2024.01.25

Unveiling TeleBoyi: Chinese APT Group
Targeting Critical Infrastructure Worldwide
Yi-Chin Chuang, Yu-Tung Chang

$whoami

Yi-Chin Chuang

Yu-Tung Chang◆

Threat Intelligence Researcher @ TeamT5•

Threat Intelligence Researcher @ TeamT5◆

Focus on APAC APT•Focus on APAC APT•

Speaker of Conferences: Code Blue
2

Agenda01

Introduction

02

Dive into TeleBoyi

03

Relation with other APT groups

04

Conclusion

Introduction

TeleBoyi Profile猼訑(Boyi)◆ China-nexus APT group◆◆◆Targeted Country:◆◆

Worldwide, especially APAC region

Targeted Industry:◆◆Since 2014

Critical Infrastructure, mainly Telecom

Malware:◆PlugX, LibreCoin, DoubleShell, TripleZero, …
5

Target ScopeAmericas

APAC RegionEurope
6Target Industry

Telecommunications

Information Technology

Critical Manufacturing

Financial Services

Government Facilities

Healthcare

EnergyNuclear7

Chinese APT Targeting CI◆

ChamelGang (CamoFei)◆

Target : Energy and Aviation in Russia◆

other victims :…

• APT41 (Amoeba)•Target Industry :•Target Scope : North America, Europe, Asia

8

Chinese APT Targeting CI (Cont.)◆Volt Typhoon◆

Target Industry :◆Target Country :…

9Reason for Chinese APT targeting CI

Espionage and Information Gathering◆ ChamelGang◆ Technology Theft◆ APT41◆ Preparation for Future Operations◆ Volt Typhoon◆

10Operation ‘Harvest’◆

Reported by McAfee◆ Cyber espionage◆ Observed in 2019/2020

Backdoor◆ PlugX, Winnti◆ C2◆ sery.brushupdata.com◆ center.asmlbigip.com◆ sec.asmlbigip.com◆11Timeline
2017/05
2017/03

2015/03
2015/112017/08

2016/1120152018/05

2016

2017

2018/08201820192020

2018/10
2015/04

2016/082017/032018/082019/12

12

Timeline
2017/05
2017/03

2015/03
2015/112017/08

2016/112015

Targeting telecom

2018/05

2016

2017

2018/08

2018

2019

2020

2018/10
2015/04

2016/082017/032018/082019/12Targeting financial
13

Timeline (Cont.)
Overlap with Operation ‘Harvest’
2023/01 2023/06

2022/04
2021/04 2021/07

2020/07

2020/04

2022/08

2020

2022

2021
2020/122020/102020/05

2023/08 2023/12

2022/092023
2023/032023/072021/04

2021/06

2023/102022/072022/12

14

Timeline (Cont.)
Targeting energy
2023/01 2023/06

2022/04
2021/04 2021/07

2020/07

2020/04

2022/08

2020

2022

2021
2020/122020/102020/05

2023/08 2023/12

2022/092023
2023/032023/072021/04

2021/06

2023/102022/07

2022/12Targeting telecom
15Timeline (Cont.)
2023/01 2023/06

2022/04
2021/04 2021/07

2020/07

2020/04

2022/08

2020

2022

2021
2020/122020/102020/05

2023/08 2023/12

2022/092023
2023/032023/072021/04

2021/06

2023/102022/072022/1216

TeleBoyi’s interest in the CI
Telecommunication◆ Cooperating to develop 5G networks in Turkey.
◆ China’s telecom products have been banned in India and Vietnam.
◆ Semiconductor◆ The semiconductor tech blockade.
◆ Energy◆ Investment in the energy sector in both Thailand and Brazil.
◆17

Dive into TeleBoyi

Malware Delivery

Fake Applications/Documents◆ Disguise malware as fake application or documents◆ Malicious document files◆ Document with macro, HTA◆ Exploit Public-Facing Application◆19

Fake Applications/Documents◆

Ofis_personeli_yolsuzluk_raporu.exe◆◆

無法注冊網頁出現亂碼.exe◆◆

Turkish, translate: Office staff corruption report

Translate: Unable to register, the webpage is garbled

News about National *** *** University.exe

20

21

Malicious Document FilesMacro

詳細信息.doc

Download PlugX dropper

C2 server

Exploit Public-Facing Application
Java Deserialize vulnerability

Exchange vulnerability
Struts2 S2-045…
China Chopper
Godzilla

TeleBoyi
WebshellServer22

Malware Packing
Self-Extracting Archive (SFX)◆ Flexible deployment◆ Disguise malware as fake application or document◆ Easier installation by macro/HTA◆ Easier installation through webshell
◆◆

Icons

23

TeleBoyi’s Arsenal

25

TeleBoyi’s Arsenal◆

Malware◆ PlugX◆ Winnti◆ ShadowPad◆ DeedRAT◆ TripleZero (Mélofée)◆ LibreCoin (RatelS)◆DoubleShell◆ FakeWorker◆ CobaltStrike◆ Sliver◆ AsyncRAT◆

Hacking tool
◆ Web shell◆ Credential dumpingtool◆ OthersPlugX◆First seen: 2008◆

A modular malware with multiple capabilities◆

Used by several Chinese APT groups◆

TeleBoyi, APT41, Mustang Panda, APT27, menuPass, and more26

TeleBoyi’s Custom Loader
◆

◆◆

◆

Payload◆ PlugX◆ CobaltStrikePacker◆ Themida◆ VMProtect
Payload decryption◆ XORString decryption◆ Pseudo random generation (PRNG)

1. Initial seed as the argument

3. Decrypt string with apseudo-random value

2. Generate a
pseudo-randomvalue with initialseed27TeleBoyi’s PlugX vs.
Other Threat Actors’ PlugX?

TeleBoyi’s PlugX◆◆

Special configuration password◆ &&%*%@! (shift + 7758521)
7758521◆ 亲亲我吧我爱你, which means “Kiss me I love you”

…
29

30

LibreCoin
◆

◆◆

◆

Alias
◆ RatelSFirst seen
◆ 2022/03
Connection◆ Reverse mode
◆ Listen mode
Protocol◆ TCP◆ HTTP/HTTPS
◆ TLS

◆

Capability◆ Command shell◆ File operations◆ Proxy◆ Screenshot◆ Keylogger◆ And more...

LibreCoin – Execution FlowDLL sideloading

Read file anddecrypt with RC4Launcher

Loader

Payloadusost.exe

libvlc.dll

usost.ppt
Decrypted as shellcode

1. Decrypt and decompress
2. Reflective DLL injection
Shellcode loader

Read file anddecrypt withRC4Inject
LibreCoinsvchost.exe

Configusost.cab31

Something Interesting About
This Shellcode Loader...

Shellcode Loader◆◆◆◆

Special API hashing◆ ROR12ROR12Payload decryption◆ XOR + LZNT1
Reflective DLL injection
Shared among certain Chinese APT groups◆ LibreCoin◆ Earth Berberoka’s CoinLess (the variant of CLAMBLING)◆ FamousSparrow’s CobaltStrike◆ GroundPeony’s micDown33

DoubleShell◆First seen◆

2020

◆

Multi-staged◆

Capability◆

Disk management◆

File management◆

Screenshot◆

Command shell

34

DoubleShell – Execution Flow
Launcher

DLL sideloading

oleview.exe

LoaderDecrypt resourcewith a custom
algorithm

run()daemon()MainServer.dll

work()

EdgeUpdate.dat

DoubleShell

watchdog
Shellcode

Payload

InstallDll.dll

ClassicExplorer32.dll

Selfmodify

Read and decryptwith a custom
algorithm

DownloadPlugin

DiskManagerController
FileTransferController
ScreenCtroller
TerminalController
35DoubleShell – Custom Algorithm◆Load resource◆Extract binary blob from even-numberedoffsets of resource

LoaderDecrypt with acustom algorithm

ClassicExplorer32.dll?

InstallDll.dll

36

DoubleShell – Custom Algorithm
1. XOR decrypt a string as “c3nz9x”
2. Try all the permutation of string “c3nz9x” as RC4
key to decrypt it; if the result matches the key, theresult will be a 2nd RC4 key
3. Decrypt it using the 2ndRC4 key
4. The first 16-byte will
be 3rd RC4 key

5. Decrypt it with 3rd RC4 key as next-stage loader (e.g., InstallDll.dll)

37

DoubleShell – Dead Drop Resolver

Legitimated site
https://sites.google.c
om/site/xxxxxxxxxx/Config
DoubleShell’s config

185.236.78.3
New C2 server38

FakeWorker
◆◆

◆

◆

First seen
◆ 2022/04

Command code:
CMD$04|Target◆ LinuxCapability◆ Upload file
◆ Download file
◆ Pseudo terminal (pty)Terminate pseudoterminal (pty)Command code
◆ CMD$0X| (X:1~7)
39

FakeWorker◆◆

Protocol◆ KCP
C2 communication◆ XOR encryption◆ XOR key: 99 (0x63)

40

C&C Infrastructure

42

C&C Infrastructure◆Consists of◆◆◆

VPS server

Compromised
websiteDomains containing
companies related tothe target

Targeted Sector
Semiconductor

C&C Domain
asmlupdata.com,
center.asmlbigip.com,
sec.asmlbigip.com

Telecommunication idupea.controlliamo.com

LegitimateCompany
ASML

Idea Cellular

Aerospacefanuc.gre6gbuf4f.com

FANUC

Cryptocurrency

erc.acefinance.asia,
www.acefinance.asia,
acefinance.asia

ACE Exchange

43

C&C Infrastructure◆

Domains containing famous companies
Legitimate Company

C&C Domain

Microsoft

microsoftupdatebaks.ns0.it,
newupdatemicrosoft.homepc.it,
microsoftstate.homepc.it,
sery.mirsoftcheckie.com

Googledategoogle.ns0.it, googlegmail.ns0.it

LINE

cdn.statics12.line-mychat.com,
cdn.static10.line-mychat.com

PChomepc.pchomecache.com,
cdn.pchomecache.com

Relation with other APT groups

Relation with other APT groups
LibreCoin(RatelS)

TeleBoyi
Windows ver.

ChengduWinnti

TripleZero(Mélofée)

CoinLess(variant ofCLAMBLING)

Linux ver.
Linux ver.

APT41

Earth Berberoka

Shellcode
Loader
micDown
CobaltStrike

FamousSparrow

GroundPeony

45

Relation with other APT groups
LibreCoin(RatelS)

TeleBoyi
Windows ver.

ChengduWinnti

TripleZero(Mélofée)

CoinLess(variant ofCLAMBLING)

Linux ver.
Linux ver.

APT41

Earth Berberoka

Shellcode
Loader
micDown
CobaltStrike

FamousSparrow

GroundPeony

46

Relation with other APT groups
LibreCoin(RatelS)

TeleBoyi
Windows ver.

ChengduWinnti

TripleZero(Mélofée)

CoinLess(variant ofCLAMBLING)

Linux ver.
Linux ver.

Shellcode
Loader
micDown
CobaltStrike

SLIME40
APT41Earth Berberoka

FamousSparrow

GroundPeony

47

Relation with other APT groups◆Potential collaboration between TeleBoyi and other APT groups, including
APT41, Earth Berberoka, SLIME40◆

Malware supply chain among these groups due to malware sharing

48

Conclusion

Key Takeways◆◆◆

TeleBoyi is a Chinese APT group that targets critical infrastructure worldwide
TeleBoyi leverages three different ways to gain initial access, including fakeapplications, malicious documents, exploit public-facing application
TeleBoyi relies on shared tools heavily; we also found two malware named
DoubleShell and FakeWorker that have not been disclosed before◆

TeleBoyi has a close connection with APT41, Earth Berberoka, and SLIME40◆

Chinese APT groups tend to use shared tools in their attacks nowadays

50

THANK YOU!
Yi-Chin Chuang

Yu-Tung Changrax@teamt5.org

tako@teamt5.org