Penetration Test Report (SwissCERT): Report Ruag Espionage Case

MELANI:GovCERT TLP WHITE
APT Case RUAG
Technical Report
Author: GovCERT.ch
Date: 23rd May 2016
TLP: WHITE
Topic: Technical Report about the Espionage Case at RUAG
MELANI:GovCERT TLP WHITE
Content
Summary 1
Introduction 2
The Case . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
The Chronology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
The Malware Family . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
Modus Operandi 4
Victim Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Infecting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5
Active Infection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Trojan Supported Reconnaissance. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Gaining Information and the Task Format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Gaining Final Persistence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
A Closer Look at the Encryption Algorithms Used in Carbon-DLL and Tavdig . . . . . . . . 15
Lateral movement . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Data Exfiltration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Recommendations 27
System level . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Active Directory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Network level . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Log files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
System Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Organization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Conclusion 29
Appendix IOCs 31
URLs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
MD5 Hashes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
External References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
CONTENT
MELANI:GovCERT TLP WHITE
Summary
TheRUAGcyberespionagecasehasbeenanalyzedbyGovCERTinordertoprovideinsightandprotection.
We decided to publish this report to give organizations the chance to check their networks for similar
infections, and to show the modus operandi of the attacker group.
The attackers have been using malware from the Turla family, which has been in the wild for several years.
The variant observed in the network of RUAG has no rookit functionality, but relies on obfuscation for
stayingundetected. Theattackersshowedgreatpatienceduringtheinfiltrationandlateralmovement. They
only attackedvictims they were interestedin byimplementing variousmeasures, such as a target IP list and
extensive fingerprinting before and after the initial infection. After they got into the network, they moved
laterallybyinfectingotherdevicesandbygaininghigherprivileges. Oneoftheirmaintargetswastheactive
directory, as this gave them the opportunity to control other devices, and to access the interesting data by
usingtheappropriatepermissionsandgroupmemberships. ThemalwaresentHTTP requeststotransferthe
data to the outside, where several Command-and-Control (C&C) servers were located. These C&C servers
provided new tasks to the infected devices. Such tasks may consist of new binaries, configuration files, or
batch jobs. Inside the infiltrated network, the attackers used named pipes for the internal communication
between infected devices, which is difficult to detect. This way, they constructed a hierarchical peer-to-peer
network: some of these devices took the role of a communication drone, while others acted as worker drones.
The latter ones never actually contacted any C&C servers, but instead received their tasks via named pipes
from a communication drone, and also returned stolen data this way. Only communication drones ever
contacted C&C servers directly.
It is difficult to estimate the damage caused by the attackers; this is by any means beyond the scope of
this report. However, we observed interesting patterns in the proxy logs. There were phases with very few
activity, both in terms of requests and amount of data transferred. These quiet phases were seperated by
high-activity periods with many requests and big amounts of exfiltrated data.
At the end of the report, we provide some recommendations and countermeasures we consider most effective
against this kind of threat on the level of end-devices, the active directory, and the network. It is important
to mention that many countermeasures are not cost-intensive, and can be implemented with reasonable
amount of work. Even if it is difficult to completely protect an organization against such actors, we are
confident that they are detectable, as everyone makes mistakes. The defending organization must be ready
to see such traces, and to share this information with other parties, in order to follow such attackers closely.
SUMMARY 1 / 32
MELANI:GovCERT TLP WHITE
Introduction
The following is a short report with the intention to inform the public about Indicators of Compromise
(IOCs) and Modus Operandi of the attacker group that is responsible for the RUAG cyber espionage
case, which has been made public on Wednesday, May 4th 2016.
One of the main tasks of MELANI is to support critical infrastructures during security incidents and the co-
ordination of relevant actors involved. Regarding technical first response and support, GovCERT supported
RUAG with log analysis, forensics, malware reverse engineering and security monitoring. The report below
reflects our experiences during this case.
The Case
ThecyberattackisrelatedtoalongrunningcampaignofthethreatactoraroundEpic/Turla/Tavdig. The
actor has not only infiltrated many governmental organizations in Europe, but also commercial companies
in the private sector in the past decade. RUAG has been affected by this threat since at least September
2014. The actor group used malware that does not encompass any root kit technologies (even though the
attackers have rootkits within their malware arsenal). An interesting part is the lateral movement, which
has been done with a lot of patience. The intention of the attackers is always to steal information from the
victim. In order to this, they infiltrate the network and then move laterally, until they are able to retrieve
the information of interest.
We would like to emphasize that public blaming is never appropriate after such attacks. These attacks may
happen to every organization regardless of their security level. What is much more important is to learn
from these attacks and to raise the bar for the next time the attacker tries to infiltrate the network.
The Chronology
The picture below shows the chronology of the attack against RUAG.
Figure 1: Timeline of Attack
INTRODUCTION 2 / 32
MELANI:GovCERT TLP WHITE
The Malware Family
There are many names used in the context of this malware family. The most generic one is Turla, which is
consideredasthenameforthewholefamily-somealsocallitUroburos, thoughthisisnotstrictlycorrect.
The following picture tries - in an extremely simplified manner - to summarize the involved trojan names:
Figure 2: Turla Family Tree
This overview is not complete, but most commonly known names should be present. The common ancestor
seemstobe Agent.BTZ,whichwasfirstobservedin 2007and2008in theUS.Theroots ofAgent.BTZare
a bit vague, and also code relations to the rest of the