Behind the Scenes of APTs: 2014 Advanced Threats Trend

Advanced Persistent Threats (APTs) are no longer a new type of threat. They have leaped onto the main stage of global security. The attackers or attack groups gather information from the target and penetrate the target system to install their malware to then steal confidential information or destroy the system. AhnLab had forecast the intensification of APTs in its report ‘2014 Security Predictions’ by mentioning evolving attack methods, large scale APT incidents and simultaneous damages, APT incidents by international attack groups, and attacks against specific and random targets.

Recently, there has been a remarkable trend in which attackers find and exploit the vulnerabilities in the specific applications mainly used by targets. Also, stolen information by APT attacks has resulted in some financial incidents in South Korea.

The key characteristics of the latest APT attacks are as follows:
• Network penetration via applications’ update server or thir​​d-party products
• Penetration using ​​spear-phishing or watering-hole techniques
• Advanced bypass and deactivation techniques to increase malware infection and its incubation period​​
• Attacks by international cyber industrial spy groups
• Multilingual manpower pool of attacker groups

In this article, you will find the 2014 APTs trend including attack vectors and techniques based on actual APT incidents.

APT Scene #1: Attack Method​​
1. Spear Phishing​​​​
The term ‘Spear Phishing’ was literally coined from the actual spearfishing method that targets its prey—Phishing is a cyber attack tactic that lures victims with rogue emails or documents. Spear Phishing is not a massive attack but a targeted cyber scam or ‘targeted malicious email’ to lure users into malicious websites or to infect PCs via malicious attached files in order to access unauthorized systems and sensitive data. Technically, sending emails with malicious attached files disguised as messages with interesting content is by now a common and much-recognized method. Never​​theless, it remains stubbornly effective. That is why security experts point out that the biggest security vulnerability is people themselves.

Table 1. Vulnerabilities exploited to distribute malware via email attachments

2. Watering Hole
‘Watering Hole’ can be referred to as a ‘target attack’; the term refer to the hunting strategy of lions that lie in wait to ambush their prey near a watering hole where they are drawn to drink. In cyber space, the attackers probe the victims’ favorite websites before injecting malware into them via zero-day vulnerabilities. Thus, victims are infected once they visit their favorite websites.  

Table 2. Vulnerabilities exploited to distribute malware via websites

The website vulnerabilities and major Web Exploit Kits are listed below: 

Recently, attackers exploit not only common applications, but also particular applications used only by specific corporations. In order to infect all the systems in the corporate network, attackers also exploit the flaws in integrity check procedures and update systems of applications. In other words, attackers compromise the update files of normal systems or applications to avoid detection or suspicion and successfully infect the systems from inside.

APT Scene #2: Lateral Movement
Attackers who succeed in breaking into the corporate network attempt to expand their influence across the system. This is called lateral movement. For lateral movement, attackers need to obtain the credentials of an administrator account with high privileges – e.g., Administrator ID, password, NTLM hash, etc. These credentials can be retrieved from the system registry and memory. In order to obtain those credentials, attackers use attack tools such as gsecdump, Windows Credential Editor (WCE) and mimikatz. Also, attackers insert the DLLs into malware, such as wceaux.dll and sekuralsa.dll, and call them when launching attacks. Or, the attackers use steal IDs and passwords via a keylogger function of “backdoor.”
​

Figure 1.Obtain the domain administrator’s NTLM hash through WCE

The attackers can succeed in expanding their influence across the target corporate systems because most companies use the same local administrator ID and password in all their corporate systems for convenience’ sake. In Active Directory system, the administrator’s ID, password, and hash value are stored in the memory when logging in to multiple systems with a domain administrator account.

After obtaining the administrator’s account information, the attacker installs a backdoor to access the system using the account. If the attacker obtains a domain administrator ID and password, the attacker can install a backdoor not only on all the systems within the domain, but also the systems in all the other trusted domains as well.

The process of backdoor installation is as follows:
First, the attacker uses the account information to log in to the system and share the network, and then copies the backdoor. Then the attacker registers a remote service or task scheduler and executes the copied backdoor with system privileges. The backdoor performs relay connection with a Command and Control (C&C) server using a proxy for the attackers to access the system.

The attacker repeats this process until he/she finds the target system or DB. Usually, the attacker just finds the administrator’s system in the corporate network to access the gateway server and infiltrate into the server network bandwidth. In this way, the attacker installs a backdoor on the servers located in the server network bandwidth.

Figure 2. Lateral movement by attackers 

​

APT Scene #3: Invasion of the Retail Industry
On January 17, 2014, the FBI Cyber Division issued a report titled, “Recent Cyber Intrusion Events Directed toward Retail Firms.” In this report, FBI warned retailers of the risk of malware that could infect Point of Sales (POS) systems. FBI also claimed that this type of cyber crime targeting POS systems would continue to increase despite law enforcement agencies and security firms’ efforts to enhance relevant measures, and pointed out the causes for the increase of these cyber crimes: cyber black markets where it is easy to buy POS malware and the huge circulation of money of retail firms through POS systems.

There have been multiple recent incidents of POS malware targeting major retail firms in the US:
• Neiman Marcus Group: information from 1,100,000 credit cards stolen
• Target: information from 40,000,000 credit cards stolen
• Home Depot: information from 56,000,000 credit cards stolen

Since 2009 with Tracker, various POS malware have been found in 2013. Also, in the beginning of 2014, it was discovered that a malware called “Ompos” was used in an attack in South Korea.

Figure. 3. POS system malware found from 2009 to 2014

APT Scene #4: Persistent Threats
■ Kimsuky
The same type of malware that was used in ‘Kimsuky Operation’ in 2013 with possible links to the North Korean government was found again on February 25 and March 19, 2014. Like the previous attack, the initial malware infection was caused by a vulnerable HWP file, which is a file format for Hangul Word Processor, a widely used word processing program in South Korea. For more details about the Kimsuky malware, you can refer to ASEC’s (AhnLab Security E-response Center) Blog.
​

Figure 4. Kimsuky malware’s Team Viewer module in 2013 and 2014

■ CyberGate RAT
On March 2014, CyberGate RAT malware infection was reported again in South Korea. Unlike the previous case in which the CyberGate RAT malware exploited vulnerability in a specific program - a Hangul spreadsheet program - in June 2013, in this recent case, CyberGate RAT malware was distributed via adware disguised as various normal files to install itself. However, it was not a target attack against a specific organization or company but a random attack against unspecified individuals. It is assumed that the attacker was looking for new targets among a large number of infected systems.

 
​
Figure 5. CyberGate RAT remote control module

■ Gh0st
Recently, a Gh0st remote control module that launches DDoS attacks was distributed along with banking malware that alters the hosts file in the victim’s system (refer to ASEC Blog). It can be assumed that the recently discovered Gh0st malware was meant to build a botnet to launch further attacks in addition to stealing financial information. Since more and more malware previously used in APTs continue to be used against unspecified individuals rather than specific targets, it is necessary for individual users to be more cautious when using the internet.   

Figure 6. Remote control module of Gh0st 3.75 version

APT Scene #5: Cyber Security Coalition
These are the key features of the latest worldwide APT incidents:
1. International cybercriminal or industry spy groups
2. Cyber espionage between countries
3. Target attacks against specific government institutions, defense industries, research institutions, communication companies, and energy companies
4. Cyber espionage based on highly trained hacking groups and development of attack tools
5. Advanced stealth feature using spear phishing, watering hole, rootkit and bootkit, and sophisticated attack skills against multiple OSs including Windows, Mac, UNIX and Linux
6. Advanced tactics to evade tracing C&C server: locating C&C server in the victim’s local network or controlling malware via a proxy instead of direct connection
7. Persistently passing over the target network, and finally dominating the network and stealing confidential information

The cybercriminals we face are no longer mere petty thieves. Now, cybercrimes are directly linked to not just personal and corporate security, but also to national security. With cybercriminal groups growing on an international scale, we must deal with these sophisticated APT attacks through close security collaboration.

Regarding security collaboration, an exemplary ‘cyber security coalition’ has recently been reported. Called Operation SMN, multiple security vendors have become involved in removing malware installed by Axiom, a Chinese cyber espionage group, from over 43,000 separate PCs around the world. Axiom has been listed as a state-sponsored Chinese hacking group and is also assumed to have attacked law enforcement and other government agencies, journalists, telecommunications and energy firms, and human rights and pro-democracy groups in the US and other countries. Also, there are indications that Axiom might be behind the high-profile Operation Aurora attack on Google in 2010 and the VOHO campaign in 2012.

Operation SMN, a cross-vendor collaboration under Microsoft’s new Coordinated Malware Eradication (CME) program, has seen significant amount of intelligence being shared among vendors, resulting in the creation of comprehensive, multi-vendor protection.

 Figure 7. CME Concept (*Source: Microsoft’s Malware Protection Center)

APT Scene #6: A Never-ending War
APT attacks have become more organized, sophisticated, persistent and at times, international in scope. What is needed and what can be done against these ever-evolving attacks? Will the “APT protection solution” prevent APTs? No, it will not.

Individual solutions are no longer effective in responding to sophisticated and evolving threats. Besides, corporate business environments continue to grow and develop as intricately as IT technologies. Therefore, we must prioritize security issues based on an understanding of respective industrial nature of businesses and then adopt security technologies and solutions for practical and effective security.

AhnLab MDS (Malware Defense System) is an exclusive APT protection solution that implements Dynamic Content Analysis and Anti-Exploit technology to prevent exploits via vulnerabilities of various types of document files and to detect malware that bypasses virtual environments. AhnLab also provides security intelligence optimized for each industrial sector based on accumulated data and information on security threats and responses experienced by its customers. By interacting with customers, AhnLab collects and analyzes threats in real-time and then delivers security “contents,” meaningful and useful information, to the customers. AhnLab also applies these security contents as solutions at every point to deliver a practical response. Moreover, we offer a more effective and advanced response model against ever-evolving threats while encouraging close cooperation between the corporate’ business and security departments.

<References>
● Recent Cyber Intrusion Events Directed toward Retail Firms
● http://www.securelist.com/en/downloads/vlpdfs/unveilingthemask_v1.0.pdf
● http://www.welivesecurity.com/wp-content/uploads/2014/03/operation_windigo.pdf
● http://cdn0.vox-cdn.com/assets/4589853/crowdstrike-intelligence-report-putter-panda.original.pdf
● http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/Dragonfly_Threat_Against_Western_Energy_Suppliers.pdf
● http://www.isightpartners.com/2014/10/cve-2014-4114/
● http://www.microsoft.com/security/Portal/mmpc/cme/malware_eradication.aspx
● http://www.novetta.com/files/9714/1446/8199/Executive_Summary-Final_1.pdf