# APT17 is run by the Jinan bureau of the Chinese Ministry of State Security

**[intrusiontruth.wordpress.com/2019/07/24/apt17-is-run-by-the-jinan-bureau-of-the-chinese-ministry-of-state-security/](https://intrusiontruth.wordpress.com/2019/07/24/apt17-is-run-by-the-jinan-bureau-of-the-chinese-ministry-of-state-security/)**

intrusiontruth July 24, 2019

In previous articles we identified Jinan Quanxin Fangyuan Technology Co. Ltd. ( 济南全欣方
沅科技有限公司), Jinan Anchuang Information Technology Co. Ltd. (济南安创信息科技有限公
司), Jinan Fanglang Information Technology Co. Ltd. (济南方朗信息科技有限公司) and
RealSOI Computer Network Technology Co. Ltd. (瑞索计算机网络科技有限公司) as
companies associated with Guo Lin (郭林), a likely MSS Officer in Jinan.

We also identified two hackers from Jinan – Wang Qingwei (王庆卫), the representative of
the Jinan Fanglang company and Zeng Xiaoyong (曾小勇) the individual behind the online
profile ‘envymask’.

**ZoxRPC**

The Chinese variant of MS08-067 is particularly interesting because it forms part of a
[hacking tool frequently used by Chinese APT groups called ZoxRPC. This report from](https://www.novetta.com/wp-content/uploads/2014/11/ZoxPNG.pdf)
Novetta details ZoxRPC’s incorporation in its code of specific memory addresses from the
port of MS08-067 to Chinese operating systems (for which envymask takes responsibility).

That is to say, Zeng’s code is used in ZoxRPC.


-----

Novetta report on ZoxRPC evolution
If there were any doubt that it was envymask’s code used in ZoxRPC, have a look at the
code found on pudn[.]com and you will see that it says: ‘MS08067 Exploit for CN by EMM@ph4nt0m.org’.

MS08-067 for China written by envymask aka EMM
**ZoxPNG**


-----

In a timeline analysis, the Novetta report identifies that ZoxRPC was evolved from code
dating back to 2002 and was eventually released in 2008. It was then further developed into
a new tool called ZoxPNG in 2013.

Novetta timeline analysis
A [PwC presentation given at the Kaspersky Security Analyst Summit in 2015 showed that](https://youtu.be/NFJqD-LcpIg)
Chinese hacker Zhang Peng (张鹏) aka ‘missll’ was the author of the newer ZoxPNG variant.

PwC presentation on ZoxPNG
**APT17**

[As FireEye noted in their ‘Hide and Seek’ report, ZoxPNG is also known as BLACKCOFFEE.](https://www.rsaconference.com/writable/presentations/file_upload/crwd-t11-hide_and_seek-how_threat_actors_respond_in_the_face_of_public_exposure.pdf)
[And as V3 showed in their blog article, APT17 aka DeputyDog used BLACKCOFFEE](http://www.informationsociety.co.uk/apt17-deputydog-hackers-are-pushing-blackcoffee-malware-using-technet/)
malware as a key part of multiple campaigns.


-----

V3 blog article on APT17 using BLACKCOFFEE malware
So Zeng wrote the MS08-067 code in ZoxRPC.

And Zhang Peng aka missll evolved it into the APT17 tool ZoxPNG aka BLACKCOFFEE.

Where was Zhang Peng from? Jinan, China.


-----

PWC presentation on missll
In summary:

_Either, one of the authors of code in APT17’s primary malware just happens to be associated_
with a series of Cyber Security outfits that claim the MSS as their clients and are
coincidentally managed by an MSS Officer.

_Or, MSS Officer Guo Lin of the Jinan bureau of the Ministry of State Security manages_
**APT17.**

**#thereismore…**


-----