2 shows two such cases, Maryam and Sayed Yousif.


Input: The attacker sent the e-mails using ReadNotify.com, which records the user's IP address upon their mail client downloading the remote image.

The attacker

the e-mails

ReadNotify.com

the user's IP address

their mail client downloading the remote image

sent

records

using

upon


Input: While ReadNotify.com forbids spoofing in their TOS, the service has a vulnerability known to the attackers (and which we confirmed) that allows spoofing the From address by directly setting the parameters on a submission form on their website.


Input: We have not found evidence suggesting this vulnerabil- ity is publicly known, but it appears clear that the attacker ex- ploited it, as the web form adds a X-Mai1er: RNwebmail header not added when sending through ReadNotify.com's other supported methods.


Input: The header appeared in each e-mail the targets forwarded to us.


Input: When spoofing using this method, the original sender ad- dress still appears in X-Sender and other headers.


Input: Accord- ing to these, the e-mails received by the targets all came from fatoomah85 @gmail.com.


Input: A link sent in one of these e- mails was connected to the al9mood bit.ly account.


Input: In monitoring accounts connected to al9mood, we counted more than 200 IP spy links in Twitter messages and public Facebook posts.


Input: Attackers often used (1) accounts of promi- nent or trusted but jailed individuals like'' Red Sky,'' (2) fake personas (e.g., attractive women or fake job seekers when tar- geting a labor union), or (3) impersonations of legitimate ac- counts.

Attackers

(1) accounts of promi- nent or trusted but jailed individuals like'' Red Sky,'' (2) fake personas (e.g., attractive women or fake job seekers when tar- geting a labor union), or (3) impersonations of legitimate ac- counts

used


Input: In one particularly clever tactic, attackers exploited Twitter's default font, for example substituting a lowercase'' l'' with an uppercase'' I'' or switching vowels (e.g.


Input: from'' a'' to an'' e'') to create at-a-glance identical usernames.


Input: In addition, malicious accounts tended to quickly delete IP spy tweets sent via (public) mentions, and frequently change profile names.


Input: The use of RATs against the opposition has been a well- documented feature of the Syrian Civil War since the first re- ports were published in early 2012 [,,,,].


Input: The phenomenon is widespread, and in our experience, most mem- bers of the opposition know that some hacking is taking place.


Input: As summarized in Table 3, the attacks often include fake or ma- liciously packaged security tools; intriguing, or ideological, or movement-relevant content (e.g. lists of wanted persons).

the attacks

fake or ma- liciously packaged security tools; intriguing, or ideological, or movement-relevant content (e.g. lists of wanted persons)

include


Input: The seeding techniques and bait files suggest a good understanding of the opposition's needs, fears and behavior, coupled with ba- sic familiarity with off-the-shelf RATs.


Input: In some cases attacks occur in a context that points to a more direct connection to one of the belligerents: the Syrian opposition has regularly ob- served that detainees' accounts begin seeding malware shortly after their arrest by government forces.


Input: Researchers and security professionals have already profiled many of these RATs, including DarkComet [,], Black- shades Remote Controller, Xtreme RAT, njRAT, and ShadowTech.


Input: Some are available for purchase by any- one, in contrast to'' government only'' FinSpy and RCS.


Input: For ex- ample, Xtreme RAT retails for e350, while a version of Black- shades lists for e40.


Input: Others, like DarkComet, are free.


Input: We have also observed cracked versions of these RATs on Arabic- language hacker forums, making them available with little ef- fort and no payment trail.


Input: While the RATs are cheaper and less sophisticated than FinSpy and RCS, they share the same ba- sic functionality, including screen capture, keylogging, remote monitoring of webcams and microphones, remote shell, and file exfiltration.

the same ba- sic functionality

screen capture

keylogging

remote monitoring of

webcams

microphones

remote shell

file exfiltration

including


Input: In the most common attack sequence we observed, illus- trated with three examples in Figure 3, the attacker seeds mal- ware via private chat messages, posts in opposition-controlled social media groups, or e-mail.

the attacker

mal- ware

private chat messages, posts in opposition-controlled social media groups, or e-mail

seeds

via


Input: These techniques often limit the world-visibility of malicious files and links, slowing their detection by common AV products.

These techniques

their detection by common AV products

slowing


Input: Typically, targets receive either (1) a PE in a .zip or .rar, (2) a file download link, or (3) a link that will trigger a drive-by download.

targets

either (1) a PE in a .zip or .rar, (2) a file download link, or (3) a link that will trigger a drive-by download

receive


Input: The messages usually include text, often in Arabic, that attempts to persuade the target to execute the file or click the link.

The messages

text, often in Arabic, that attempts to persuade the target to execute the file or click the link

include


Input: The first attacks in Figure 3 date to 2012, and use bait files with a DarkComet RAT payload.

The first attacks

bait files with a DarkComet RAT payload

use


Input: These attacks share the same C & C, 216.6.0.28, a Syrian IP address belonging to the Syr- ian Telecommunications Establishment, and publicly reported as a C & C of Syrian malware since February 2012.

These attacks

the same C & C, 216.6.0.28, a Syrian IP address belonging to the Syr- ian Telecommunications Establishment, and publicly reported as a C & C of Syrian malware since February 2012

share


Input: The first bait file presents to the victim as a PDF containing infor- mation about a planned uprising in Aleppo.

The first bait file

the victim

a PDF containing infor- mation about a planned uprising in Aleppo

presents

to

as


Input: In fact the file is a Windows Screensaver (.scr

the file


Input: ) that masquerades as a PDF using Unicode RLO, rendering a name such as'' .fdp.scr

masquerades

as

using

a PDF

Unicode RLO


Input: '' dis- play to the victim as'' .rcs.pdf


Input: '' The second bait file is a dummy program containing DarkComet while masquerading as a Skype call encryption program, playing to opposition para- noia about government backdoors in common software.

The second bait file

a Skype call encryption program

masquerading

as


Input: The third attack in Figure 3, observed in October 2013, entices tar- gets with e-mails purporting to contain or link to videos about the current conflict, infecting victims with Xtreme RAT, and using the C & C tn1.linkpc.net.

The third attack

tar- gets

e-mails purporting to contain or link to videos about the current conflict

victims

Xtreme RAT

the C & C tn1.linkpc.net

entices

infecting

using

with

with


Input: For seeding, the attackers typically use compromised ac- counts (including those of arrested individuals) or fake iden- tities masquerading as pro-opposition.

For

seeding

the attackers

compromised ac- counts (including those of arrested individuals) or fake iden- tities masquerading as pro-opposition

use