Operation Ke3chang, Chinese hackers target Indian Embassies
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2015-2545 | Malformed EPS Image RCE in Microsoft Office Microsoft Office fails to properly validate Encapsulated PostScript (EPS) images embedded in documents (CWE-20, improper input validation), and processing a specially crafted EPS image can allow arbitrary code execution. The flaw is triggered when a victim opens an Office document—typically delivered via email—that contains the malicious EPS image, with no user interaction beyond opening the file. Successful exploitation gives the attacker code execution with the privileges of the logged-in user, a technique espionage groups targeting embassies, government entities and the Indian subcontinent (e.g., Patchwork, Ke3chang-related campaigns) have used to deliver backdoors such as the BADNEWS RAT. Any organization running Microsoft Office builds that lack the relevant Office updates is affected, with historically exposed populations concentrated in government and diplomatic networks using legacy Office. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-03) and carries a very high EPSS (~86%), indicating active exploitation despite the fix being available since 2015. Do: Apply the Microsoft Office security update from the September 2015 Patch Tuesday (MS15-099) or upgrade to a currently supported Office version, per the vendor instructions required by the KEV catalog, and audit environments running legacy Office builds that no longer receive routine updates. Exercise caution with emailed Office documents containing embedded EPS images and prioritize remediation for government, diplomatic and other espionage-targeted networks. | — | 86% | KEV |
| masshundreds of millions of Office installations worldwide; the unpatched legacy subset is likely in the 100k+ systems range (estimate) |
Full article455 words · extracted from securityaffairs.com · click to collapse
Security experts from PaloAlto Networks collected evidence that the Operation Ke3chang discovered by FireEye in 2013 is still ongoing.
Back in 2013, the security researchers at FireEye spotted a group of China-Linked hackers that conducted an espionage campaign on foreign affairs ministries in Europe. The campaign was named ‘Operation Ke3chang,’ now threat actors behind the attacks were spotted targeting personnel at Indian embassies across the world.
The researchers speculate the threat actors behind the Operation Ke3chang had been active since at least 2010, and the bad news is that they are still active. The attackers evolved their arsenal over the time, initially, they had been using three different strains of malware codenamed by BS2005, BMW, and MyWeb.
Recently security experts at Palo Alto Networks detected a new piece of malware, dubbed ‘TidePool,’ that seems to be linked to the group’s activity in the ongoing attacks against the Indian embassies.
The hackers launched spear phishing attacks leveraging on an annual report filed by more than 30 Indian embassies as a decoy. The attackers used spoofed email addressed to send out the malicious email.
The phishing attacks relied on email with attached an MHTML document that was specifically crafted to trigger the Microsoft Office vulnerability (CVE-2015-2545) and drop the TidePool malware.
The malware implements RAT features and presents many similarities with the BS2005, but it appears to be its evolution.
“We’ve discovered a new malware family we’ve named TidePool. It has strong behavioral ties to Ke3chang and is being used in an ongoing attack campaign against Indian embassy personnel worldwide.” reads a report published by Palo Alto Networks. “TidePool contains many capabilities common to most RATs. It allows the attacker to read, write and delete files and folders, and run commands over named pipes”
The experts from the Unit 42 noticed that the TidePool and BS2005 malware share 11 similar registry modifications, they implement the same C2 obfuscation and use the same set of library functions.
“These samples are quite similar when looking at the library functions used, but the most notable features they have in common are the timeline of behaviors executed. Ke3chang and TidePool both modify the IEHarden registry key, as well as the following list of keys. ” continues the report.
The experts noticed that the binaries included resources, encoding was 0x04 (LANG_CHINESE) indicating the systems used by the attackers are likely running a software with Chinese as the default display language.
India is the country with the largest number of infections, a circumstance that highlights the country is a high priority target for the attackers.
The experts closed the report confirming that the Operation Ke3chang is still ongoing and the malware factory is producing new evolving threats.
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/47620/cyber-crime/operation-ke3chang.html