APT3

Introduction

APT3 is a China-based threat group that researchers have attributed to China’s Ministry of State Security. FireEye Clandestine Wolf Recorded Future APT3 May 2017 This group is responsible for the campaigns known as Operation Clandestine Fox, Operation Clandestine Wolf, and Operation Double Tap. FireEye Clandestine Wolf FireEye Operation Double Tap As of June 2015, the group appears to have shifted from targeting primarily US victims to primarily political organizations in Hong Kong. Symantec Buckeye

Activities and Tactics

Targeted Sectors: Political party, Private sector

Country of Origin: 🇨🇳 China

Risk Level: High

First Seen: 2015

Last Activity: 2018

Incident Type: Espionage

Suspected Victims: United States, United Kingdom, Hong Kong

Notable Campaigns

• 2007
• 2014 targeting multiple organizations. The attacker leveraged multiple exploits
• 2014-04
• 2014-06
• 2014-11
• 2015-06
• 2016-03
• APT3 actors launched a large-scale phishing campaign against organizations in the following industries: Aerospace and Defense
• Beginning in March 2016
• Buckeye began using a variant of DoublePulsar (Backdoor.Doublepulsar)
• Buckeye cyberespionage group shifts gaze from US to Hong Kong
• Clandestine Fox
• Clandestine Wolf
• Construction and Engineering
• Double Tap
• FireEye Research Labs identified a new Internet Explorer (IE) zero-day exploit used in targeted attacks. The vulnerability affects IE6 through IE11
• High Tech
• Hupigon and Pirpi Backdoors
• In the last several weeks
• Operation “Clandestine Fox”
• Operation “Clandestine Wolf”
• Operation “Double Tap”
• Part Deux
• Telecommunications and Transportation.
• This actor initiated their most recent campaign on November 19
• Variant of the DoublePulsar Backdoor
• While Microsoft quickly released a patch to help close the door on future compromises
• a backdoor that was subsequently released by the Shadow Brokers in 2017. DoublePulsar was delivered to victims using a custom exploit tool (Trojan.Bemstour) that was specifically designed to install DoublePulsar.
• but the attack is targeting IE9 through IE11. This zero-day bypasses both ASLR and DEP. Microsoft has assigned CVE-2014-1776 to the vulnerability and released security advisory to track this issue.
• https://research.checkpoint.com/upsynergy/
• https://www.fireeye.com/blog/threat-research/2010/11/ie-0-day-hupigon-joins-the-party.html
• https://www.fireeye.com/blog/threat-research/2014/04/new-zero-day-exploit-targeting-internet-explorer-versions-9-through-11-identified-in-targeted-attacks.html
• https://www.fireeye.com/blog/threat-research/2014/06/clandestine-fox-part-deux.html
• https://www.fireeye.com/blog/threat-research/2014/11/operation_doubletap.html
• https://www.fireeye.com/blog/threat-research/2015/06/operation-clandestine-wolf-adobe-flash-zero-day.html
• https://www.symantec.com/blogs/threat-intelligence/buckeye-windows-zero-day-exploit
• https://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong
• targeting both CVE-2014-6332 and CVE-2014-4113.
• we have now observed the threat actors behind “Operation Clandestine Fox” shifting their point of attack and using a new vector to target their victims: social networking.

Tactics, Techniques, and Procedures (TTPs)

• T1053.005 Scheduled Task
• T1104 Multi-Stage Channels
• T1110.002 Password Cracking
• T1564.003 Hidden Window
• T1555.003 Credentials from Web Browsers
• T1059.003 Windows Command Shell
• T1016 System Network Configuration Discovery
• T1049 System Network Connections Discovery
• T1090.002 External Proxy
• T1218.011 Rundll32
• T1027 Obfuscated Files or Information
• T1566.002 Spearphishing Link
• T1098.007 Additional Local or Domain Groups
• T1204.001 Malicious Link
• T1041 Exfiltration Over C2 Channel
• T1552.001 Credentials In Files
• T1074.001 Local Data Staging
• T1078.002 Domain Accounts
• T1005 Data from Local System
• T1203 Exploitation for Client Execution
• T1021.002 SMB/Windows Admin Shares
• T1574.001 DLL
• T1087.001 Local Account
• T1070.004 File Deletion
• T1083 File and Directory Discovery
• T1546.008 Accessibility Features
• T1560.001 Archive via Utility
• T1082 System Information Discovery
• T1059.001 PowerShell
• T1543.003 Windows Service
• T1003.001 LSASS Memory
• T1547.001 Registry Run Keys / Startup Folder
• T1021.001 Remote Desktop Protocol
• T1057 Process Discovery
• T1095 Non-Application Layer Protocol
• T1069 Permission Groups Discovery
• T1018 Remote System Discovery
• T1056.001 Keylogging
• T1036.010 Masquerade Account Name
• T1027.002 Software Packing
• T1136.001 Local Account
• T1105 Ingress Tool Transfer
• T1033 System Owner/User Discovery
• T1027.005 Indicator Removal from Tools

ATT&CK technique IDs (denormalized)

• T1003.001
• T1005
• T1016
• T1018
• T1021.001
• T1021.002
• T1027
• T1027.002
• T1027.005
• T1033
• T1036.010
• T1041
• T1049
• T1053.005
• T1056.001
• T1057
• T1059.001
• T1059.003
• T1069
• T1070.004
• T1074.001
• T1078.002
• T1082
• T1083
• T1087.001
• T1090.002
• T1095
• T1098.007
• T1104
• T1105
• T1110.002
• T1136.001
• T1203
• T1204.001
• T1218.011
• T1543.003
• T1546.008
• T1547.001
• T1552.001
• T1555.003
• T1560.001
• T1564.003
• T1566.002
• T1574.001

Notable Indicators of Compromise (IOCs)

No atomic indicators are listed in this profile. The APTnotes snapshot indexes 5 public reports that may contain IOCs; see Source Attribution for dataset links.

Malware and Tools

• CyberGate
• Cyber Eye RAT
• Shotput:
• Pirpi:
• PlugX/Sogu:
• Kaba:
• Cookie Cutter:
• many 0days: IE:
• Firefox:
• and Flash:
• SportLoader:
• Shadow Brokers exploits:
• DoublePulsar:
• Bemstour:
• Filensfer:
• APT3 Keylogger:
• EternalBlue:
• Firefox and Flash:
• HTran:
• Hupigon:
• LaZagne:
• OSInfo:
• PlugX:
• RemoteCMD:
• TTCalc:
• several 0-days for IE:
• shareip:
• w32times:

MITRE ATT&CK Software

• OSInfo (S0165) — malware
• schtasks (S0111) — tool
• PlugX (S0013) — malware
• LaZagne (S0349) — tool
• SHOTPUT (S0063) — malware
• RemoteCMD (S0166) — malware

Attribution and Evidence

Country of Origin: China Additional attribution information pending cataloguing.

References

[1] mitre-attack [9] FireEye Clandestine Wolf Eng, E., Caselden, D.. (2015, June 23). Operation Clandestine Wolf – Adobe Flash Zero-Day in APT3 Phishing Campaign. Retrieved January 14, 2016. [10] Recorded Future APT3 May 2017 Insikt Group (Recorded Future). (2017, May 17). Recorded Future Research Concludes Chinese Ministry of State Security Behind APT3. Retrieved September 16, 2024. [11] PWC Pirpi Scanbox Lancaster, T. (2015, July 25). A tale of Pirpi, Scanbox & CVE-2015-3113. Retrieved March 30, 2016. [12] FireEye Operation Double Tap Moran, N., et al. (2014, November 21). Operation Double Tap. Retrieved January 14, 2016. [13] Symantec Buckeye Symantec Security Response. (2016, September 6). Buckeye cyberespionage group shifts gaze from US to Hong Kong. Retrieved September 26, 2016.