NSPX30
A sophisticated AitM-enabled implantevolving since 2005

Facundo Munoz
Malware Researcher

Facundo Munoz• Malware Researcher at ESET since 2021
• Hunting and analysing APT malware

facundo.munoz@eset.com

AgendaDiscovery of the NSPX30 implant
Our research, evolution of NSPX30 and attribution to Blackwood APT
Case study of an initial access via AitM
The NSPX30 implant and its features
The China-aligned AitM clubConclusion

In the beginning there were… many detections

Threatmagnet
comx3.dll• Evasive Panda• LuoYu• LittleBear

msnsp.dll

comx3.dll

NSPX30 implant components

The NSPX30 implant
drops

executesloads

RsStub.exe

Dropperloads

comx3.dll

comx3.dll.txt

index.dat

establishes
persistence

Embedded plugins
drops

loads

executes

Legitimate
processloads

msnsp.dll

download
and loadloads

mshlp.dll

WIN.cfg

msfmtkl.dat
downloads
loads

Plugins

Malware paleontology

Timeline of NSPX30 and its ancestors

First and last known sample of NSPX30First and last known sample of DCM (aka Dark Specter)

First and last known sample of Project Wood

20052008NSPX30 detected in ESET
telemetry2013 20142018 2019 20202022 2023 2024

Compilation timestamps, to trust or not to trust

Project Wood backdoor
MainFuncOften.dll

Compiled on
2005-01-09 08:21:22

Project Wood dropper
Unknown file name Compiled on
2005-01-09 08:21:39

Compilation timestamps, to trust or not to trust

Project Wood backdoor
MainFuncOften.dll

Compiled on
2005-01-09 08:21:22
17 seconds difference!

Project Wood dropper
Unknown file name Compiled on
2005-01-09 08:21:39

UPX version
Dropper

000003D0000003E0000003F000000400
00000410
00000420
0000043000 00 00 00 00 00 00 00 00 00 00 31 2E 32 34 00
55 50 58 21 0C 09 05 09 C6 BF B8 96 B6 DB 30 81
E7 39 04 00 0D 48 01 00 00 20 04 00 26 0A 00 29
7F FF FF FF 51 53 55 56 8B 35 1C C0 40 00 8D 44
24 0C 57 50 68 06 00 02 00 BD B4 E0 1F 6A 00 55
68 ED B7 ED 7F 15 00 80 FF D6 8B 3D 20 3E 68 AC
28 FF 74 24 14 FF D7 0A 10 91 B7 B5 ED 8B 1D 24

UPX 1.24 wasreleased in 2003...........1.24.
UPX!....¿¸–¶Û0..
ç9...H......&..).ÿÿÿQSUV‹5.À@..D$.WPh....½´à.j.Uhí·í...€ÿÖ‹=.>h¬(ÿt$.ÿ×..‘·µí‹.$Rich header metadata

Visual Studio 6.0 was released in 1998
Assessment: high confidence that is unlikely that attackers modified all these indicators.

Project Wood aka PeerWoodCOften
Dropper

00000000
00000010
00000020
00000030
00000040
00000050
00000060

00 00 00 00 00 00 00 00 00 00 00 00 00 00 0E 00
50 00 65 00 65 00 72 00 57 00 6F 00 6F 00 64 00
43 00 4F 00 66 00 74 00 65 00 6E 00 00 00 00 000C 00 48 00 65 00 6C 00 6C 00 6F 00 20 00 57 00
6F 00 72 00 6C 00 64 00 21 00 00 00 00 00 0E 00
50 00 45 00 45 00 52 00 57 00 4F 00 4F 00 44 00
43 00 4F 00 46 00 54 00 45 00 4E 00 00 00 00 00................
P.e.e.r.W.o.o.d.
C.O.f.t.e.n.....
..H.e.l.l.o...W.
o.r.l.d.!.......
P.E.E.R.W.O.O.D.
C.O.F.T.E.N.....

PeerYou RAT

Open sourced in 2001

Possibly of Chinese origin

Still around in Chinese websites

Many variants

Timeline of publications about NSPX30’s ancestors

Timeline of publications about NSPX30’s ancestors
First and last known sample of NSPX30First and last known sample of DCM(aka Dark Specter)
First and last known sample of Project Wood

NSPX30 detected in ESET
telemetry

2011
2005

2008

2016
2013

First public report on
Project Wood byFrankie Li

2018 2019 20202022 2023 2024

Timeline of publications about NSPX30’s ancestors
First and last known sample of NSPX30First and last known sample of DCM(aka Dark Specter)
First and last known sample of Project Wood

NSPX30 detected in ESET
telemetry2014

2011 2012
2005

2008

2013

First public report on
Project Wood byFrankie Li
First publicreport on DCMby Jianming

20162018 2019 20202022 2023 2024

Timeline of publications about NSPX30’s ancestors
First and last known sample of NSPX30First and last known sample of DCM(aka Dark Specter)
First and last known sample of Project Wood

NSPX30 detected in ESETtelemetry

2014

2011 2012
20052008

2013
G DATA publishes
report about
Operation TooHash
First public report onProject Wood byFrankie Li
First public
report on DCM
by Jianming

20162018 2019 20202022 2023 2024

Timeline of publications about NSPX30’s ancestors
First and last known sample of NSPX30First and last known sample of DCM(aka Dark Specter)
First and last known sample of Project Wood

NSPX30 detected in ESET
telemetry2014

2011 2012
2005

2008

2016
2018 2019 2020

2013
G DATA publishes
report about
Operation TooHash
First public report onProject Wood byFrankie Li
First public
report on DCMby Jianming

Tencent publishes
a report on
DCM/Dark Specter

2022 2023 2024

Timeline of publications about NSPX30’s ancestors
First and last known sample of NSPX30First and last known sample of DCM(aka Dark Specter)
First and last known sample of Project Wood

NSPX30 detected in ESET
telemetry2014

2011 2012
2005

2008

2016
2018 2019 202020132022 2023 2024

G DATA publishes
report aboutOperation TooHash
First public report on
Project Wood byFrankie Li
First public
report on DCM
by Jianming

Tencent publishes
a report on
DCM/Dark Specter

NSPX30 cluster
tracked asBlackwood

Targeted regions

Blackwood profile

Japan

ChinaSectors
United Kingdom

Manufacturing

Toolkit

NSPX30

AitM

Individuals

Geographical distribution of NSPX30 victims
United Kingdom
an individualGeographical distribution of NSPX30 victims
United Kingdom
an individual

China
individuals
a manufacturing andtrading company
a Japanese engineeringand manufacturingcorporation

Geographical distribution of NSPX30 victims
United Kingdom
an individual

Japanindividuals

Chinaindividuals
a manufacturing andtrading company
a Japanese engineeringand manufacturingcorporation

How Blackwood uses AitM?

What we observed on victim machines
Tencent QQ
softwarehttp://dl_dir.qq.com/invc/qq/minibrowser.zip(183.134.93.142)

1. updates from

Legitimate server

Tencentdl.exe

QQ.exeWhat we observed on victim machines
Tencent QQ
softwarehttp://dl_dir.qq.com/invc/qq/minibrowser.zip(183.134.93.142)

1. updates from

Legitimate server

2. writes to disk

Tencentdl.exe

QQ.exeminibrowser_shell.dll

What we observed on victim machines
Tencent QQsoftware
http://dl_dir.qq.com/invc/qq/minibrowser.zip(183.134.93.142)

1. updates from

Legitimate server

2. writes to disk

Tencentdl.exe

minibrowser_shell.dll

3. loads DLLQQ.exe

Successfully hijacked software updates byBlackwood and others!

Tencent QQ

Sogou Pinyin

WPS OfficeSuccessfully hij…

MISSION FAILURE

What we learned from the attacks

Initial access
NSPX30 dropper downloaded
through HTTP by legitimate
software.

What we learned from the attacks

Initial access

Legitimate servers

NSPX30 dropper downloaded
through HTTP by legitimatesoftware.

IP address associated to domains
were from legitimate
infrastructure.

What we learned from the attacks

Initial access

Legitimate servers

Flexible dropper

NSPX30 dropper downloaded
through HTTP by legitimate
software.

IP address associated to domains
were from legitimate
infrastructure.

NSPX30 dropper can be DLL/EXE,
if required: in ZIP archive.

The NSPX30 and its design

NSPX30 main features

Reliance on AitM
NSPX30 dropper component isdelivered via hijacked updates.
Communicates with its
infrastructure through AitM.

NSPX30 main features

msnsp.dll

Reliance on AitM

Persistence

NSPX30 dropper component isdelivered via hijacked updates.

Loader persisted as a Winsock
Namespace Package (NSP) DLL.

Communicates with its
infrastructure through AitM.

Malicious DLL is automaticallyloaded into processes that useWinsock.

NSPX30 main features

msnsp.dll

Reliance on AitM

PersistenceHighly modular

NSPX30 dropper component isdelivered via hijacked updates.

Loader persisted as a Winsock
Namespace Package (NSP) DLL.

Communicates with its
infrastructure through AitM.

Malicious DLL is automaticallyloaded into processes that use
Winsock.

Composed of many components:
loaders, orchestrator, backdoor,and three groups of plugins.

Orchestrator main functionality
Orchestrator
startsThread 1

startsThread 2

Orchestrator main functionality
Orchestrator
startsstartsThread 2

Thread 1

downloads
backdoor

drops andloads

Baidu website

BackdoorOrchestrator main functionality
Orchestrator
startsstartsThread 2

Thread 1

downloads
backdoor

drops andloads

loads

performs

Baidu website

Backdoor

Plugins

AllowlistingOrchestrator plugins
Backdoorc001.datc002.dat
Found! ☺

Orchestrator

downloads

loads

c003.dat

c005.dat

c006.dat
Not found 

The orchestrator does not load a plugin named c004.dat!

c007.datOrchestrator plugins
Plugin c001.dat

Plugin c002.dat

Orchestrator plugins
Plugin c001.dat

decrypts
key from

Registry.db

Plugin c002.dat

decrypt DBs

QQ databases

Orchestrator plugins
Plugin c001.dat

decrypts
key from

Plugin c002.dat

hooks functions
in memorydecrypt DBs

issues SQL
statements
Registry.db

QQ databases

Common.dll(SQL functions)

KernelUtil.dll(Msg functions)Orchestrator plugins
Input stream APIs
• waveInOpen• waveInAddBuffer• waveInClose
Plugin c003.dat
winmm.dll

Output stream APIs
• waveOutOpen• waveOutWrite• waveOutClose
CoCreateInstance -> IMMDeviceEnumerator

ole32.db“AITM is more than our favourite technique, it’s a way of life!” NSPX30’s developers, maybe.

Allowlisting in security software

Tencent PC
Manager360 Safeguard
And Antivirus

Kingsoft Antivirus

Allowlisting in Tencent PC ManagerLoaders

Orchestrator

Or…

msnsp.dll

Used by NSPX30

mshlp.dllWIN.cfg

Allowlisting in 360 software
Target: 360 Antivirus

sl2.dbTarget: 360 Safeguard

mshlp.dll
msnsp.dll

Used by: NSPX30 and Gelsemium.

Used by: NSPX30, Gelsemium, and McRAT.

Allowlisting in Kingsoft Antivirus

msnsp.dll

Used by: NSPX30

Bonus mention: allowlisting in Windows DefenderOverview of the backdoor’s functionality
a010.dat
Gather system information
Extracts embedded plugins
msfmtkl.dat(Backdoor)

Load plugins from disk
Configure plugins
Download plugins
Communicate with C&C
Exfiltrate collected data

AitM

b010.datb011.dat

Anonymizing the attacker’s
infrastructure via AitM

How we believe Blackwood operates

Local network

Blackwood

RouterUnknown
network implant

How we believe Blackwood operates
Local network
Traffic fromunencrypted
update protocol

NSPX30Tencent QQ
serverRouterhttp://dl_dir.qq.com/invc/qq/minibrowser.zip(183.134.93.142)

How we believe Blackwood operates
Local network
NSPX30packets
appearlegitimate.

NSPX30 packets areforwarded to thereal attacker’s infraDownloading components

Fingerprint

http://www.baidu.com/id=<ID>&ad=32&os=<OS_MAJOR_VERSION>.<OS_MINOR_VERSION>&t=<ATTEMPTS>

Mozilla/4.0 (compatible;MSIE 5.0; Windows 98)

UDP interception
Fingerprint

DNS server at 180.76.76.11/24
Port: 53, 4499, 8000
Transaction ID always 0xFEAD
Domain: microsoft.com

Appended data to exfiltrateUDP interception
Beginning at 180.76.76.11

Port: 53 or 4499 or 8000

Baidu DNS is at 180.76.76.76

What about ISP infrastructure compromise?

What about ISP compromise?

Global reachNot all targets are located inChina.

What about ISP compromise?

Global reachNot always China

Not all targets are located inChina.

Some servers from Baidu
network 186.76.76.0/24 areanycast: they could be
geolocated around the world.

What about ISP compromise?

Global reachNot always China!

Reliability

Not all targets are located inChina.

Some servers from Baidu
network 186.76.76.0/24 areanycast: they could be
geolocated around the world.

AitM mechanism appears to bereliable. Exfiltration requires A
LOT of packets.

Assessment: ISP compromise for AitM is unlikely.

The China-aligned AitM clubChina-aligned APTs with AitM capability tracked by ESET

Evasive Panda

LittleBear

AitM via compromised network device, or ISP? We don’t know.

LuoYuBlackwood

AitM working outside of China networks? Yes.

The update hijacking mechanism seems suspiciously similar for all four clusters

TheWizards APT

Targeted regions
Philippines

Hong Kong

Sectors
UAE

China

Gambling

Toolkit

WizardNet

DarkNights

Spellbinder

Individuals

TheWizards APT

Targeted regions
Philippines

Hong Kong

Sectors
UAE

China

Gambling

Individuals

Toolkit

WizardNet

DarkNights

Spellbinder

Spellbinder: lateral
movement tool thatperforms AitM via IPv6
Stateless Address
Autoconfiguration(SLAAC) spoofing attack

TheWizards approach to AitM
ICMPv6 RA message
Preffix:
2001:db8::/64
RDNSS:
240e:56:4000:8000::11240e:56:4000:8000::22

Spellbinder

VictimTheWizards approach to AitM
ICMPv6 RA message
Preffix:
2001:db8::/64
RDNSS:
240e:56:4000:8000::11
240e:56:4000:8000::22

Spellbinder

VictimTheWizards approach to AitM
ICMPv6 RA message
Preffix:
2001:db8::/64
RDNSS:
240e:56:4000:8000::11
240e:56:4000:8000::22

DNS queryget.sogou.com

Spellbinder

VictimTheWizards approach to AitM
ICMPv6 RA message
Preffix:
2001:db8::/64
RDNSS:240e:56:4000:8000::11
240e:56:4000:8000::22

DNS queryget.sogou.com

Spellbinder

DNS reply
malicious server IP

Attacker’s server

VictimTheWizards approach to AitM
ICMPv6 RA message
Preffix:
2001:db8::/64
RDNSS:
240e:56:4000:8000::11
240e:56:4000:8000::22

DNS queryget.sogou.com

Spellbinder

DNS reply
malicious server IP

Victim
get update via
HTTP

Attacker’s server

Dropper DLL

Spellbinder’s IPv6 SLAAC attack
Attack vector discussed by the IETF as early as 2008
IPv6 is enabled by default on modern Windows OS
Very effective:▪ Dozens of machines compromised in a short time
▪ No noticeable effect for the victims

Conclusion

What is known and what is not known• NSPX30 and DCM for Win32• Project Wood for Win32

Project Wood is alive and well:• Linux version recently found!

What is known and what is not known• NSPX30 and DCM for Win32• Project Wood for Win32

Is NSPX30 developed by a digitalquartermaster?

Project Wood is alive and well:• Linux version recently found!

What is known and what is not known• NSPX30 and DCM for Win32• Project Wood for Win32

Project Wood is alive and well:• Linux version recently found!

Is NSPX30 developed by a digitalquartermaster?
How is Blackwood able to accurately
find its victims in cyberspace?

Reports by CitizenLab and McAfee

What is known and what is not known• NSPX30 and DCM for Win32• Project Wood for Win32

Project Wood is alive and well:• Linux version recently found!

Is NSPX30 developed by a digitalquartermaster?
How is Blackwood able to accurately
find its victims in cyberspace?

The elusive AitM network implantどうも ありがとう ございます
Q&A