Posté par: igor51 le mars 23, 2017, 17:04:46
and Targets Hong Kong Media Outlets
[html]
FireEye Threat Intelligence analysts identified a spear phishing
campaign carried out in August 2015 targeting Hong Kong-based media
organizations. A China-based cyber threat group, which FireEye tracks
as an uncategorized advanced persistent threat (APT) group and other
researchers refer to as “admin@338,” may have conducted the
activity.[1] The email messages contained
malicious documents with a malware payload called LOWBALL. LOWBALL
abuses the Dropbox cloud storage service for command and control
(CnC). We collaborated with Dropbox to investigate the threat, and our
cooperation revealed what may be a second, similar operation. The
attack is part of a trend where threat groups hide malicious activity
by communicating with legitimate web services such as social
networking and cloud storage sites to foil detection efforts.
A Cyber Campaign Likely Intended to Monitor Hong Kong Media During
a Period of Crisis
The threat group has previously used newsworthy events as lures to
deliver malware.[4] They have largely targeted
organizations involved in financial, economic and trade policy,
typically using publicly available RATs such as Poison Ivy, as well
some non-public backdoors.[5]
The group started targeting Hong Kong media companies, probably in
response to political and economic challenges in Hong Kong and China.
The threat group’s latest activity coincided with the announcement of
criminal charges against democracy activists.
have faced several challenges, including large-scale protests in Hong
Kong in late 2014, the precipitous decline in the stock market in
mid-2015, and the massive industrial explosion in Tianjin in August
2015. In Hong Kong, the pro-democracy movement persists, and the
government recently denied a professor a post because of his links to
a pro-democracy leader.[7]
Multiple China-based cyber threat groups have targeted international
media organizations in the past. The targeting has often focused on
Hong Kong-based media, particularly those that publish pro-democracy
material. The media organizations targeted with the threat group’s
well-crafted Chinese language lure documents are precisely those whose
networks Beijing would seek to monitor. Cyber threat groups’ access to
the media organization’s networks could potentially provide the
government advance warning on upcoming protests, information on
pro-democracy group leaders, and insights needed to disrupt activity
on the Internet, such as what occurred in mid-2014 when several
websites were brought down in denial of service attacks.[8]
Threat Actors Use Spear Phishing Written in
Traditional Chinese Script in Attempted Intrusions
In August 2015, the threat actors sent spear phishing emails to a
number of Hong Kong-based media organizations, including newspapers,
radio, and television. The first email references the creation of a
Christian civil society organization to coincide with the anniversary
of the 2014 protests in Hong Kong known as the Umbrella Movement. The
second email references a Hong Kong University alumni organization
that fears votes in a referendum to appoint a Vice-Chancellor will be
co-opted by pro-Beijing interests.[9]
Figure 1: Lure Screenshots
The group’s previous activities against financial and policy
organizations have largely focused on spear phishing emails written in
English, destined for Western audiences. This campaign, however, is
clearly designed for those who read the traditional Chinese script
commonly used in Hong Kong.
LOWBALL Malware Analysis
The spear phishing emails contained three attachments in total, each
of which exploited an older vulnerability in Microsoft Office (CVE-2012-0158):
MD5 | valign="top"> |
| valign="top"> | |
| valign="top"> | |
| valign="top"> |