## D U S O P E R AT I O TTTTTN S T O R MMMMM[T] ###### By Jon Gross and ## D U S O P E R AT I O TTTTTN S T O R MMMMM[T] ###### By Jon Gross and the Cylance SPEAR™ Team ----- #### “Nothing strengthens authority so much as #### silence.” ###### -Leonardo da Vinci ###### 01 Executive Summary 01 The Early Days: Spear Phishing 03 Identity Crisis: Zero-Day Attacks 04 Into the Future: Japanese Targets 05 Here and Now: Companies Compromised 06 Conclusion 07 Implant Analysis: 07 Misdat Backdoor (2010-2011) 10 MiS-Type Hybrid Backdoor (2012) 13 S-Type Backdoor (2013-2014) 16 Zlib Backdoor (2014-2015) ###### EXECUTIVE SUMMARY Cylance SPEAR has uncovered a long-standing persistent threat targeting numerous major industries spread across Japan, South Korea, the United States, Europe, and several other Southeast Asian countries. Power comes in many forms Our research indicates Operation Dust Storm has been operational since at least early 2010, and has employed a number of different operational techniques, including spear phishing, waterholes, and zero-day exploits over time. Several antivirus companies initially detected early backdoor samples under the moniker Misdat, but the group has quietly evolved over the years to remain undetected and highly effective. Attack telemetry in 2015 indicates the Dust Storm group has migrated from more traditional government and defense-related intelligence targets to exclusively seek out organizations involved in Japanese critical infrastructure and resources. The group recently compromised a wide breadth of victims across the following industry verticals: electricity **generation, oil and natural gas, finance, transportation,** **and construction. SPEAR’s current research indicates** the group’s present focus has shifted to specifically and exclusively target Japanese companies or Japanese subdivisions of larger foreign organizations. ###### The Early Days: Spear Phishing The earliest indications of the group’s activities stem from the compile times of the executable resource section of Misdat samples. All of the early backdoor samples were compiled using a version of Delphi which notoriously mangles the compilation timestamp of the file to June 19, 1992 22:22:17 UTC. By using the executable resource section timestamp, SPEAR was able to more accurately gauge the actual compile times of these samples, and traced one of them, "bc3b36474c24edca4f063161b25bfe0c90b378b9c19c”, to January 2010.[1] ###### 21 Appendix 1 During analysis of older command and control infrastructure, there were several domains that resolved to known malicious IP addresses in September 2009 However SPEAR was not able to corroborate these dates in any known malware samples able to more accurately gauge the actual compile times of these samples, and traced one of them, "bc3b36474c24edca4f063161b25bfe0c90b378b9c19c”, to January 2010.[1] ----- Very little public information was available throughout 2010 on this threat, despite the group’s primary backdoor gaining some level of prominence in targeted Asian attacks. This may be explained by the group’s early reliance on Dynamic DNS domains for their command and control (C2) infrastructure, as well as their use of public RATs like Poison Ivy and Gh0st RAT for second-stage implants. The actors relied heavily on the free Dynamic DNS providers No-IP (http://www.noip.com), Oray (http:// www.oray.com/) and 3322 (http://www.pubyun.com/) for their infrastructure continuing into 2011; the earliest known backdoors SPEAR identified communicated to “323332.3322.org” and “1stone.zapto.org”. It wasn’t until June 2011 that Operation Dust Storm started to garner some notoriety from a series of attacks which leveraged an unpatched Internet Explorer 8 vulnerability, CVE-2011-1255, to gain a foothold into victim networks. In these attacks, a link to the exploit was sent via a spear phishing email from a purported Chinese student seeking advice or asking the target a question following a presentation. Media coverage of these attacks included “http://www.symantec.com/connect/ blogs/inside-back-door-attack”,[2] and “http://asec.ahnlab. com/730” which named the early backdoor variants “Misdat”. The secondary C2 server from Symantec’s writeup was mentioned in news reports elsewhere as “honeywells.tk”; this domain resolved to “111.1.1.66” during early June 2011. This address is coincidentally the same IP address that one of the earliest Misdat samples that SPEAR identified beaconed to during the same timeframe. A paper published in August 2011 by Ned Moran via Usenix (https://www.usenix.org/system/files/login/articles/ 105484-Moran.pdf) described in detail an attack by this used the domain “mail.glkjcorp.com” to deliver the exploits, and the domain was hosted on the IP address “114.108.150.38” at the time of the attack. SPEAR was unable to definitively tie this particular exploit site to a watering hole or phishing campaign, however, numerous other CN-APT operators leveraged the Internet Explorer zero-day during the same period using both techniques. The exploit domain “glkjcorp.com” was registered shortly before the attack on May 24, 2012. Two different emails were used in the registration of this domain: “effort09 (at) hotmail.com” and “zaizhong16 (at) 126.com”. This attack was the first to use the file “DeployJava. js” to fingerprint installed software on victim systems prior to delivery and ensure a known effective exploit was deployed. This JavaScript file was first used and documented by Ahnlab a month earlier in the Gong Da Exploit Kit: http://www.ahnlab.com/kr/site/ securityinfo/secunews/secuNewsView.do?menu_ dist=2&seq=19418. The “DeployJava.js” worked in conjunction with another script embedded in the exploit page, to deliver the Flash exploit if the version of IE was 8 or 9 or deliver the IE zero-day if the version of IE was 6 or 7. threat group during April 2011. The attack was initiated by a spear phishing email that contained a Word document embedded with a zero-day Flash exploit (CVE-2011-0611). The final payload described in the report matched other confirmed Misdat samples, and beaconed to “msejake.7766. org”, which first resolved to “125.46.42.221”, then later to “218.106.246.220” at the time of the attack. As to other documented cases, the attacker started interacting with the infected machine within minutes of compromise to begin manual network and host enumeration. In October 2011, the group attempted to take advantage of the ongoing Libyan crisis at the time and phish the news cycle regarding Muammar Gaddafi’s death on October 20, 2011. It appears that in addition to some US defense targets, this campaign was also directed at a Uyghur mailing list. This time, the group used a specially crafted malicious Windows Help (.hlp) file, which exploited CVE2010-1885. The hlp files, when opened, would execute a piece of JavaScript code via “mshta.exe”, which in turn launched a second piece of Visual Basic Script using the Windows scripting host. This secondary piece of VBS code was then responsible for decoding the payload from the body of the hlp file and executing it. The first stage payloads used in these attacks were Misdat variants stored base64 encoded within the hlp file. The samples SPEAR identified both communicated to the domain “msevpn.3322.org”, which resolved to the IP address “218.106.246.195” at that time. Pivoting off of this IP address yielded several additional dynamic DNS domains that were used for command and control, as well as several standard domains that were used by the group from May 2010 up until December 2015. Early infrastructure for the 2010-2011 timeframe used by the group relied heavily on two email addresses, "wkymyx (at) 126.com” and “duomanmvp (at) 126.com”, for domain registration. The attackers typically used either seemingly random four-character subdomains or common words like image, blog, ssl, pic, mail, news, etc. There was also evidence to suggest this group attempted to gather user credentials for Yahoo, Windows Live and other accounts through several different phishing domains during July and August 2011. While SPEAR was unable to recover the original pages served, the domains these pages were hosted on are: “login.live.adobekr.com”, “login.live.wih365.com”, and “yahoomail.adobeus.com”. Individual IP address resolutions for each of the domains were generally shortlived, with none of them lasting more than a month. ###### Identity Crisis: Zero-Day Attacks SPEAR identified another Operation Dust Storm campaign in June 2012 that leveraged both CVE-2011-0611, a Flash exploit the group had used previously, and CVE2012-1889, an Internet Explorer zero-day. The attackers ``` if (((i9> -1) ||(i8> -1))&&w7>-1&&ja){ ###### flash.Movie = vars; } else if((i8>-1)&&(xp>-1)){ flash.Movie = vars; } else if((i6>-1||i7>-1)&&(xp>-1)){ document.body.innerHTML+=”<\/ob- ject>”; setTimeout(“document.body.innerHTML+=\”