Franchising The Chinese APT

Two Chinese cyber espionage gangs known for targeting very different industries and working out of different regions of the nation actually use some of the same or similar tactics, tools, and resources in their spying operations, researchers found.

Such collaboration and resource sharing has not typically been the MO among the majority of Chinese cyber espionage groups, and this could indicate an evolution in the nation's cyberspying operations toward more organized, streamlined, and cooperative operations, according to FireEye, which studied the inner workings of the groups.

Security researchers from other firms say this is a trend that has been evolving for some time.

"They use similar malware implants, backend infrastructure, and similar social engineering techniques. But they are distinct based on their mission focus and locations," says Thoufique Haq, senior research scientist at FireEye. "It's quite possible they are subgroups with their own mission focus."

The so-called Moafee gang, which targets military and government entities such as the US defense industry, and the DragonOK gang, which targets high-tech and manufacturing companies in Japan and Taiwan, operate out of different regions in China and constitute separate groups, researchers say. Moafee appears to operate out of Guandong Province, and DragonOK appears to operate out of Jiangsu Province.

They use similar phishing email and malicious attachment structures in their targeted cyberattack campaigns, with password-protected Office documents or ZIP files with malicious executables, as well as phony documents that mask the malware running in the background. They each also attempt to hide the malware by halting its execution if only one CPU is detected running it, which could indicate a virtual machine analyzing it. They also require passwords for the victims to open the documents as a way to bypass antivirus engines and other security tools, and they pad files so that they appear larger and can bypass host-based AV engines, FireEye has found.

Moafee and DragonOK also use the backdoor malware, including CT/NewCT, NewCT2, Mongall, Nflog, and PoisonIvy. They also use the popular HTRAN proxy tool on their command and control servers to mask their locations.

"They are collaborating or a handoff is going on between the APT attackers… they are not completely isolated groups," Haq says.

His team could not determine just how successful the two APT groups have been in their cyberspying operations, but most of their operations are still under way. Though Moafee and DragonOK haven't been exposed much publicly before, they have been operating under the radar for some time.

"It's not very often you can gain insight into the methodology of a [cyber espionage] attacker," he says. "In the crimeware industry, you… have a good understanding of the payloads. In APTs, this usually happens behind the curtain."

Aviv Raff, CTO at Seculert, says he and his team have seen attackers sharing tools and resources. "There are even 'as-a-service' groups just for that. However, I think it's more important to understand the motive behind the attack, instead of trying to attribute it to a specific attacker."

Researchers at AlienVault also have seen Chinese APTs sharing zero-day exploits for several years, says Jaime Blasco, director of AlienVault Labs. "It seems there is either a supply chain or I would say a huge amount of information-exchanging and collaboration between groups operating in China," Blasco says.

What was the most surprising thing about the Moafee and DragonOK groups? "The most surprising aspect here is their use of very simple evasion techniques, such as detecting the CPU… that's been known about for more than a decade in the industry," Haq says. "I'm very surprised they were still able to use them and remain effective against their targets."

Meanwhile, FireEye says a third Chinese APT group may also be using some of the same tools and techniques as Moafee and DragonOK. "By sharing TTPs and coordinating joint attacks, these advanced threat actors are leveraging China's supply chain economic expertise to perform extensive worldwide espionage," FireEye's research team wrote in a blog post today.