Winnti is Coming - Evolution after Prosecution@HITCON2021 Archived: 2026-04-06 01:14:32 UTC Since APT41 was sued by the FBI last year, the group has not disappeared. Instead, they have used more innovative and less well noticed techniques to evade detection by security products, such as: - Avoiding memory detection through dll hollowing technique - Using DPAPI to encrypt the real payload to make forensics more difficult. - Abusing the certificate to hide the payload in a signed PE file. - Using domain fronting techniques to hide the real IP address. - Using legitimate tools like InstallUtil to execute code and bypass application whitelisting. In addition to malware that is known to be used by APT41 , we also found some newly developed malware. There are two new pieces of listening port malware.We also found a shellcode-based backdoor, Natwalk. The group is also more careful in their usage of C2. They use DNS tunnelling extensively as well as Cloudflare Worker to hide their real C2 IP. We have observed that APT41 targeted telecommunications companies, key medical institutions, governments, and major infrastructures in various countries in 2021. The prosecution did not deter them, but instead prompted them to evolve their attack techniques, and make it harder for researchers to track and detect. In this talk we will provide more details about the campaigns of APT41 , including its innovative TTPs, newly developed malware, lateral movement techniques, and the strategies they used for C2 after they were sued by the FBI. We also research the relation of the subgroups under APT41, like fishmaster and GroupCC. Transcript 1. Winnti is Coming - Evolution after Prosecution TeamT5 2. 3. 4. Who is Winnti? 4 https://twitter.com/jfslowik/status/1420924040047337474 https://speakerdeck.com/aragorntseng/winnti-is-coming-evolution-after-prosecution-at-hitcon2021 Page 1 of 8 5. Winnti? APT41? 5 Ministry of State Security of the People's Republic of China(MSS) • Winnti = APT41 ? • APT41 = Chengdu404 ? • Under APT41, it can be divided into several groups via different techniques and targets • The targets are very wide. It is suspected that MSS has integrated the resources, attack techniques, and tools to make this group looks bigger. APT41 APT10 APT17 APT… Integration? Fishmaster /TAG-22 GroupCC Amoeba Unknown Group … 6. Target Country Talk in last section 6 7. 8. Compromise Winnti is Coming - Evolution after Prosecution 9. 10. Webshell Access 10 11. Probe plugin 11 12. Webshell Upload 12 13. Catalina Log 13 14. 15. 16. Post-Compromise Winnti is Coming - Evolution after Prosecution 17. 18. Timeline for disseminating the Cobalt Strike 2020.7 2020.11 2021.1 2021.3 2021.4 Chacha20 shellcode or loader(Chatloader) appeared to extract Cobalt strike Beacon Use CDN service in Cobalt Strike, especially DNS beacon Use Cloudflare worker to hide real C2 IP Use certificate bypass and dll hollowing technique in Chatloader Use multiple .NET loaders and misuse InstallUtil to load Cobalt Strike 2021.6 Use funnyswitch to load Cobalt Strike and use early bird code injection technique 18 19. 20. Chatloader ◆ Uses chacha20 algorithm to decrypt the payload ◆ Most of the payload is Cobalt Strike, but we have also seen another backdoor ◆ ETW bypass ◆ Dll hollowing offset length data 0x0:0xB 0xC config nonce 0xC:0xF 0x4 config crc32 0x10:0x13 0x4 config_enc_length 0x14:0x14+config_enc _length config_enc_length ciphertext 0x100:0x120 0x20 config key 20 21. length data 0x4 Header 0x4 Check User is SYSTEM 0x4 https://speakerdeck.com/aragorntseng/winnti-is-coming-evolution-after-prosecution-at-hitcon2021 Page 2 of 8 Mutex trigger 0x4 Delete Loader trigger 0x4 Patch EtwEventWrite trigger 0x4 Process Hollowing trigger 0x4 Injected Process Name Length(x2) InjectedProcess Name Length(x2) InjectedProcess Name 0x4 Payload in Loader 0x4 Payload Name Length(x2) Payload Name Length(x2) Payload Name 0x4 Payload Size 0x4 Payload FilePointor 0x4 Payload crc32 0xC Payload Nonce length data 0x4 Header 0x4 Check User is SYSTEM 0x4 Mutex trigger 0x4 Delete Loader trigger 0x4 Patch EtwEventWrite trigger 0x4 Payload in Loader 0x4 Payload Name Length(x2) Payload Name Length(x2) Payload Name 0x4 Payload Size 0x4 Payload FilePointor 0x4 Payload crc32 0xC Payload Nonce Header:CB2F29AD Header:8BD6488B 21 22. Chatloader config example ====== Decrypt Config ====== Config Nonce (12 bytes) = 0xb5 0x5e 0x14 0x8d 0x46 0xe1 0x2e 0x97 0x5d 0x3d 0x75 0xf1 Config Nonce (base64) = tV4UjUbhLpddPXXx Config CRC32 = 0xe 0xdc 0xac 0xad Config CRC32 (base64) = DtysrQ== Ciphertext length = 48 Config Key = 0xa2 0x42 0x99 0x5 0x5f 0x1f 0xc 0x14 0xcb 0xdd 0xb 0x1 0xdf 0xa6 0x4c 0x34 0xf5 0xfd 0x3 0x3c 0xa7 0xf1 0xaf 0x30 0xa0 0xc7 0x5c 0x57 0x35 0x9d 0x41 0xe0 Config Key (base64) = okKZBV8fDBTL3QsB36ZMNPX9Azyn8a8woMdcVzWdQeA= ====== Config ====== Head = 0xad 0x29 0x2f 0xcb Check User is SYSTEM = 0 Mutex trigger = 0 Delete Loader trigger = 0 Patch EtwEventWrite trigger = 1 Payload in Loader = 0 Payload Name Length = 14 Payload Name = Despxs.dll Payload Size = 3f800 Payload FilePointor = 0 Payload CRC32 = 0x40 0xf6 0x8f 0xa7 Payload Nonce (12 bytes) = 0x93 0x49 0x68 0x79 0x6a 0xda 0xb5 0xcf 0xf0 0xf1 0xb3 0x4f 22 23. 24. Dll Hollowing (cont.) https://github.com/forrest-orr/phantom-dll-hollower-poc 24 25. 26. .NET loader structure offset data offset 38(h) – 47 md5 hash of offset 48 until end offset 48-53 Sha256 as AES key offset 54-67 MD5 as AES IV offset 68 - end Encrypted payload with AES(ECB) offset data offset 0-3 must be 1F A4 3A AC offset 4-7 the length of the payload offset 8 - end malware payload Version 2.63 offset Data offset 84(h) -93 md5 hash of offset 48 until end offset 94-9f Sha256 as AES key offset a0-ab MD5 as AES IV offset ac - end Encrypted payload with AES(ECB) offset data offset 0-3 must be 0C C0 73 95 offset 4-7 the length of the payload offset 8 - end malware payload Version 17.102 After decryption 26 27. Funnyswitch loader ◆ Name from ptsecurity*, which will inject .NET backdoor funny.dll in memory ◆ We found new version loader(mcvsocfg.dll) which may target McAfee user ◆ E:\VS2019_Project\while_dll_ms\whilte\x64\Release\macoffe.pdb ◆ Another : E:\\VS2019_Project\\prewhiltedll\\x64\\Release\\prewhiltedll.pdb ◆ We found the new loader inject Cobalt Strike and funny.dll *https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41- backdoors-old-and-new/ Cobaltstrike funnydll 27 28. https://speakerdeck.com/aragorntseng/winnti-is-coming-evolution-after-prosecution-at-hitcon2021 Page 3 of 8 29. Early bird code injection Loader ◆ Using open source Alaris loader* to use syscalls to run cobalt strike ◆ Load PNG resource as payload and decrypt with RC4 ◆ Using Detour to hook the Freelibrary API of the launcher ◆ Using early bird code injection technique ◆ NtTestAlert ◆ KiUserApcDispatcher *https://github.com/cribdragg3r/Alaris 29 30. 31. 32. loader used by GroupCC 32 Signed file Temp.tmp winprint.exe rundll32.exe 2.Create rundll32.exe Process 1.Read File binary Stage_1.shellcode 4.Read File 5.decode cobaltstrike 3.Inject shellcode in rundll32 • winprint.exe first reads a piece of shellcode from the payload file and then opens rundll32.exe, calls RtlCreateUserThread to run the first stage shellcode in rundll32.exe • The first stage shellcode will read the payload file again, use VirtualAlloc to allocate memory in rundll32.exe, and inject the payload and decrypt it, finally, it will call EtwpCreateEtwThread to move the thread to the starting point of the cobalt strike. GroupCC 33. Backdoor Winnti is Coming - Evolution after Prosecution 34. 35. 36. 37. Shadowpad ◆ APT41 used the new builder of shadowpad in 2021, which was mentioned in Ptsecurity’s report* which used new obfuscation method and decryption method for configuration ◆ We think this builder was a shared Tool, because we have also seen Naikon Team use this builder ◆ Md5 of the loader:3520e591065d3174999cc254e6f3dbf5 37 def decrypt_string(src): key = struct.unpack("