Top Banner
#RSAC SESSION ID: SESSION ID: Sean Duca APT Attacks in the Asia Pacific TTA-R01 Chief Security Officer – APAC Palo Alto Networks @seanduca Vicky Ray UNIT 42 – Threat Intelligence Analyst Palo Alto Networks @0xVK
31

APT Attacks in the Asia Pacific - RSA Conference · #RSAC. AGENDA. 2. Unit 42 Mission Why Asia Pacific is a constant target of APT threat actors 0-days or known exploits Targeted

Jan 22, 2019

Download

Documents

vunga
Welcome message from author
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
Page 1: APT Attacks in the Asia Pacific - RSA Conference · #RSAC. AGENDA. 2. Unit 42 Mission Why Asia Pacific is a constant target of APT threat actors 0-days or known exploits Targeted

#RSAC

SESSION ID:SESSION ID:

Sean Duca

APT Attacks in the Asia Pacific

TTA-R01

Chief Security Officer – APACPalo Alto Networks@seanduca

Vicky RayUNIT 42 – Threat Intelligence AnalystPalo Alto Networks@0xVK

Page 2: APT Attacks in the Asia Pacific - RSA Conference · #RSAC. AGENDA. 2. Unit 42 Mission Why Asia Pacific is a constant target of APT threat actors 0-days or known exploits Targeted

#RSAC

AGENDA

2

Unit 42 Mission

Why Asia Pacific is a constant target of APT threat actors

0-days or known exploits

Targeted Attack Case studies

What do we learn from the APT attacks

Way forward

Page 3: APT Attacks in the Asia Pacific - RSA Conference · #RSAC. AGENDA. 2. Unit 42 Mission Why Asia Pacific is a constant target of APT threat actors 0-days or known exploits Targeted

#RSAC

Unit 42 Mission

3

Analyze the data available to Palo Alto Networks to identify adversaries, their motivations, resources, and tactics to better understand the threats our customers face.

Page 4: APT Attacks in the Asia Pacific - RSA Conference · #RSAC. AGENDA. 2. Unit 42 Mission Why Asia Pacific is a constant target of APT threat actors 0-days or known exploits Targeted

#RSAC

Connecting the dots together

4

Page 5: APT Attacks in the Asia Pacific - RSA Conference · #RSAC. AGENDA. 2. Unit 42 Mission Why Asia Pacific is a constant target of APT threat actors 0-days or known exploits Targeted

#RSAC

Why is Asia Pacific a target of APT ?

5

Economic Growth

Page 6: APT Attacks in the Asia Pacific - RSA Conference · #RSAC. AGENDA. 2. Unit 42 Mission Why Asia Pacific is a constant target of APT threat actors 0-days or known exploits Targeted

#RSAC

Why is Asia Pacific a target of APT ?

6Territorial disputes

https://en.wikipedia.org/wiki/Territorial_disputes_in_the_South_China_Sea

Page 7: APT Attacks in the Asia Pacific - RSA Conference · #RSAC. AGENDA. 2. Unit 42 Mission Why Asia Pacific is a constant target of APT threat actors 0-days or known exploits Targeted

#RSAC

Most Targeted Application ?

7

Page 8: APT Attacks in the Asia Pacific - RSA Conference · #RSAC. AGENDA. 2. Unit 42 Mission Why Asia Pacific is a constant target of APT threat actors 0-days or known exploits Targeted

#RSAC

Zero-days or Known exploits used

8

CVE-2010-3333 – Microsoft Office Remote Code Execution Vulnerability

CVE-2012-0158 – Microsoft Office Remote Code Execution Vulnerability

CVE-2017-0199 – Microsoft Office/WordPad Remote Code Execution Vulnerability.

Page 9: APT Attacks in the Asia Pacific - RSA Conference · #RSAC. AGENDA. 2. Unit 42 Mission Why Asia Pacific is a constant target of APT threat actors 0-days or known exploits Targeted

#RSAC

BACKDOOR TROJAN

EXPLOIT ATTACHMENT

BACKDOOR ACCESS

SPEAR PHISHING EMAIL

DECOY FILE

TARGET

SPEAR PHISHING + DECOY

ACTOR

Page 10: APT Attacks in the Asia Pacific - RSA Conference · #RSAC. AGENDA. 2. Unit 42 Mission Why Asia Pacific is a constant target of APT threat actors 0-days or known exploits Targeted

#RSAC

Tropic Trooper

10

TROPIC TROOPER targets the Taiwan Government

Who is Tropic Trooper?

Page 11: APT Attacks in the Asia Pacific - RSA Conference · #RSAC. AGENDA. 2. Unit 42 Mission Why Asia Pacific is a constant target of APT threat actors 0-days or known exploits Targeted

#RSAC

TROPIC TROOPER TARGETS THE TAIWAN GOVERNMENT

11

TARGETED SPEAR-PHISHING EMAIL WAS SENT TO THE SECRETARY GENERAL OF EXECUTIVE YUAN, TAIWAN GOVERNMENT

Page 12: APT Attacks in the Asia Pacific - RSA Conference · #RSAC. AGENDA. 2. Unit 42 Mission Why Asia Pacific is a constant target of APT threat actors 0-days or known exploits Targeted

#RSAC

DECOY USED BY TROPIC TROOPER

12

DECOY USED IN THE ATTACK AGAINST THE SECRETARY GENERAL OF EXECUTIVE YUAN, TAIWAN GOVERNMENT

Page 13: APT Attacks in the Asia Pacific - RSA Conference · #RSAC. AGENDA. 2. Unit 42 Mission Why Asia Pacific is a constant target of APT threat actors 0-days or known exploits Targeted

#RSACTROPIC TROOPER PAYLOAD EXTRACTED AFTER DECRYPTION

13

HIDDEN PAYLOAD EXTRACTED AFTER DECRYPTION

Page 14: APT Attacks in the Asia Pacific - RSA Conference · #RSAC. AGENDA. 2. Unit 42 Mission Why Asia Pacific is a constant target of APT threat actors 0-days or known exploits Targeted

#RSAC

EXPLOIT & MALWARE USED

14

Exploit - CVE-2012-0158 (no surprises)

Malware – Trojan : Poison Ivy

Investigations on related infrastructure provided details of other tools being used by Tropic Trooper

Yahoyah PCshare

Page 15: APT Attacks in the Asia Pacific - RSA Conference · #RSAC. AGENDA. 2. Unit 42 Mission Why Asia Pacific is a constant target of APT threat actors 0-days or known exploits Targeted

#RSAC

15

INFRASTRUCTURE AND ASSOCIATED MALWARE

Page 16: APT Attacks in the Asia Pacific - RSA Conference · #RSAC. AGENDA. 2. Unit 42 Mission Why Asia Pacific is a constant target of APT threat actors 0-days or known exploits Targeted

#RSAC

16

NEW DECOYS USED IN RECENT SAMPLES SUGGEST TARGETS IN VIETNAM

Recent samples show that the targets are in Vietnam too

Payload dropped : PivyShares same mutex

Page 17: APT Attacks in the Asia Pacific - RSA Conference · #RSAC. AGENDA. 2. Unit 42 Mission Why Asia Pacific is a constant target of APT threat actors 0-days or known exploits Targeted

#RSAC

17

Malware ROVER used to Target the Indian AmbassadorTo Afghanistan

Page 18: APT Attacks in the Asia Pacific - RSA Conference · #RSAC. AGENDA. 2. Unit 42 Mission Why Asia Pacific is a constant target of APT threat actors 0-days or known exploits Targeted

#RSAC

SPEAR-PHISHING EMAIL

18

TARGETED SPEAR-PHISHING EMAIL WAS SENT TO THE AMBASSADOR OF INDIA TO AFGHANISTAN

Page 19: APT Attacks in the Asia Pacific - RSA Conference · #RSAC. AGENDA. 2. Unit 42 Mission Why Asia Pacific is a constant target of APT threat actors 0-days or known exploits Targeted

#RSAC

INFECTION FLOW

19

Page 20: APT Attacks in the Asia Pacific - RSA Conference · #RSAC. AGENDA. 2. Unit 42 Mission Why Asia Pacific is a constant target of APT threat actors 0-days or known exploits Targeted

#RSAC

20

BACKDOOR COMMANDS

Page 21: APT Attacks in the Asia Pacific - RSA Conference · #RSAC. AGENDA. 2. Unit 42 Mission Why Asia Pacific is a constant target of APT threat actors 0-days or known exploits Targeted

#RSAC

21

POC on OpenCV library to capture video from webcam

Page 22: APT Attacks in the Asia Pacific - RSA Conference · #RSAC. AGENDA. 2. Unit 42 Mission Why Asia Pacific is a constant target of APT threat actors 0-days or known exploits Targeted

#RSAC

NetTraveler TARGETS DIPLOMAT OF UZBEKISTAN

22

TARGETED SPEAR-PHISHING EMAIL WAS SENT TO A DIPLOMAT OF UZBEKISTAN

Page 23: APT Attacks in the Asia Pacific - RSA Conference · #RSAC. AGENDA. 2. Unit 42 Mission Why Asia Pacific is a constant target of APT threat actors 0-days or known exploits Targeted

#RSAC

NetTraveler Targets diplomat of Uzbekistan

23

Page 24: APT Attacks in the Asia Pacific - RSA Conference · #RSAC. AGENDA. 2. Unit 42 Mission Why Asia Pacific is a constant target of APT threat actors 0-days or known exploits Targeted

#RSAC

Infection Flow

24

DLL SIDE-LOADING TECHNIQUE USED TO DROP THE MAIN NETTRAVELER PAYLOAD

Page 25: APT Attacks in the Asia Pacific - RSA Conference · #RSAC. AGENDA. 2. Unit 42 Mission Why Asia Pacific is a constant target of APT threat actors 0-days or known exploits Targeted

#RSAC

NetTraveler configuration

25

NetTraveler obtaining its configuration from rastls.dll

Page 26: APT Attacks in the Asia Pacific - RSA Conference · #RSAC. AGENDA. 2. Unit 42 Mission Why Asia Pacific is a constant target of APT threat actors 0-days or known exploits Targeted

#RSAC

NetTraveler DLL embedded in sycmentec.config

26

Page 27: APT Attacks in the Asia Pacific - RSA Conference · #RSAC. AGENDA. 2. Unit 42 Mission Why Asia Pacific is a constant target of APT threat actors 0-days or known exploits Targeted

#RSAC

C2 Infrastructure

27

C2 resolves to‘98.126.38[.]107’ whichis hosted by KryptTechnologies.

Page 28: APT Attacks in the Asia Pacific - RSA Conference · #RSAC. AGENDA. 2. Unit 42 Mission Why Asia Pacific is a constant target of APT threat actors 0-days or known exploits Targeted

#RSAC

DLL side loading techniques continues to be used

28

JP CERT report on attacks targeting Japan South Korean media reports on recent attacks

Page 29: APT Attacks in the Asia Pacific - RSA Conference · #RSAC. AGENDA. 2. Unit 42 Mission Why Asia Pacific is a constant target of APT threat actors 0-days or known exploits Targeted

#RSAC

What do we learn from the attacks?

29

Threat actors continue to use old proven exploits – and it works.

Threat actors employ new techniques to by-pass traditional security systems. We need to understand the TTPs to better defend against the threats.

Asia Pacific continues to experience large number of growing targeted cyber attacks.

Many threat actors continue to use same hosting providers for their C2 infrastructure

Page 30: APT Attacks in the Asia Pacific - RSA Conference · #RSAC. AGENDA. 2. Unit 42 Mission Why Asia Pacific is a constant target of APT threat actors 0-days or known exploits Targeted

#RSAC

WAY FORWARD

30

The risk from these attacks can be reduced significantly if systems are patched on a timely basis. PATCH PATCH PATCH!!!

We need to understand the TTPs to better defend against the threats.

Focus on “Preventing” a successful cyber attack.

Education on the modus operandi of the threat actors.

Unit 42 research includes TTPs and IOCs which is accessible to the public. Tools and resources also published in Github.

Page 31: APT Attacks in the Asia Pacific - RSA Conference · #RSAC. AGENDA. 2. Unit 42 Mission Why Asia Pacific is a constant target of APT threat actors 0-days or known exploits Targeted

#RSAC

Questions ?

31

THANK YOU


Related Documents
Tp 224 c - Hendrickson Asia Pacific - Hendrickson Asia Pacific

Tp 224 c - Hendrickson Asia Pacific - Hendrickson Asia...

Category: Documents
ASIA PACIFIC 2011 - ESOMAR · 2017-04-26 · 2 | ASIA PACIFIC 2011 INCREASING VALUE THROUGH SIMPLICITY ASIA PACIFIC 2011 The Asia-Pacific region is far more culturally and socially

ASIA PACIFIC 2011 - ESOMAR · 2017-04-26 · 2 | ASIA...

Category: Documents
APT Programmes and ICT Initiatives in the Asia-Pacific Region Regional Forum of ICT Experts in South East Asia: Meeting the Challenges in Digital Gaps.

APT Programmes and ICT Initiatives in the Asia-Pacific...

Category: Documents
Asia Pacific Youth to Business (Y2B) Forum Proposal [for Asia Pacific]

Asia Pacific Youth to Business (Y2B) Forum Proposal [for...

Category: Documents
Asia Pacific Metrology Programme (APMP) - Asia Pacific ... · 6/1/2017  · Asia Pacific Metrology Programme (APMP) - Asia Pacific Laboratory Accreditation Cooperation (APLAC) Joint

Asia Pacific Metrology Programme (APMP) - Asia Pacific...

Category: Documents
2014 Asia-Pacific cardiovascular symposium Managing ... Asia-Pacific cardiovascular symposium Managing cardiovascular risk ... 2014 Asia-Pacific cardiovascular symposium “Managing

2014 Asia-Pacific cardiovascular symposium Managing ......

Category: Documents
Asia-Pacific Strategy for Emerging Diseases · 2010 AsiA PAcific strAtegy for emerging DiseAses South-East Asia Region Western Pacific Region

Asia-Pacific Strategy for Emerging Diseases · 2010 AsiA...

Category: Documents
Asia-Pacific Telecommunity€¦ · Web viewAlso, according to APT Report on Information of Mobile Operator’s Frequencies, Technologies and License durations in Asia Pacific countries

Asia-Pacific Telecommunity€¦ · Web viewAlso, according....

Category: Documents
by: R. B. KUMARAPATHIRANA Director, Proj. Development Asia-Pacific Telecommunity (APT)

by: R. B. KUMARAPATHIRANA Director, Proj. Development...

Category: Documents
REGION ASIA/PACIFIC - Sika Group · region asia/pacific heinz gisel regional manager asia/pacific sika capital markets day 2016

REGION ASIA/PACIFIC - Sika Group · region asia/pacific...

Category: Documents
APT Programmes and ICT Initiatives in the Asia-Pacific Region

APT Programmes and ICT Initiatives in the Asia-Pacific...

Category: Documents
Asia Pacific Aviation - · PDF fileAsia Pacific Aviation ... • Asia Pacific safety performance in line with world ... • Asia Pacific region the seat of experimentation &

Asia Pacific Aviation - · PDF fileAsia Pacific Aviation...

Category: Documents