APT12

🔴 High
Also known as: APT 12, APT12, BRONZE GLOBE, BeeBus, Bronze Globe, CTG-8223, Calc Team, Crimson Iron, DNS-Calc, DNSCALC, DNSCalc, DynCALC, DynCalc, G0005, Group 22, Group22, HORDE, HYDROGEN, Hexagon Typhoon, IXESHE, NUMBERED PANDA, Numbered Panda, Red Anubis, TG-2754, TG-2754 (tentative)

APT12 is a threat group that has been attributed to China. The group has targeted a variety of victims including but not limited to media outlets, high-tech companies, and multiple governments. Meyers Numbered Panda

🌍 Country China
📅 Activity 2012 — 2016
⚡ Risk Level High
🎯 Incident Type Espionage
🧭 ATT&CK G0005
Private sector Government
2012
2016

Targeted Victims

Taiwan Japan

Associated Operations

2009-07 2011 2011-05 2012-10 2014-08 2016-01 2016-11 Breach of The New York Times Chinese hackers have persistently attacked The New York Times Etumbot uses a right-to-left override exploit to trick the victim to download the malware installer. According to Arbor Security IXESHE Derivative IHEATE Targets Users in America NYT Oct 2012 On November 7 Once the malicious file was downloaded and extracted by the victim Spear-phishing on Taiwanese Government Taiwanese electronics manufacturers and a telecommunications company. Target: East Asian governments Target: Taiwan The attack occurred after the New York Times published a story about how the relatives of Wen Jiabao Uses an updated version of ETUMBOT. for example.” http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp_ixeshe.pdf https://blog.trendmicro.com/trendlabs-security-intelligence/ixeshe-derivative-iheate-targets-users-america/ https://www.arbornetworks.com/blog/asert/wp-content/uploads/2014/06/ASERT-Threat-Intelligence-Brief-2014-07-Illuminating-Etumbot-APT.pdf https://www.fireeye.com/blog/threat-research/2013/08/survival-of-the-fittest-new-york-times-attackers-evolve-quickly.html https://www.nytimes.com/2013/01/31/technology/chinese-hackers-infiltrate-new-york-times-computers.html?pagewanted=all https://www.zscaler.com/blogs/research/cnacom-open-source-exploitation-strategic-web-compromise infiltrating its computer systems and getting passwords for its reporters and other employees.” so that a .scr binary file appears to be a .xls document the sixth Premier of the State Council of the People’s Republic of China the “technique is a simple way for malware writers to disguise names of malicious files. A hidden Unicode character in the filename will reverse the order of the characters that follow it we spotted a malicious injection on the registration page of a major Taiwanese public service website. An iframe was injected into the footer of the page which then loaded a unique landing page containing the CVE-2016-0189 exploit code. “AUMLIB” campaign “CNACOM” campaign “ETUMBOT” campaign “For the last four months “HIGHTIDE” campaign “IXESHE” campaign “RIPTIDE” campaign “THREEBYTE” campaign “WATERSPOUT” campaign “accumulated a fortune worth several billion dollars through business dealings.” The computers used to launch the attack are believed to be the same university computers used by the Chinese military to attack United States military contractors.

Introduction

APT12 is a threat group that has been attributed to China. The group has targeted a variety of victims including but not limited to media outlets, high-tech companies, and multiple governments. Meyers Numbered Panda

Activities and Tactics

Targeted Sectors: Private sector, Government

Country of Origin: 🇨🇳 China

Risk Level: High

First Seen: 2012

Last Activity: 2016

Incident Type: Espionage

Suspected Victims: Taiwan, Japan

Notable Campaigns

  • 2009-07
  • 2011
  • 2011-05
  • 2012-10
  • 2014-08
  • 2016-01
  • 2016-11
  • Breach of The New York Times
  • Chinese hackers have persistently attacked The New York Times
  • Etumbot uses a right-to-left override exploit to trick the victim to download the malware installer. According to Arbor Security
  • IXESHE Derivative IHEATE Targets Users in America
  • NYT Oct 2012
  • On November 7
  • Once the malicious file was downloaded and extracted by the victim
  • Spear-phishing on Taiwanese Government
  • Taiwanese electronics manufacturers and a telecommunications company.
  • Target: East Asian governments
  • Target: Taiwan
  • The attack occurred after the New York Times published a story about how the relatives of Wen Jiabao
  • Uses an updated version of ETUMBOT.
  • for example.”
  • http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp_ixeshe.pdf
  • https://blog.trendmicro.com/trendlabs-security-intelligence/ixeshe-derivative-iheate-targets-users-america/
  • https://www.arbornetworks.com/blog/asert/wp-content/uploads/2014/06/ASERT-Threat-Intelligence-Brief-2014-07-Illuminating-Etumbot-APT.pdf
  • https://www.fireeye.com/blog/threat-research/2013/08/survival-of-the-fittest-new-york-times-attackers-evolve-quickly.html
  • https://www.nytimes.com/2013/01/31/technology/chinese-hackers-infiltrate-new-york-times-computers.html?pagewanted=all
  • https://www.zscaler.com/blogs/research/cnacom-open-source-exploitation-strategic-web-compromise
  • infiltrating its computer systems and getting passwords for its reporters and other employees.”
  • so that a .scr binary file appears to be a .xls document
  • the sixth Premier of the State Council of the People’s Republic of China
  • the “technique is a simple way for malware writers to disguise names of malicious files. A hidden Unicode character in the filename will reverse the order of the characters that follow it
  • we spotted a malicious injection on the registration page of a major Taiwanese public service website. An iframe was injected into the footer of the page
  • which then loaded a unique landing page containing the CVE-2016-0189 exploit code.
  • “AUMLIB” campaign
  • “CNACOM” campaign
  • “ETUMBOT” campaign
  • “For the last four months
  • “HIGHTIDE” campaign
  • “IXESHE” campaign
  • “RIPTIDE” campaign
  • “THREEBYTE” campaign
  • “WATERSPOUT” campaign
  • “accumulated a fortune worth several billion dollars through business dealings.” The computers used to launch the attack are believed to be the same university computers used by the Chinese military to attack United States military contractors.

Tactics, Techniques, and Procedures (TTPs)

ATT&CK technique IDs (denormalized)

Notable Indicators of Compromise (IOCs)

No atomic indicators are listed in this profile. The APTnotes snapshot indexes 4 public reports that may contain IOCs; see Source Attribution for dataset links.

Malware and Tools

  • China Chopper
  • Etumbot:
  • Riptide:
  • Hightide:
  • ThreeByte:
  • Waterspout:
  • Mswab:
  • Gh0st:
  • ShowNews:
  • 3001:
  • AUMLIB:
  • IHEATE:
  • IXESHE:
  • RapidStealer:

MITRE ATT&CK Software

Attribution and Evidence

Country of Origin: China Additional attribution information pending cataloguing.

References

[1] mitre-attack [7] Meyers Numbered Panda Meyers, A. (2013, March 29). Whois Numbered Panda. Retrieved January 14, 2016. [8] Moran 2014 Moran, N., Oppenheim, M., Engle, S., & Wartell, R.. (2014, September 3). Darwin’s Favorite APT Group [Blog]. Retrieved November 12, 2014.