NetWitness Community

DarrenMccutchen · ‎2022-12-10

Earlier this Fall, the Cybersecurity & Infrastructure Security Agency (CISA) released an Alert Bulletin detailing campaigns perpetrated by several advance persistent threat (APT) groups against a Defense organization(1) . While several of the tools highlighted in the report had ties to several Chinese sponsored cyber groups (China Chopper, CovalentStealer, Impacket), the use of the HyperBro Remote Access Trojan (RAT) pointed to the involvement of one prolific threat group in particular, APT27.

In this blog post, we will review the history of the threat group, highlight well-known attacks attributed to APT27, and use Netwitness to analyze the HyperBro RAT, one of the more widely used pieces of malware in the APT27 toolkit.

APT27 Background:

APT27 is a sophisticated cyber threat group believed to be sponsored by the Chinese government. Commonly referred to by several aliases including EMISSARY PANDA, Bronze Union, Budworm, Iron Tiger, TG-3390, and Lucky Mouse, APT27 has been targeting victims since at least 2010(2). This group has successfully executed multiple long-term, highly targeted attacks against organizations in multiple industries (defense, technology, energy, manufacturing, among others). Originally, APT27 solely focused their efforts on espionage, infiltrating networks to monitor, gather, and exfiltrate sensitive data. In recent years however, there has been an expansion in tactics towards financially motivated cybercrime, with known APT27 malware used to deliver cryptominers(3) and ransomware(4). Over the course of the APT27’s existence, the group has displayed an ability to gain access using several techniques. Whereas APT27 initially used spearphishing as their main infiltration vector, the group has expanded their capabilities to include exploitation of vulnerabilities on web facing systems(5), compromise of third party applications(6), and supply-chain attacks(7).

To conduct their tradecraft, APT27 uses a combination of proprietary malware, malware shared amongst several suspected Chinese cybercrime groups, and publicly available open-source software. The first malware to be associated with an early iteration of the group was the infamous Gh0st RAT from 2009. Since that time, other well-known malware like ZxShell, PlugX, SysUpdate, and HyperBro have been heavily linked to APT27. Additionally, modified versions of legit software such as HTTPBrowser, Impacket, and gsecdump have been used during the group’s intrusions. Due to regular maintenance and updating of their toolset, APT27 has been adept at bypassing traditional security detections. This diverse collection of tools allows APT27 to adapt their tactics as needed, essentially giving the group a “Swiss army knife” to compromise vastly different target environments.

Notable Attacks Linked to APT27:

February 2015 - American health Insurance provider Anthem disclosed it was a victim of a data breach, in which the PII information of 78.8 million people was stolen(8). Post breach analysis revealed the initial access vector as a phishing email sent to an employee a year prior. According to the same report, the breach resulted in Anthem spending $260 million to fix security-related issues and an additional $39 million to settle lawsuits from affected victims. Although this attack was never directly attributed to a nation state, the presence of several APT27 TTPs (including C2 infrastructure and software), made the group the most likely culprit.
March 2018 - APT27 compromised the national data center of a Central Asian country(9). While present in the victim network for at least 4 months, the threat group used official websites from the victim to run a watering hole attack. Users who interacted with malicious links hosted on these websites were redirected to APT27 controlled domains and silently downloaded ScanBox and BEeF frameworks to their systems. APT27 tool HyperBro was found on several systems inside of the targeted environment.
March 2021 - The BfV German domestic intelligence services released a report alerting on APT27 attacks against German commercial organizations(10). In the documented attacks, APT 27 exploited vulnerabilities in Zoho AdSelf Service Plus software, a self-service password management tool, to gain initial access. Once on the network, the threat group conducted espionage activity by leveraging legitimate software vulnerable to DLL side-loading to load HyperBro RAT in memory.
April 2022 - Campaigns against a Middle Eastern government, an electronics manufacturer, a U.S. state legislature, and a Southeast Asian hospital were all attributed to APT27(11). In these attacks, APT27 took advantage of the Log4j vulnerabilities to install web shells on web servers. Again, APT27 deployed its HyperBro RAT by dropping a copy of legitimate software (In these instances, CyberArk Viewfinity was used) on victim systems and DLL side-loading the payload in memory.

HyperBro - APT27's Premier Payload:

Across recent intrusions linked to APT27, the most witnessed piece of malware is the HyperBro RAT. HyperBro is an in-memory remote access trojan used by APT27 for backdoor access on targeted systems. HyperBro abuses DLL side-loading to compromise victim systems (Bitdefender has an excellent write-up on DLL side-loading here(12)). Once on the target host, an attacker drops two files into a directory of their choosing: a legitimate signed executable vulnerable to side-loading attack and a malicious loader DLL. Once the executable is executed, the malicious DLL is side-loaded and executed, which in turn loads the HyperBro payload. The payload is then decoded and loaded into memory. With HyperBro running on a system, attackers can execute commands both locally and remotely, log keystrokes, screen capture, and modify services, processes, files, and the registry.

Analyzing HyperBro with Netwitness:

For a better understanding of how a HyperBro attack works, we used Netwitness to analyze the artifacts mentioned in CISA’s latest HyperBro briefing. To setup our detonation environment we used a Windows 10 hosts and then placed copies of the following files in a Desktop folder named HB-Test:

vf_host.exe – The legit software CyberArk Viewfinity
- SHA256: df847abbfac55fb23715cde02ab52cbe59f14076f9e4bd15edbe28dcecb2a348
vftrace.dll – The malicious DLL side-loaded by Viewfinity. This contains the HyperBro payload
- SHA256: 52072a8f99dacd5c293fccd051eab95516d8b880cd2bc5a7e0f4a30d008e22a7
thumb.dat – The config file which instructs the HyperBro payload how to operate
- SHA256: f2ba8b8aabf73020febd3a925276d52ce88f295537fe57723df714c13f5a8780

Once vf_host.exe is executed on our “victim” system, vftrace.dll is run via side-loading (MITRE: T1574.002 - Hijack Execution Flow: DLL Side-Loading). On the host, the other files are then deleted from the HB-Test folder.

HB-Test Files gone.png

HyperBro files removed from original folder HB-Test

At the same time, vf_host.exe drops copies of the previously removed files vftrace.dll and thumb.dat in a newly created hidden directory C:\ProgramData\windefenders (T1564.001 - Hide Artifacts: Hidden Files and Directories). A copy of vf_host.exe is renamed to msmpeng.exe and is also placed in the new windefenders directory along with a file config.ini which contains system identification information to be used in later command-and-control (C2) communications.

All files copied to windefenders.png

HyperBro files copied to C:\ProgramData/windefenders

In our Netwitness SIEM we can see the ‘renameToExecutable’ and ‘writeToExecutable’ events related to this activity.

vf_host.exe moves vftrace.dll to C:\ProgramData\windefenders

vf_host.exe makes copy of itself, named msmpeng.exe, to C:\ProgramData\windefenders

After decoding thumb.dat (MITRE: T1140 - Deobfuscate/Decode Files or Information), HyperBro will spawn a new svchost.exe and inject itself into the process (MITRE: T1055 – Process Injection). The next step is for HyperBro to gain persistence, which it accomplishes by adding an entry for windefenders to the Startup Run registry key (MITRE: T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder).

Registry Run Key.jpg

windefenders added to Startup Run Registry key for persistence

Looking back on our SIEM, we see the corresponding ‘createRegistryValue’ activity in our threat lab SIEM.

Netwitness captures registry edit made by HyperBro

The last activity seen in Netwitness is the attempted network connection to the C2 server 104.168.236.43 mentioned in the CISA report (MITRE: T1071.001 - Application Layer Protocol: Web Protocols).

HyperBro C2 communication attempt

Conclusion:

APT27 is a highly skilled adversary with no indication of stopping anytime soon. Because of its ability to quickly weaponize novel tools and methods of intrusion, the group seems poised to continue operations across multiple sectors and geographical regions. It will be interesting to see if the financial motivation displayed by APT27 in recent attacks will continue or if the group will revert to an espionage only model.

The following App Rules, currently on Netwitness Live, should help organizations identify suspicious HyperBro activity with Netwitness Endpoint: