Input: They generally create archive files containing the content they want to exfiltrate, which are then sent to the attackers by using a remote administration tool (RAT) or transfer protocols such as FTP and HTTP.

They

archive files containing the content they want to exfiltrate

the attackers

using a remote administration tool (RAT) or transfer protocols such as FTP and HTTP

create

are then sent

to

by


Input: This phase is not the end of an APT attack.


Input: The attackers loop to the access strengthening/lateral moves stage and generally keep stealing more information and stay inside the network for more data gathering.

The attackers

more information

the network

more data gathering

stealing

stay

inside

for


Input: For more information about all the APT phases, please refer to our APT Kill Chain blog post serie.


Input: During our regular investigations on APT cases, one particular variant of malware caught our attention, because we had not faced it before.


Input: We decided to spend some time to investigate around this malware and found out that it was used exclusively by a single group of attackers.


Input: This malware family is known as'' PittyTiger'' by the anti-virus research community.


Input: We discovered this malware sample in June 2014, leading to a command & control (c & c) server still in activity.

this malware sample

a command & control (c & c) server still in activity

leading

to


Input: Our researches around this particular malware family revealed the'' Pitty Tiger'' group has been active since 2011, yet we found other publications which could probably be attributed to the same group of attacker back in 2010.


Input: This group uses other malware and tools during their APT operations, in addition to the PittyTiger RAT.


Input: A variant of the infamous Gh0st RAT dubbed'' Paladin'' has been used repeatedly by the PT group, together with other RATs which seem to be developed exclusively for the PT group:'' MM RAT'' (aka Troj/Goldsun-B), and'' CT RAT''.


Input: Another variant of Gh0st RAT named'' Leo'' has been found inactive on a c & c server.


Input: We also found another malware, named'' Troj/ReRol.A''.


Input: This one is also used by the group to infect workstations, collect system information, and install more malware on the infected computer.

This one

workstations

system information

more malware

the infected computer

infect

collect

install

on


Input: It acts as a first stage downloader and system data collector often used in the initial compromise of the Pitty Tiger campaigns, generally embedded in Microsoft Office documents.

It

a first stage downloader

system data collector

Microsoft Office documents

acts

embedded

as

in


Input: Thanks to server's misconfigurations, we managed to get information from three c & c servers used by this group of attackers, which provided us with insight from the end of 2013 to the beginning of July 2014.

three c & c servers

this group of attackers

used


Input: Our investigation has been focused on the data we could get from these c & c servers but also on the Pitty Tiger environment.


Input: This whitepaper aims to expose the view we have on the group, especially on their infrastructure and capabilities.


Input: We hope this publication will bring further counter analysis from the research community to enrich the global common threat knowledge.


Input: Pitty Tiger, like most other APT groups, use spear phishing e-mails extensively in order to gain an initial foothold within the targeted environment.

Pitty Tiger

spear phishing e-mails

extensively

gain an initial foothold within the targeted environment

use

in order to


Input: We have been able to find a spear phishing e-mail crafted by the attackers.

a spear phishing e-mail

the attackers

crafted


Input: This e-mail spoofed the identity of an employee of a targeted company: The attached file is a Microsoft Office Word document triggering CVE-2014-1761 to infect the computer it is sent to: While this example looks very'' amateur'' for a spear phishing attempt, we suppose the group has conducted more advanced spear phishing campaigns, based on the fact that we found infected Word documents showing content stolen from victims of the group.

This e-mail

the identity of an employee of a targeted company

a Microsoft Office Word document

infect the computer it is sent to

the group

more advanced spear phishing campaigns

content

victims of the group

spoofed

triggering

conducted

stolen

to

from


Input: These documents were infecting the system with Troj/ReRol.A malware, which we will detail later in this report.

These documents

the system

Troj/ReRol.A malware

were infecting

with


Input: This could mean that the Pitty Tiger group is using stolen material as spear phishing content either to target other persons in the compromised company, or to target other persons in a competitor's company, or more generally to compromise another target.

the Pitty Tiger group

stolen material

spear phishing content

is using

as


Input: Pitty Tiger also seem to use fake Microsoft Office Excel content, yet we could only find empty content delivering once again the Troj/ReRol.A malware.

Pitty Tiger

fake Microsoft Office Excel content

use


Input: Although we have not been able to find evidences of any attack aimed at exploiting vulnerabilities on the group's targets servers, we have been able to record several vulnerability scanning launched from one c & c server straight to the targets.

vulnerability scanning

one c & c server

the targets

launched

from

straight to


Input: The attackers have been using different vulnerability scanners aimed at their targets.

The attackers

different vulnerability scanners aimed at their targets

been using


Input: While some targets have been scanned with'' generic'' vulnerability scanning tools like HScan or Fluxay and port scanners like Nmap, some other targets have been scanned for very specific vulnerabilities, like a ZyWALL vulnerability or a FORTINET product.

some targets

'' generic'' vulnerability scanning tools like HScan or Fluxay and port scanners like Nmap

some other targets

very specific vulnerabilities, like a ZyWALL vulnerability or a FORTINET product

been scanned

been scanned

with

for


Input: We have also been able to testify that the Pitty Tiger group has successfully collected information on some of their targets by exploiting the HeartBleed bug.

the Pitty Tiger group

information on some of their targets

exploiting the HeartBleed bug

collected

by


Input: This vulnerability which exists on some old versions of OpenSSL allows attackers to collect data from chunks of memory from the targeted machine.

attackers

data

chunks of memory from the targeted machine

collect

from


Input: It allowed the Pitty Tiger group to get admin credentials from at least one target, for example.

the Pitty Tiger group

admin credentials

at least one target

get

from


Input: Running automated vulnerability scanners on whole ranges of IP addresses used by the targets or on several domains is a very noisy way to collect information and find server vulnerabilities.

Running

collect

find

automated vulnerability scanners

whole ranges of IP addresses used by the targets

several domains

information

server vulnerabilities

on

on


Input: We would advocate that this method is unwise when you want to stay furtive, and doing it from a c & c server is very surprising, to say the least.


Input: While the Pitty Tiger group is experienced on some aspects on its running APT campaigns, it definitely lacks some maturity here.


Input: One of the favorite methods used by the Pitty Tiger group to infect users is to use a Microsoft Office Word document which exploits a specific vulnerability.

the Pitty Tiger group

infect users

a Microsoft Office Word document which exploits a specific vulnerability

to

use


Input: The payload infecting the system is malware known as'' Troj/ReRol.A''.

The payload

the system

infecting


Input: It is generally the first step of the initial compromise for Pitty Tiger campaigns.


Input: We have been able to find one such document used by that group of attacker, exploiting CVE- 2012-0158, an old critical vulnerability impacting Microsoft Office and corrected by Microsoft's MS12-027 fix in April 2012.

one such document used by that group of attacker

CVE- 2012-0158, an old critical vulnerability impacting Microsoft Office and corrected by Microsoft's MS12-027 fix in April 2012

exploiting


Input: This vulnerability affects Microsoft Office versions up to Office 2010.


Input: We also found one RTF document embedding CVE-2014-1761, which is a more recent exploit.

one RTF document

embedding


Input: We discovered several different documents spreading this malware by triggering CVE-2012-0158 vulnerability, yet we could not share them in this report, since these documents contain information about victims of the Pitty Tiger group.

several different documents

this malware

triggering CVE-2012-0158 vulnerability

spreading

by


Input: The discovery of this'' old'' vulnerability exploitation in June 2014 could mean that the Pitty Tiger group has no direct access to 0day exploits, or not enough budgets to buy some.


Input: It could also mean they use their low range exploit by default because it is working on their targets and is sufficient to compromise their workstations.


Input: The Word document we initially found was probably a'' test'' document used by the group.


Input: When opened, it shows a single line written in Chinese language, which can be translated as'' Hello!'' When successfully triggered, the exploit infects the host by dropping and executing a file named'' svohost.exe'' in the temporary folder of the currently logged-in user: This binary is'' Troj/ReRol.A'' according to Sophos naming convention.

the exploit

the host

a file named'' svohost.exe''

the temporary folder of the currently logged-in user

infects

dropping

executing

in


Input: It immediately triggers alarms on our sandbox: The binary drops a copy of itself in the Application Data folder of the currently logged-in user: The malware initiates a communication to time.windows.com to check for connectivity, and then communicates with the c & c server at mac.avstore.com.tw.

The binary

a copy of itself

the Application Data folder of the currently logged-in user

The malware

a communication

time.windows.com

connectivity

the c & c server

mac.avstore.com.tw

drops

initiates

check

communicates

in

to

for

with

at


Input: Very few variants of Troj/ReRol.A are public.


Input: The variants we have seen did use that same User- Agent: The persistence mechanism used by the malware is the creation of a registry key named'' Shell'' containing the path to the malware on the infected system: The payload of this malware is used to collect information on the newly infected host, and send it back to the c & c server.

The persistence mechanism

the malware

the creation of a registry key named'' Shell'' containing the path to the malware on the infected system

The payload of this malware

collect information on the newly infected host

it

the c & c server

used

is

is used

send

to

back to


Input: It can also download and execute binaries.

It

binaries

download

execute


Input: The data sent in the POST request has a 0x11 bytes header consisting of a fixed-value byte (0xc3) followed by a 0x10 bytes encryption key.

The data

the POST request

sent

in


Input: The data following the header is encrypted using RC4 with the previous key.

The data following the header

the previous key

is encrypted

using

with


Input: Once the data is deciphered, the last byte of the clear text should also be 0xc3.


Input: We have been able to decrypt the communications and confirmed what is transmitted to the c & c server.


Input: Here is an anonymized sample of communication showing information collected by the malware: This information is very useful for an attacker: it shows all software installed on the system, and running services.

information

the malware

it

all software installed on the system

running services

collected

shows


Input: Once this data has been transferred to the c & c server, it responds by sending additional malware to execute on the machine.

this data

the c & c server

it

additional malware to execute on the machine

been transferred

sending

to


Input: The c & c part consists of two files: The dr.asp registers the following keywords: These two binaries were no longer available on the server.


Input: However, we found various files which could have been used as'' 32.exe'' in the past: The 322.exe file is a legitimate, Chinese, calc.exe tool.


Input: It might have been used by the attackers to perform tests.


Input: The 3 others binaries are RATs, which will be detailed in the next parts.


Input: This RAT is the origin of the attackers' group name.


Input: '' PittyTiger'' is a mutex used by the malware.


Input: '' Pitty Tiger'' is also a string transmitted in the network communications of the RAT, as you will see in this chapter.


Input: The malware, when running in our sandbox, triggers the following alarms: The binary drops two files in'' C: \Windows\System32'': The'' qmgrxp.exe'' binary is a simple copy of the original binary.

The binary

two files

'' C: \Windows\System32''

The'' qmgrxp.exe'' binary

a simple copy of the original binary

drops

is

in


Input: It drops the'' packet64.dll'', and injects it in'' explorer.exe''.

It

the'' packet64.dll''

it

'' explorer.exe''

drops

injects

in


Input: When executed, a mutex called'' PittyTiger'' is created.

a mutex called'' PittyTiger''

is created


Input: Persistence is achieved by adding the path to the binary to the WinlogonUserInit key: The'' packet64.dll'' is the main payload of the RAT.

Persistence

adding the path to the binary to the WinlogonUserInit key

is achieved

by


Input: After being injected, it starts sending its Hello packet to its c & c server: All the requests sent to the c & c contains the string'' /FC001/'' followed by the bot id.

it

its Hello packet

its c & c server

All the requests

the c & c

sending

sent

to

to


Input: This id consists of the infected computer name followed by a dash and the lower word of the disk serial id.


Input: The data sent is simply encoded using base64, there is no cipher at all.

The data sent

is simply encoded

using


Input: The hello packet, once decoded, looks like the following: Our sample had 3 c & c servers configured: The following commands are implemented: Regarding the controller part, we found two different versions: The interface handling both Pitty TIGER and CT connections is very interesting.

Our sample

3 c & c servers

The following commands

configured

are implemented


Input: We have been able to confirm that the author of those two families of malware is the same person, as will be seen in the next chapter about'' CT RAT''.


Input: This remote administration tool is often used by the Pitty Tiger group.

This remote administration tool

the Pitty Tiger group

is often used


Input: We have been able to acquire both the client and the server parts.


Input: We found two instances of the same binary with different names–32mm.exe and mm32.exe.


Input: This RAT seems to be an evolution of PittyTiger, since a specific server binary we found could handle both requests from CT and PittyTiger, and was indicated as compatible with PittyTiger.


Input: Moreover, the same commands are implemented in both RATs.

the same commands

both RATs

are implemented

in


Input: Unsurprisingly, when running in our sandbox, the RAT triggers the same alarms as PittyTiger: The binary drops two files in'' C: \Program Files\Internet Explorer'': The'' ieupdate.exe'' is a simple binary to inject the DLL into'' explorer.exe''.

The binary

two files

'' C: \Program Files\Internet Explorer''

The'' ieupdate.exe''

the DLL

'' explorer.exe''

drops

inject

in

into


Input: Persistence is achieved via the following registry key: After injection, the RAT sends a first login packet to its c & c: The RAT communication is performed through HTTP requests.

Persistence

the following registry key

the RAT

a first login packet

its c & c

The RAT communication

HTTP requests

is achieved

sends

is performed

via

to

through


Input: The data is sent encrypted with RC4, and base64-encoded.

The data

encrypted with RC4, and base64-encoded

is sent


Input: The RC4 key is the Unicode form of the requested URL.


Input: The Login packet contains the following string, after decoding and deciphering: It contains the computer name, the user name, the internal IP address, the OS version, the RAT internal version and the Language ID of the system.

It

the computer name

the user name

the internal IP address

the OS version

the RAT internal version

the Language ID of the system

contains


Input: The RAT can then receive commands from its c & c.

The RAT

commands

its c & c

receive

from


Input: Usual RAT features are implemented: Regarding the configuration, our sample communicates with'' sop.avstore.com.tw'', and contains the string'' Nov 13 2013'', which should be a version identifier.

our sample

'' sop.avstore.com.tw''

communicates

with


Input: The c & c part is a Windows binary written in .NET


Input: We found 2 versions: The About form gives the name of the developer (s): The version of the controller which can handle both PittyTiger and CT shows the same author (s): As these screenshots show, the switch between PittyTiger and CT was probably in the last semester of 2013.


Input: The text can be translated, thanks to Google Translate, as: Further discussion about this author is provided in subsequent sections.


Input: We named this malware'' MM RAT'' at the beginning of our investigation, before we found an existing name for it,'' Troj/Goldsun-B'' according to Sophos.


Input: This is another remote administration tool often used by the Pitty Tiger crew.

another remote administration tool

the Pitty Tiger crew

used


Input: We have been able to acquire both a client and server part for it.


Input: The binary we found is named 3200.exe, and triggers the following alarms in our sandbox: The'' release.tmp'' file is dropped on the system: The binary is also copied to the user's'' Application Data'' directory, and injects the'' release.tmp'' file in'' explorer.exe''.

The'' release.tmp'' file

the system

The binary

the user's'' Application Data'' directory

the'' release.tmp'' file

'' explorer.exe''

is dropped

is also copied

injects

on

to

in


Input: Persistence is achieved by adding the path to the binary to the Winlogon Shell key: The RAT embeds its own DNS server IP addresses to make the c & c domain names resolutions.

Persistence

adding the path to the binary to the Winlogon Shell key

The RAT

its own DNS server IP addresses

make the c & c domain names resolutions

is achieved

embeds

by

to


Input: These addresses are listed below: It starts resolving its domains after injection, and immediately sends requests.

It

its domains

injection

requests

resolving

sends

after


Input: First requests are used to check for updates (GET request on /httpdocs/update/update.ini).

requests

check for updates (GET request on /httpdocs/update/update.ini)

are used

to


Input: A Hello packet is then sent: The bot then repeatedly sends GET requests on'' /httpdocs/mm/ < botid > /ComMand.sec'' to retrieve remote commands.

A Hello packet

The bot

GET requests

'' /httpdocs/mm/ < botid > /ComMand.sec''

remote commands

is then sent

sends

retrieve

on


Input: The communication protocol is quite simple: GET requests are used to receive data from the c & c, and POST requests to send data.

GET requests

receive data from the c & c

POST requests

data

are used

send

to


Input: In POST commands, the CGI name represents the command.

In

POST commands

the CGI name

the command

represents


Input: The following features are implemented: The following CGI files can be requested by the bot: The configuration is stored locally in a file called'' schmup.sys''.

The following CGI files

the bot

be requested


Input: The file is ciphered using RC4, using the MD5 hash of'' rEdstArs'' as the key.

The file

the MD5 hash of'' rEdstArs'' as the key

is ciphered

using

using


Input: Our sample uses'' mca.avstore.com.tw'','' star.yamn.net'' and'' bz.kimoo.com.tw'' as c & c servers.

Our sample

'' mca.avstore.com.tw'','' star.yamn.net'' and'' bz.kimoo.com.tw''

c & c servers

uses

as


Input: It contains the'' 1.6.0'' version number, and uses the password'' 9ol.8ik,'' to authenticate with the bots.


Input: Unlike others c & c binaries, the c & c part of this RAT does not have a graphical interface, but can be remotely requested to manage the bots.

the c & c part of this RAT

manage the bots

be remotely requested

to


Input: Furthermore, no authentication is required to send commands to the c & c (but you need to know the configured password to interact with the bots).

send

commands

the c & c

to


Input: The management protocol is the same as the bots protocol, with different CGI files: The bots' answers to remote commands can be retrieved by requesting the'' Reply.sec'' file (e.g.


Input: GET /httpdocs/mm/ < botid > /Reply.sec) These network patterns might ring bells in some researcher's minds.


Input: The network communication used by this binary are the same as those used by the Enfal malware, which has been used in the past by the Lurid group (APT attackers) and by other threat actors in China.


Input: An examination of the code did not reveal code similarities with the Enfal malware.


Input: We do not currently know why this malware uses the same patterns to communicate.

this malware

the same patterns

communicate

uses

to


Input: This is another remote administration tool used by the Pitty Tiger group.

another remote administration tool

the Pitty Tiger group

used


Input: We have been able to get both a client and server part of it.


Input: The binary we found was dropped by a malicious Word document.

The binary we found

a malicious Word document

was dropped


Input: The following alarms are triggered in the sandbox: The shellcode contained in the Word file drops the following file, and executes it: This one drops in turn the following file: This tmp file is then copied to'' C: \Windows\system32\Nwsapagentex.dll'' and registered as a service called'' Nwsapagent''.

The shellcode contained in the Word file

the following file

it

This one

the following file

This tmp file

'' C: \Windows\system32\Nwsapagentex.dll''

a service called'' Nwsapagent''

drops

executes

drops

is then copied

registered

in turn

to

as


Input: This malware is a variant of the infamous Gh0st RAT.


Input: Our specific sample uses'' ssss0'' instead of the usual'' Gh0st'' header for network communications.


Input: The commands ID used in the communication protocol have also changed, but the features are quite the same.


Input: The configuration is directly embedded in the binary, and deciphered at runtime.


Input: Up to 5 c & c servers can be configured, but our sample only had one:'' ey.avstore.com.tw:53''.

Up to 5 c & c servers

be configured


Input: '' EY'' could stand for'' Ernst & Young''.


Input: It would not be very surprising, since a lot of different attack groups do use anti-virus vendors or other big company's names to try to look more legitimate.


Input: Pitty Tiger is no exception, as detailed later in this report.


Input: We also found two c & c binaries, claiming to be versions 2.1 and 2.2 of the Paladin RAT controller.


Input: Version 2.1 answers to the'' ssss0'' header, while version 2.2 uses the classical'' Gh0st'' header.


Input: Additionally to the Paladin RAT, we found another variant of Gh0st RAT, named'' Leo''.


Input: Although we have found it on a c & c server of the group, there is no evidence that is has been used by the group, in opposition to Paladin which is used often by Pitty Tiger.


Input: Moreover, the built malware we found in the same folder was configured to connect to a local IP address, probably for testing purposes.

the built malware we found in the same folder

a local IP address

connect

to


Input: Our investigation has focused on three particular c & c servers used by the group.


Input: These c & c servers, unlike the other c & cs used by the group, have been misconfigured.


Input: Once parsed and dumped, it provided us with more insight.


Input: We found several domains used by the Pitty Tiger group, the most interesting ones being detailed in this chapter.


Input: Pitty Tiger, like other APT attackers, often use anti-virus'' familiar names'' when registering domains or creating subdomains.


Input: Some examples can be avstore.com.tw, sophos.skypetm.com.tw, symantecs.com.tw, trendmicro.org.tw etc.


Input: The registration information for this domain has been the same since 2013-06-04: This information has been used to register another domain, skypetm.com.tw, which has also been used by the Pitty Tiger group.


Input: Our research also led us to the discovery of four different malware families connected to subdomains of avstore.com.tw: This domain has shown two different WHOIS entries through time: The most recent registration information is also used for avstore.com.tw.


Input: Six malware families have been identified as communicating with subdomains of skypetm.com.tw: Avstore.com.tw and skypetm.com.tw have 4 malware families in common, communicating to subdomains of both domains: Some domains registered by the group are very old.

Six malware families

subdomains of skypetm.com.tw

4 malware families

subdomains of both domains

communicating

communicating

with

to


Input: There is an increase in the registrations from 2010 on.


Input: All the e-mail addresses used are connected to the Pitty Tiger group.


Input: Mapping the victims of such a targeted campaign is not an easy task.


Input: We have found the Pitty Tiger group to be very active against one particular private company from the defense industry and one academic network of a government,, yet we think it was done to be used as a proxy for some of the group's operations.


Input: We have also found some connections from other companies to the c & c servers, yet we did not find evidence that they were real victims.


Input: These alleged victims do work in different sectors and are located mostly in European countries.


Input: It might be surprising to see a company specialized in web development here, yet it has built websites for interesting potential targets.


Input: We suspect Pitty Tiger to use this compromise to spear phish other companies which are in commercial relation with this web development company.

Pitty Tiger

other companies which are in commercial relation with this web development company

spear phish


Input: We have to mention that we only had access to three of the several attackers' servers.


Input: Therefore, we suppose the Pitty Tiger group could have more targets than what we could confirm.


Input: We also found a lot of vulnerability scanners launched by the attackers at different targets, yet there was no sign of compromise.

vulnerability scanners

the attackers

different targets

launched

at


Input: During the course of our investigations, we discovered a RAR archive on the attacker's server containing 5 Word documents and one small C source code.


Input: These documents belong to the defense company which has been compromised.


Input: According to the name of the files and the general feel of the archive, we do think it was extracted by the attackers to'' show'' someone what kind of data they could get from the compromise of that particular target.

it

the attackers

'' show'' someone what kind of data they could get from the compromise of that particular target

was extracted

to


Input: The documents were still exhibiting comments from various users, showing it was an ongoing work and not old documents.


Input: Interestingly enough, we saw a part of these documents appear on Virus-Total, with an additional'' gift'' from the attackers, a payload dropping a malware.

a payload

a malware

dropping


Input: There are only two options we can think of here:  Someone from the same company has been targeted with this document.

Someone from the same company

this document

been targeted

with


Input:  Someone from another company has been targeted with this document.

Someone from another company

this document

been targeted

with


Input: This other company could be a partner or competitor.


Input: Since we were unable to determine the intended use of this specific document, we can only suppose that it could be used to provide commercial advantages to competitors of that company, or used by a foreign state.


Input: During our investigation, we found out interesting information about the Pitty Tiger group itself.


Input: After analyzing the various collected elements, we have tried to draw a portrait of this particular threat.


Input: We have been able to get all the RDP connections logs to one c & c server: These connections are either VPS or dynamic IP addresses, mostly from China.


Input: A computer named CHMXY-PC connected to the c & c via RDP with IP address 58.61.40.5.

A computer named CHMXY-PC

the c & c

RDP

IP address 58.61.40.5

connected

to

via

with


Input: The IP is in an ADSL dynamic pool in the Gangzhou area (Guangdong province): A few connections to the c & c were done by a computer named TIEWEISHIPC with IP address 27.16.139.143.

A few connections to the c & c

a computer named TIEWEISHIPC with IP address 27.16.139.143

were done


Input: This IP address belongs to an ADSL dynamic pool in the Wuhan area (Hubei's provincial capital).


Input: Some connections to the c & c originated from a computer named FLY-THINK with several IP addresses, all located in Fuqing (Fujian province).

Some connections to the c & c

a computer named FLY-THINK with several IP addresses, all located in Fuqing (Fujian province)

originated

from


Input: The IP addresses are in an ADSL dynamic pool: Most of the connections to the c & c server were coming from a computer named 50PZ80C- 1DFDCB8 with several IP addresses.

Most of the connections to the c & c server

a computer named 50PZ80C- 1DFDCB8 with several IP addresses

were coming

from


Input: There are 11 IP addresses from Chinese dynamic ADSL ranges: 9 from Fuqing (Fujian province), one from Fuzhou (Fujian's province capital) and one from Nanchang (Jiangxi's province capital).


Input: The last one came from a VPS instance located in Los Angeles (California, USA) but purchased by a China based VPS provider XeVPS which belong to the AS38197 (Sun Network Hong Kong Limited).


Input: The two computers FLY-THINK and 50PZ80C-1DFDCB8 have used distinct IP addresses to connect to the c & c, yet some of these IP addresses come from the same IP range: We mapped these RDP connections to have a graphical view: We found that a member of this group of attackers used some tools on his own system, for testing purposes.

The two computers FLY-THINK and 50PZ80C-1DFDCB8

distinct IP addresses

connect to the c & c

used

to


Input: This information was still available when we got access to the c & c server.


Input: He launched some tests with the CT RAT we exposed earlier: Here we can see a user'' Toot'' from a machine named'' toot-2a601225a8'' logging in the CT RAT and executing some commands.

a user'' Toot''

some commands

executing


Input: The c & c IP address, 198.100.113.27, can be seen there.


Input: Other log files showed that'' Toot'' is using virtual machines for his tests.


Input: We can also see the system: Microsoft Windows XP SP3.


Input: The'' P'' field is the language ID.


Input: 1028 means'' Chinese traditional''.


Input: We have also seen tests run by'' toot'' with a language ID of 2052, which is'' Chinese simplified''.


Input: The'' M'' field is probably used for versioning.


Input: It is a hardcoded string in the binary.


Input: After these tests, we could see some real connections to a victim using this RAT.

some real connections to a victim

this RAT

using


Input: Here is a follow-up of the commands launched by the bot controller, in a standard command-line shell: The attacker goes on like this, using his tools, and then ends the communication with this RAT on that computer.


Input: Please note that at this point, the attacker has at least the privileges of a local administrator, since he is allowed to write content in the system32 folder of a Windows XP system.

the attacker

the privileges of a local administrator

he

content

the system32 folder of a Windows XP system

has

write

at least

in


Input: He could also gain the credentials to a sensitive e-mail account.

He

the credentials to a sensitive e-mail account

gain


Input: In addition to all information already shown, we saw Toot connect to an account on a cloud service named'' Baidu Drive''.


Input: The e-mail address linked to this account is dyanmips @qq.com (QQ-ID: 2589315828).


Input: We could find traces of two other e-mail accounts associated to Toot, ciscodyanmips @qq.com (QQ ID: 204156335) and ciscodynamips @qq.com (QQ ID: 1878836793).


Input: We did not find more information about user'' Toot'', yet we miss Chinese language capabilities.


Input: The controller part of CT RAT/PittyTiger RAT revealed the following'' about'' information, once translated from Chinese to English language: CT console (compatible pittytiger) v1.3 2013.12 by Trees and snow We believe this translation of the author's name might not be accurate due to the use of automated translation tools.


Input: Moreover, we have strong suspicions that there is not a single individual nicknamed'' Trees and snow'' but rather two programmers nicknamed'' Trees'' and'' Snow''.


Input: '' Trees'' could also be'' Cold''.


Input: We noticed that the symbol for this word is translated differently according to the context it is used in.


Input: Once again, we lack Chinese language skills.


Input: We identify the two nicknames on the current campaign as Automn Snow (秋雪) and Cold Air Kiss (风吻寒).


Input: While we are confident that these people are indeed the developers of both PittyTiger and CT RAT malware, we are not sure they belong to the PittyTiger group.


Input: These developers might just have been hired to develop these RATs.


Input: They might also just be selling it to the PittyTiger group.


Input: There is no trace of usage from other attacking groups, we believe the PittyTiger RAT is exclusively used by this group of attackers.


Input: According to indicators we gathered and threat activities profiling we have some hypothesis on the way the group is conducting its operations.


Input: We have strong evidence of a bot operator position.


Input: We identify one nickname for this position, the user known as TooT.


Input: As we did not see other nickname, we think that TooT is one person and not a group of persons.


Input: We also identified a malware development position.


Input: We identified two nicknames for this position on the current campaign, Automn Snow (秋雪) and Cold Air Kiss (风吻寒).


Input: Yet we are unsure that they belong to the group, they might just be a third party providing or selling their malware.


Input: We have a strong suspicion of a coordinator position, which coordinates the bot operator, provides him with some logistics support (weaponized document, tools…) and reviews the programmers work.


Input: This position could imply a communication channel with another manager.


Input: We named this position'Chen', in relation with several references of this common Chinese name in c & c WHOIS and other investigation materials.


Input: We have some suspicion of a customer relationship manager position that may act as an interface between a customer and Chen.


Input: We named this position'Lilly'.


Input: The c & c servers used by the attackers revealed a lot of interesting files stored in various folders: This is quite the usual arsenal for a group of APT attackers: What is rare to find is the controller part of those tools.

The c & c servers

the attackers

used


Input: We have been lucky enough to get the controller part of Pitty Tiger and CT RAT, and even to get a kind of hybrid controller made for CT RAT but also supporting Pitty Tiger.


Input: We suppose that the CT RAT is the new evolution of Pitty Tiger and that it will replace Pitty Tiger in the following months.


Input: The presence of a Chinese version of'' calc.exe'', the official calculator provided in Microsoft Windows, is interesting.


Input: Not only is it one more indicator of a probable Chinese origin, but also an indicator that this server was probably used as a test base, in addition to being operational and controlling infected machines from different targets.

this server

infected machines from different targets

controlling


Input: In addition to those tools, we found some interesting scripts.


Input: A script named ipc.bat uses a file named user.txt to try to brute-force a shared folder access: The user.txt file contains thousands of lines, each one being a couple of one particular username and one password attempt: This user.txt file has been anonymized, yet we wanted to give you the feel for it.

a file named user.txt

a shared folder access

brute-force


Input: This file is 67320 lines long, and uses 5610 different passwords for each of 12 users contained in this file.


Input: The user names are clearly the result from a user enumeration and are dedicated to a particular French victim.


Input: The passwords listed in this file are either build from several campaigns or from the current campaign.


Input: A lot of passwords are related to the targeted company and might be previous passwords from users.


Input: We have also discovered a pack of files which can be used to trigger an Internet Explorer vulnerability (CVE-2014-0322).


Input: The date of these files, namely Tope.swf and index.html, was 2014/02/18, a few days after the revelation of existing exploits in the wild used in APT attacks.


Input: We do not know if the Pitty Tiger group used this exploit or not, but found no trace indicating they did.


Input: A lot of different attackers seem to have used that vulnerability since.


Input: Determining who is exactly behind an APT campaign is difficult.


Input: We tried to extract different technical indicators, together with contextual elements.


Input: Information relating to the tools used by the attackers has been leveraged for attribution: The IP addresses used for the hosting of the c & c domains are mainly located in Taipei (Taïwan) and Hong Kong City (Hong Kong Special Administrative Region, PRC): Most RDP connections to the c & c infrastructure come from Chinese IP ranges in Fuqing (Fujian province, PRC).

The IP addresses

the hosting of the c & c domains

Most RDP connections to the c & c infrastructure

Chinese IP ranges in Fuqing (Fujian province, PRC)

used

come

for

from


Input: Yet some IP addresses in the USA and in Hong Kong have also been found; All the items listed in this chapter are strong indicators that the attackers might be Chinese.


Input: Pitty Tiger is a group of attackers that have been active since at least 2011.


Input: Pitty Tiger is effective and mature in the use of targeted malware, the use of known exploits to infect computers with their malware and the creation of an infrastructure to efficiently conduct APT attacks.

Pitty Tiger

computers

their malware

infect

with


Input: They are quite unprofessional in their way of using their infrastructure: they do launch vulnerability scanners directly from a c & c server and also use their connection for personal activities (downloading pornographic material for example, as we have seen a whole folder on a c & c server full of xxx torrent links).

they

vulnerability scanners

a c & c server

launch

directly from


Input: Pitty Tiger is probably not a state-sponsored group of attackers.


Input: The attackers lack the experience and financial support that one would expect from state-sponsored attackers.


Input: We suppose this group is opportunistic and sells its services to probable competitors of their targets in the private sector.


Input: One governmental network has been targeted by the group, yet we do not have any evidence of the purpose of this attack.


Input: We suppose this particular attack has been executed to provide a usable bounce for the group.


Input: The campaign we studied has been largely focused on one particular target.


Input: We suspect the Pitty Tiger group to work according to an opportunistic business model: this group might offer its services to third parties from the private sector.


Input: This group seems to be very small compared to other APT groups.


Input: We have leveraged several profiles and could identify some attackers to a certain extent.


Input: We believe this group might keep working as it is now, with limited budgets, or grow to extend its attacking campaign capabilities.


Input: This list of indicators is provided in order to help people detect Pitty Tiger APT campaign.


Input: Domains used by the Pitty Tiger group: (please note several subdomains are used, as seen in the report)