Japan Security Analyst Conference 2021
(Opening Talk)

Looking back on theincidents in 2020
JPCERT Coordination Center
Incident Response Group
January 28th, 2021
Takayoshi SHIIGI

Two Major Attack Types

Targeted Widespread(Attack aimed to steal
confidential
information)

1

Copyright ©2021 JPCERT/CC All rights reserved.

(Attack aimed tosteal money)

Combining an Attack Type with the Tactics of the Other

Targeted
AttackWidespread

Attack2

Copyright ©2021 JPCERT/CC All rights reserved.

Tactics ofWidespread
AttackTactics ofTargeted
AttackTargeted Attack

3

Copyright ©2021 JPCERT/CC All rights reserved.

Targeted Attack Campaigns (confirmed by JPCERT/CC)

4

Copyright ©2021 JPCERT/CC All rights reserved.

Trends in Recent Targeted Attack
Leverage CloudServices•Initial attack vector (SNS services)•Attack infrastructure(Microsoft Azure, Google Cloud etc.)•Main attack target (Office365 etc.)•Part of multi-layer attack (Pasetbin etc.)

5

Copyright ©2021 JPCERT/CC All rights reserved.

Complex Malware•Fileless•Modular architecture•Functions in multiple stages of attacks•Obfuscation and anti-analysis function

UsingSpecific/UniqueMalware•New malware•Targeting servers(Extended for ELF binary)•Used in combination with generic tools(Open source, legitimate tools, OScommands)

LODEINFO

6

Copyright ©2021 JPCERT/CC All rights reserved.

Version History7

2019/122020/04

2020/05

2020/06

v0.1.2v0.3.2v0.3.5v0.3.82020/04

2020/05

2020/05

2020/12v0.2.7v0.3.4v0.3.6v0.4.6

Copyright ©2021 JPCERT/CC All rights reserved.

Change in Launch Method
Via Rundll32(〜v0.2.7)

1. Create

2. Execute

3. Loadrundll32.exe
8

LODEINFO

Copyright ©2021 JPCERT/CC All rights reserved.

DLL side loading(v0.3.2〜)

2. Create&Execute

1. Create

3. Load

Legitimate file

LODEINFO

Changes in commands
v0.1.2
•cd
•ls
•send
•recv
•cat
•memory•kill•ver•commandv0.2.7
•cd
•ls
•send
•recv
•cat
•memory•kill•ver•commandv0.3.2v0.3.4v0.3.5v0.3.6v0.3.8v0.4.6

•cd
•ls
•send
•recv
•cat
•memory•kill•ver•command

•cd
•ls
•send
•recv
•cat
•memory•kill•ver•command

•cd
•ls
•send
•recv
•cat
•memory•kill•ver•command

•cd
•ls
•send
•recv
•cat
•memory•kill•ver•command

•cd
•ls
•send
•recv
•cat
•memory•kill•ver•command

•cd
•ls
•send
•recv
•cat
•memory•kill•ver•command•print•print•print•rm•(ransom)•(keylog)•print•rm•(ransom)•(keylog)•print•rm•ransom•(keylog)•print•rm•ransom•keylog•mv•cp•mkdir•ps•pkill( ): The commands in brackets have not been implemented but just added
9

Copyright ©2021 JPCERT/CC All rights reserved.

Lazarus

10

Copyright ©2021 JPCERT/CC All rights reserved.

Malware Examples used by Lazarus
Malware used after networkintrusion

11Copyright ©2021 JPCERT/CC All rights reserved.

BLINDINGCAN

C2 Communication (HTTPS)
Malware used after network intrusion
POST /[Path] HTTP/1.1
Cache-Control: no-cacheConnection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Accept: */*Cookie: token=[random 4-digit numeric][4-digit authentication key][number of communications]User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77
Safari/537.36
Content-Length: [Size]
Host:[Server][param]=[Base64 data]

BLINDINGCAN
POST /[PATH] HTTP/1.1
Connection: Keep-Alive
Cache-Control: no-cacheContent-Type: application/x-www-form-urlencoded
Accept: */*User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) Chrome/28.0.1500.95 Safari/537.36
Host: [Server]Content-Length: [Length]
id=d3Ztd3lod2t0Tqf42ux9uv3FGH+Y3oAc2w==&bbs=HA==&tbl=hzE4dlKcRq3gokgAGeMQug== &bbs_form=4GQAAA==
12Copyright ©2021 JPCERT/CC All rights reserved.

Widespread Attack

13

Copyright ©2021 JPCERT/CC All rights reserved.

Attack Exploiting
Vulnerabilities in SSL
VPN Products
14

Copyright ©2021 JPCERT/CC All rights reserved.

Publications

15

Copyright ©2021 JPCERT/CC All rights reserved.

Incident Cases confirmed by JPCERT/CC
Exploited vulnerability
in Citrix products

Installmalicious file• Script• WebShell• ELF binary

Ransomware
incident

Lateralmovement,
AD related
activity

Targeted
attackincident•PsExec•Mimikatz•Stealing AD info

Exploited vulnerability
in Pulse Connect Secure products
16Copyright ©2021 JPCERT/CC All rights reserved.

Emotet17

Copyright ©2021 JPCERT/CC All rights reserved.

Infected E-mail addresses in Japan
12000
10000

11014

addressdomain

8000
6000
3859

4000

2000
01656 1909
1029
757
909
430
298 207 0 0204 1201731
0 00 00 04574

1758
882

Number of “.jp” E-mail addresses used to send Emotet
18

Copyright ©2021 JPCERT/CC All rights reserved.

3648
1715

0 0871 464

Publications

19

Copyright ©2021 JPCERT/CC All rights reserved.

Infection Flow
Execute macroWMIE-mailAttacheddoc fileDownloadEmotet
Example of malware
used for 2nd stage
infection- Zloader
Malwarefornd- Trickbot
2 stage infection- Qakbot- IcedID
20

Copyright ©2021 JPCERT/CC All rights reserved.

PowerShell
AccessDefaced sites

C2 servers

EmoCheck

v0.0.1(2020/02/03)

21•InitialRelease•Detects
Emotet in
Nov 2019and later

v0.0.2(2020/02/10)

Supports
code singing

Copyright ©2021 JPCERT/CC All rights reserved.

v1.0.0(2020/08/11)•Detects
Emotet in
Jul 2020 andlater•Binarydistribution

v2.0.0(JustReleased!)

Detects
Emotet in
Dec 2020 andlaterAnalysis Tool

22

Copyright ©2021 JPCERT/CC All rights reserved.

Published Training Contents

https://jpcertcc.github.io/log-analysis-training/
23

Copyright ©2021 JPCERT/CC All rights reserved.

Updates to Existing Tools

github.com/JPCERTCC/MalConfScan

github.com/JPCERTCC/LogonTracer□Linux memory scan function□Support malware families□Realtime AD log analysis function(Total: 28)
24

Copyright ©2021 JPCERT/CC All rights reserved.

Remote Analysis Environment

MalwareResources

InternetLocal analysis
environment
25

Copyright ©2021 JPCERT/CC All rights reserved.

Tools
RemoteDataanalysis environment

How to Enjoy

26

Copyright ©2021 JPCERT/CC All rights reserved.

Presentation
TopicA

NanoCoreHunter: Track NanoCore C&C Serverand Monitor RAT Operator for 180 DaysA

LuoYu, the eavesdropper sneaking in multiple
platforms

A/C

A41APT case ~Analysis of the Stealth APTCampaign Threatening Japan

A/D

When you gaze into the Bottle,...

A/DB

27

Title

Knock, knock, Neo. - Active C2 Discovery Using
Protocol Emulation
Accelerating the Analysis of Offensive Security
Techniques Using DetectionLabCopyright ©2021 JPCERT/CC All rights reserved.

TopicTitle

C

A Picture of Business Email Compromise
Triggered by A Security Breach at BusinessPartners

D/A

What was Discovered through Emotet Campaign
Observation in Japan

DGrasping a Big Picture of Shathak AttackCampaign

D

Threat Hunting of Attack Campaign Targeting
Cryptocurrency Service Providers

D

GhostDNSbusters: Tracking and Responding to a
Large Scale DNS Hijacking Campaign[A] Malware[B] Forensics[C] Incident[D] Threat trends, intelligence

Workshop
分類

タイトル

W[A]

Malware Analysis at Scale ~Defeating EMOTET by Ghidra

W[C]Shuffle the SOC - automating anything, anytime, anywhere[A] Malware[C] Incident

28

Copyright ©2021 JPCERT/CC All rights reserved.

NetworkingPowered by29

Copyright ©2021 JPCERT/CC All rights reserved.

Follow-up Event
Title: After JSAC2021
Delivery: YouTube live stream(tentative)
Date & Time: 2/19(Fri.)
16:00 - 17:00
Contents(tentative):
1. Best speaker award
2. Looking back on JSAC 2021
3. Messages for those interested inapplying for JSAC 2022
30

Copyright ©2021 JPCERT/CC All rights reserved.

？

Thank you!
31

Copyright ©2021 JPCERT/CC All rights reserved.