Penetration Test Report (Fox-IT): 201912 Report Operation Wacao

Operation Wocao
Shining a light on one of China’s
hidden hacking groups
Maarten van Dantzig & Erik Schamper
December 19, 2019
fox-it.com
Executive summary
Operation Wocao (我操, “Wǒ cāo”, used as “shit” or “damn”) is the name that
Fox-IT uses to describe the hacking activities of a Chinese based hacking group.
This report details the profile of a publicly underreported threat actor that Fox-IT
has dealt with over the past two years. Fox-IT assesses with high confidence
that the actor is a Chinese group and that they are likely working to support the
interests of the Chinese government and are tasked with obtaining information
for espionage purposes. With medium confidence, Fox-IT assesses that the tools,
techniques and procedures are those of the actor referred to within the industry
as APT20. We have identified victims of this actor in 10 countries, in government
entities, managed service providers and across a wide variety of industries,
including Energy, Health Care and High-Tech.
Beyond the technical details, this report should serve to remind us all how focused and result-
oriented high-end threat actors work to achieve their goals, and that there are still threat actors
active that are almost completely unknown to the public. This actor profile reveals that:
• They carry out most of their activities through abusing legitimate access channels. VPN access
is an example of such a channel, and we have even seen this actor abuse 2FA soft tokens.
• For back-up purposes, they keep additional backdoors in place.
• They move through the network, directly singling out workstations of employees with privileged
access (administrators).
• On these systems, the contents of passwords vaults (password managers) are directly targeted
and retrieved.
• As much as is possible, they remove file system based forensic traces of their activities, making it
much harder for investigators to determine what happened after the fact.
• On the basis of the above, an attacker can efficiently achieve their goal of exfiltrating data,
sabotaging systems, maintaining access and jumping to additional targets.
• Overall the actor has been able to stay under the radar even though the tools and techniques
they use for their hacking operations are relatively simple and to the point.
Knowing how high end threat actors work should also remind us that we, the defenders, have to
continually revisit our defensive strategies:
• Zero Trust or Robust segmentation must be one of the guiding principles of any infrastructure,
both for systems and identities. As part of that, leveraging Microsoft’s Enhanced Security
Administrative Environment (ESAE) where applicable will greatly increase your resilience and can
prevent many attacks from succeeding.
• Timely detection of and adequate response to any serious incident depends on a combination of
high-level and low-level telemetry from network and endpoints.
2 | Fox-IT | Operation Wocao
Contents
Executive summary 2
1 Introduction 4
2 Modus operandi 5
2.1 Activity on an average ‘working day’ 6
3 Attribution 7
3.1 Language 7
3.2 Timezone 9
4 Victims 11
5 Custom tooling 12
5.1 File upload webshell 12
5.2 File upload and command execution webshell 12
5.3 Socket tunnel 13
5.4 Reconnaissance script 13
5.5 XServer 14
5.6 Agent 16
5.7 Directory list tool 17
5.8 Process launcher 18
5.9 CheckAdmin 18
5.10 OS scanner 20
5.11 Keylogger 21
6 MITRE ATT&CK matrix 23
6.1 Initial Access 24
6.2 Execution 24
6.3 Persistence 26
6.4 Privilege Escalation 28
6.5 Defense Evasion 28
6.6 Credential access 30
6.7 Discovery 32
6.8 Lateral movement 36
6.9 Collection 36
6.10 Exfiltration 37
6.11 Command and Control 37
Fox-IT | Operation Wocao | 3
1 Introduction
Fox-IT’s (FoxCERT) and the wider global NCC Group incident response team
carries out incident response engagements for clients every day. Our engagements
are often high profile in nature and so together with timeliness of detection,
the quality of incident response is probably the most important factor in what
the impact of an incident will be.
In the context of incident response, we support our clients with crisis management, technical
investigations and remediation of the incident. Almost without exception, the most valuable
technical insights for live and historic forensic investigation are gained from the network and
endpoint data. In other words: network and endpoint visibility are crucial for timely detection and
quality response, the most deciding factor in what the impact of an incident will be.
With that in mind, the goal of publishing this report is twofold. The first is to help organizations
and wider cyber defense eco-system defend against the specific actor described in this report.
The second is to help readers understand the tools and techniques that threat actors can use to
compromise an enterprise infrastructure and steal information. This in turn helps them in their role
as incident responder, SOC or threat analyst or even as security officer.
Very little is publicly known or published about the actor that we describe, but rather than giving
this actor an alias of our own, we chose to reach out to industry partners. This collaboration across
the private sector helped us attribute some of the previously unpublished techniques and tools in
this report, with medium confidence, to a Chinese threat actor known within the industry as APT20.
Based on the observed victims of this actor we also assess that this threat actor is likely working in
the interest of the Chinese government.
This report provides the reader with an overview of the techniques known to us that are used by
the actor. It is described in the following five chapters:
• Modus operandi describes, without going into too much technical detail, the actor’s typical
way of working.
• Attribution describes where the actor is most likely operating from.
• Victims describes the countries and sectors in which the victims of this actor reside.
• Custom tooling describes a number of tools, and their functionality, that we believe are
exclusively used by this actor.
• MITRE ATT&CK maps the techniques that the actor uses to the MITRE ATT&CK Matrix1.
This report is accompanied by a parallel publication on GitHub where Snort and YARA signatures
can be found, as well as indicators of compromise.
1. https://attack.mitre.org/wiki/Windows_Technique_Matrix
4 | Fox-IT | Operation Wocao
2 Modus operandi
This section summarizes the actor’s tactics and techniques for obtaining an
initial foothold, lateral movement and persistence. A full detailed overview of the
actor’s Tactics Techniques and Procedures (TTPs) mapped to the MITRE ATT&CK
framework can be found in chapter 6.
Initial Access
In several cases the initial access point into a victim network was a vulnerable webserver, often
versions of JBoss. Such vulnerable servers were observed to often already be compromised with
webshells, placed there by other threat actors. The actor actually leverages these other webshells
for reconnaissance and initial lateral movement activity. After this initial reconnaissance the actor
uploads one of its own webshells to the webserver. Access as initially obtained to the compromised
webserver, for example through the uploaded webshell, is kept by the actor as a precaution in the
event of losing the other primary method of persistent access, for example if the credentials for VPN
accounts were to be reset.
Lateral Movement
Once an initial foothold is established, the actor moves laterally through the network using well-
known and well-documented methods, such as dumping credentials from memory and accessing
password managers on compromised systems.
The actor specifically targets systems and people based on their role and associated privilege levels
within the organization. This method enables the actor to persistently and quickly obtain access to
highly privileged accounts, such as enterprise and domain administrators. Once such privileges have
been obtained, the actor directly shift