Operation SnowMan: DeputyDog Actor Compromises US Veterans of Foreign
Wars WebsiteOn February 11, FireEye identified a zero-day exploit
(CVE-2014-0322) being served up from the U.S. Veterans of Foreign
Wars’ website (vfw[.]org). We believe the attack is a strategic Web
compromise targeting American military personnel amid a paralyzing
snowstorm at the U.S. Capitol in the days leading up to the Presidents
Day holiday weekend. Based on infrastructure overlaps and tradecraft
similarities, we believe the actors behind this campaign are
associated with two previously identified campaigns ( href="/content/fireeye-www/en_US/blog/threat-research/2013/09/operation-deputydog-zero-day-cve-2013-3893-attack-against-japanese-targets.html">Operation
DeputyDog and href="/content/fireeye-www/en_US/blog/threat-research/2013/11/operation-ephemeral-hydra-ie-zero-day-linked-to-deputydog-uses-diskless-method.html">Operation
Ephemeral Hydra).
This blog post examines the vulnerability and associated attacks,
which we have dubbed “Operation SnowMan."
Exploit/Delivery analysis
After compromising the VFW website, the attackers added an iframe
into the beginning of the website’s HTML code that loads the
attacker’s page in the background. The attacker’s HTML/JavaScript page
runs a Flash object, which orchestrates the remainder of the exploit.
The exploit includes calling back to the IE 10 vulnerability trigger,
which is embedded in the JavaScript. Specifically, visitors to the
VFW website were silently redirected through an iframe to the exploit
at www.[REDACTED].com/Data/img/img.html.
Mitigation
The exploit targets IE 10 with Adobe Flash. It aborts exploitation
if the user is browsing with a different version of IE or has
installed Microsoft’s Experience Mitigation Toolkit (EMET). So
installing EMET or updating to IE 11 prevents this exploit from functioning.
Vulnerability analysis
The vulnerability is a previously unknown use-after-free bug in
Microsoft Internet Explorer 10. The vulnerability allows the attacker
to modify one byte of memory at an arbitrary address. The attacker
uses the vulnerability to do the following:
- Gain access to memory from Flash
ActionScript, bypassing address space layout randomization
(ASLR) - Pivot to a return-oriented programing (ROP) exploit
technique to bypass data execution prevention (DEP)
EMET detection
The attacker uses the Microsoft.XMLDOM ActiveX control to load a
one-line XML string containing a file path to the EMET DLL. Then the
exploit code parses the error resulting from the XML load order to
determine whether the load failed because the EMET DLL is not
present. The exploit proceeds only if this check determines that the
EMET DLL is not present.
ASLR bypass
Because the vulnerability allows attackers to modify memory to an
arbitrary address, the attacker can use it to bypass ASLR. For
example, the attacker corrupts a Flash Vector object and then
accesses the corrupted object from within Flash to access memory. We
have discussed this technique and other ASLR bypass approaches href="/content/fireeye-www/en_US/blog/threat-research/2013/10/aslr-bypass-apocalypse-in-lately-zero-day-exploits.html">in
our blog. One minor difference between the previous approaches
and this attack is the heap spray address, which was changed to
0x1a1b2000 in this exploit.
Code execution
Once the attacker’s code has full memory access through the
corrupted Flash Vector object, the code searches through loaded
libraries gadgets by machine code. The attacker then overwrites the
vftable pointer of a flash.Media.Sound() object in
memory to point to the pivot and begin ROP. After successful
exploitation, the code repairs the corrupted Flash Vector and
flash.Media.Sound to continue execution.
Shellcode analysis
Subsequently, the malicious Flash code downloads a file containing
the dropped malware payload. The beginning of the file is a JPG image;
the end of the file (offset 36321) is the payload, encoded with an XOR
key of 0x95. The attacker appends the payload to the shellcode before
pivoting to code control. Then, when the shellcode is executed, the
malware creates files “sqlrenew.txt” and “stream.exe”. The tail of the
image file is decoded, and written to these files. “sqlrenew.txt” is
then executed with the LoadLibraryA Windows API call.
ZxShell payload analysis
As documented above, this exploit dropped an XOR (0x95) payload that
executed a ZxShell backdoor (MD5: 8455bbb9a210ce603a1b646b0d951bce).
The compile date of the payload was 2014-02-11, and the last modified
date of the exploit code was also 2014-02-11. This suggests that this
instantiation of the exploit was very recent and was deployed for this
specific strategic Web compromise of the Veterans of Foreign Wars
website. A possible objective in the SnowMan attack is targeting
military service members to steal military intelligence. In addition
to retirees, active military personnel use the VFW website. It is
probably no coincidence that Monday, Feb. 17, is a U.S. holiday, and
much of the U.S. Capitol shut down Thursday amid a severe winter storm.
The ZxShell backdoor is a widely used and publicly available tool
used by multiple threat actors linked to cyber espionage operations.
This particular variant called back to a command and control server
located at newss[.]effers[.]com. This domain currently resolves to
118.99.60.142. The domain info[.]flnet[.]org also resolved to this IP
address on 2014-02-12.
Infrastructure analysis
The info[.]flnet[.]org domain overlaps with icybin[.]flnet[.]org and
book[.]flnet[.]org via the previous resolutions to the following IP addresses:
- 58.64.200.178
- 58.64.200.179
- 103.20.192.4
First Seen | | class="c09_td">Last Seen CnC
Domain | IP |
|---|
2013-08-31 class="c09_td_value is-hidden-mml">2013-08-31 | class="c09_td">
2013-08-31 class="c09_td_value is-hidden-mml">2013-08-31 class="c09_td">
icybin.flnet[.]org class="c09_td_value is-hidden-mml">icybin.flnet[.]org
58.64.200.178 class="c09_td_value is-hidden-mml">58.64.200.178 |
2013-05-02 class="c09_td_value is-hidden-mml">2013-05-02 | class="c09_td">
2013-08-02 class="c09_td_value is-hidden-mml">2013-08-02 class="c09_td">
info.flnet[.]org class="c09_td_value is-hidden-mml">info.flnet[.]org
58.64.200.178 class="c09_td_value is-hidden-mml">58.64.200.178 |
2013-08-02 class="c09_td_value is-hidden-mml">2013-08-02 | class="c09_td">
2013-08-02 class="c09_td_value is-hidden-mml">2013-08-02 class="c09_td">
book.flnet[.]org class="c09_td_value is-hidden-mml">book.flnet[.]org
58.64.200.178 class="c09_td_value is-hidden-mml">58.64.200.178 |
2013-08-10 class="c09_td_value is-hidden-mml">2013-08-10 | class="c09_td">
2013-08-10 class="c09_td_value is-hidden-mml">2013-08-10 class="c09_td">
info.flnet[.]org class="c09_td_value is-hidden-mml">info.flnet[.]org
58.64.200.179 class="c09_td_value is-hidden-mml">58.64.200.179 |
2013-07-15 class="c09_td_value is-hidden-mml">2013-07-15 | class="c09_td">
2013-07-15 class="c09_td_value is-hidden-mml">2013-07-15 class="c09_td">
icybin.flnet[.]org class="c09_td_value is-hidden-mml">icybin.flnet[.]org
58.64.200.179 class="c09_td_value is-hidden-mml">58.64.200.179 |
2014-01-02 class="c09_td_value is-hidden-mml">2014-01-02 | class="c09_td">
2014-01-02 class="c09_td_value is-hidden-mml">2014-01-02 class="c09_td">
book.flnet[.]org class="c09_td_value is-hidden-mml">book.flnet[.]org
103.20.192.4 class="c09_td_value is-hidden-mml">103.20.192.4 |
2013-12-03 class="c09_td_value is-hidden-mml">2013-12-03 | class="c09_td">
2014-01-02 class="c09_td_value is-hidden-mml">2014-01-02 class="c09_td">
info.flnet[.]org class="c09_td_value is-hidden-mml">info.flnet[.]org
103.20.192.4 class="c09_td_value is-hidden-mml">103.20.192.4 |
We previously observed Gh0stRat samples with the custom packet flag
“HTTPS” calling back to book[.]flnet[.]org and icybin[.]flnet[.]org.
The threat actor responsible for href="/content/fireeye-www/en_US/blog/threat-research/2013/09/operation-deputydog-zero-day-cve-2013-3893-attack-against-japanese-targets.html">Operation
DeputyDog also used the “HTTPS” version of the href="http://www.slideshare.net/emcacademics/h11146-thevohocampaignso"
target="_blank">Gh0st. We also observed another “HTTPS” Gh0st
variant connecting to a related command and control server at me[.]scieron[.]com.
MD5 Hash | | class="c09_td">CnC Domain
|---|
758886e58f9ea2ff22b57cbbb015166e class="c09_td_value is-hidden-mml">758886e58f9ea2ff22b57cbbb015166e |
book.flnet[.]org class="c09_td_value is-hidden-mml">book.flnet[.]org |
0294f9280491f85d898ebe471f0fb58e class="c09_td_value is-hidden-mml">0294f9280491f85d898ebe471f0fb58e |
icybin.flnet[.]org class="c09_td_value is-hidden-mml">icybin.flnet[.]org |
9d20566a327076b7152bbf9ed20292c4 class="c09_td_value is-hidden-mml">9d20566a327076b7152bbf9ed20292c4 |
me.scieron[.]com class="c09_td_value is-hidden-mml">me.scieron[.]com |
The me[.]scieron[.]com domain previously resolved to 58.64.199.22.
The book[.]flnet[.]org domain also resolved to another IP in the same
subnet 58.64.199.0/24. Specifically, book[.]flnet[.]org previously
resolved to 58.64.199.27.
Others domain seen resolving to this same /24 subnet were
dll[.]freshdns[.]org, ali[.]blankchair[.]com, and
cht[.]blankchair[.]com. The domain dll[.]freshdns[.]org resolved to
58.64.199.25. Both ali[.]blankchair[.]com and cht[.]blankchair[.]com
resolved to 58.64.199.22.
First Seen | | class="c09_td">Last Seen CnC
Domain | IP |
|---|
2012-11-12 class="c09_td_value is-hidden-mml">2012-11-12 | class="c09_td">
2012-11-28 class="c09_td_value is-hidden-mml">2012-11-28 class="c09_td">
me.scieron[.]com class="c09_td_value is-hidden-mml">me.scieron[.]com
58.64.199.22 class="c09_td_value is-hidden-mml">58.64.199.22 |
2012-04-09 class="c09_td_value is-hidden-mml">2012-04-09 | class="c09_td">
2012-10-24 class="c09_td_value is-hidden-mml">2012-10-24 class="c09_td">
cht.blankchair[.]com class="c09_td_value is-hidden-mml">cht.blankchair[.]com
58.64.199.22 class="c09_td_value is-hidden-mml">58.64.199.22 |
2012-04-09 class="c09_td_value is-hidden-mml">2012-04-09 | class="c09_td">
2012-09-18 class="c09_td_value is-hidden-mml">2012-09-18 class="c09_td">
ali.blankchair[.]com class="c09_td_value is-hidden-mml">ali.blankchair[.]com
58.64.199.22 class="c09_td_value is-hidden-mml">58.64.199.22 |
2012-11-08 class="c09_td_value is-hidden-mml">2012-11-08 | class="c09_td">
2012-11-25 class="c09_td_value is-hidden-mml">2012-11-25 class="c09_td">
dll.freshdns[.]org class="c09_td_value is-hidden-mml">dll.freshdns[.]org
58.64.199.25 class="c09_td_value is-hidden-mml">58.64.199.25 |
2012-11-23 class="c09_td_value is-hidden-mml">2012-11-23 | class="c09_td">
2012-11-27 class="c09_td_value is-hidden-mml">2012-11-27 class="c09_td">
rt.blankchair[.]com class="c09_td_value is-hidden-mml">rt.blankchair[.]com
58.64.199.25 class="c09_td_value is-hidden-mml">58.64.199.25 |
2012-05-29 class="c09_td_value is-hidden-mml">2012-05-29 | class="c09_td">
2012-6-28 class="c09_td_value is-hidden-mml">2012-6-28 class="c09_td">
book.flnet[.]org class="c09_td_value is-hidden-mml">book.flnet[.]org
58.64.199.27 class="c09_td_value is-hidden-mml">58.64.199.27 |
A number of other related domains resolve to these IPs and other IPs
also in this /24 subnet. For the purposes of this blog, we’ve chosen
to focus on those domains and IP that relate to the previously
discussed DeputyDog and Ephemeral Hydra campaigns.
You may recall that dll[.]freshdns[.]org, ali[.]blankchair[.]com and
cht[.]blankchair[.]com were all linked to both href="/content/fireeye-www/en_US/blog/threat-research/2013/09/operation-deputydog-zero-day-cve-2013-3893-attack-against-japanese-targets.html">Operation
DeputyDog and href="/content/fireeye-www/en_US/blog/threat-research/2013/11/operation-ephemeral-hydra-ie-zero-day-linked-to-deputydog-uses-diskless-method.html">Operation
Ephemeral Hydra. Figure 1 illustrates the infrastructure
overlaps and connections we observed between the strategic Web
compromise campaign leveraging the VFW’s website, the DeputyDog, and
the Ephemeral Hydra operations.
width="640" border="0" title="snowman-graph"
style="border-left-width: 0.0px;border-right-width: 0.0px;background-image: none;border-bottom-width: 0.0px;padding-top: 0.0px;padding-left: 0.0px;display: inline;padding-right: 0.0px;border-top-width: 0.0px;"
alt="snowman-graph"
src="/content/dam/legacy/blog/2014/02/snowman-graph_thumb.png" />
Figure 1: Ties between Operation SnowMan, DeputyDog, and
Ephemeral Hydra
Links to DeputyDog and Ephemeral Hydra
Other tradecraft similarities between the actor(s) responsible for
this campaign and the actor(s) responsible for the DeputyDog/Ephemeral
Hydra campaigns include:
- The use of zero-day exploits to deliver a
remote access Trojan (RAT) - The use of strategic web
compromise as a vector to distribute remote access Trojans
- The use of a simple single-byte XOR encoded (0x95) payload
obfuscated with a .jpg extension - The use of Gh0stRat with
the “HTTPS” packet flag - The use of related
command-and-control (CnC) infrastructure during the similar time
frames
We observed many similarities from the exploitation side as well. At
a high level, this attack and the href="/content/fireeye-www/en_US/blog/threat-research/2013/10/aslr-bypass-apocalypse-in-lately-zero-day-exploits.html">CVE-2013-3163
attack both leveraged a Flash file that orchestrated the exploit, and
would call back into IE JavaScript to trigger an IE flaw. The code
within the Flash files from each attack are extremely similar. They
build ROP chains and shellcode the same way, both choose to corrupt a
Flash Vector object, have some identical functions with common
typos, and even share the same name.
Conclusion
These actors have previously targeted a number of different
industries, including:
- U.S. government entities
- Japanese
firms - Defense industrial base (DIB) companies
- Law
firms - Information technology (IT) companies
- Mining
companies - Non-governmental organizations (NGOs)
The proven ability to successfully deploy a number of different
private and public RATs using zero-day exploits against high-profile
targets likely indicates that this actor(s) will continue to operate
in the mid to long-term.
Source:
Operation SnowMan: DeputyDog Actor Compromises US Veterans of Foreign
Wars Website
