Chinese SharpPanda APT developed a new backdoor in the last 3 years
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-11882 | Memory Corruption RCE in Microsoft Office via Legacy Equation Editor CVE-2017-11882 is a memory corruption vulnerability (CWE-119) in Microsoft Office, residing in the legacy Microsoft Equation Editor component (EQNEDT32.EXE), that allows remote code execution in the context of the current user. Attackers trigger it by persuading a user to open a crafted document, most commonly an RTF file or other Office document carrying a malicious embedded equation object, which overflows a buffer while the equation content is parsed. Successful exploitation lets the attacker run arbitrary code with the privileges of the signed-in user, a typical foothold for malware delivery and, per CISA, for ransomware operations. Any environment running affected Microsoft Office builds is exposed; the source data does not enumerate specific affected version ranges. The flaw is confirmed exploited in the wild: it was added to the CISA Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use and holds a 99.9% EPSS score (percentile 100), though the source data lists no public PoC. Do: Apply Microsoft's Office security updates (November 2017 or later) across all endpoints, prioritizing this KEV-listed flaw given its known ransomware use. On systems that cannot yet be patched, disable or unregister the legacy Equation Editor (EQNEDT32.EXE) and consider blocking or warning on RTF attachments as interim mitigations. Check for indicators of abuse such as EQNEDT32.EXE spawning unexpected child processes after document opens. | 7.8 | 100% | KEV ransomware PoC ×10 |
| masshundreds of millions of users/installations (Office is near-ubiquitous on Windows and in enterprises; the share still unpatched is unknown) | |
| CVE-2018-0798 +1 in the same advisory: …0802 | Memory Corruption RCE in Microsoft Office Equation Editor (CVE-2018-0798) CVE-2018-0798 is a memory corruption flaw (out-of-bounds write, CWE-787) in the Microsoft Equation Editor component of Microsoft Office 2007, 2010, 2013, and 2016 that allows remote code execution when the component mishandles objects in memory. A remote attacker triggers it by persuading a user to open a specially crafted document containing a maliciously embedded equation; user interaction is required and no privileges are needed (CVSS vector AV:N/AC:L/PR:N/UI:R). Successful exploitation lets the attacker run arbitrary code in the context of the current user, with high impact on confidentiality, integrity, and availability (CVSS 3.1 score 8.8). Any organization running the affected legacy Office versions — including deployments using the Office Compatibility Pack — is exposed, with government, military, and transportation organizations named in related reporting on Office-document attack campaigns. Exploitation is confirmed: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03, and its EPSS score of 95.1% (100th percentile) indicates a very high probability of active exploitation, with related headlines highlighting APT activity (notably the Bitter group's campaigns against military targets in South Asia) around Office document threats. Do: Apply Microsoft's security updates for this vulnerability across Office 2007, 2010, 2013, 2016 and the Office Compatibility Pack, per vendor instructions as required by CISA KEV, and upgrade off legacy Office 2007/2010 to a still-supported release since those versions no longer receive regular fixes. Enforce caution with untrusted Office documents (don't open unsolicited attachments or embedded equations from unknown sources) and consider stripping or blocking embedded OLE equation objects from external files. Prioritize patching for government, military, and transportation-sector environments given active APT targeting of those sectors via Office documents. | 8.8 group max | 95% | KEV |
| masshundreds of millions of Office users/endpoints worldwide |
Full article669 words · extracted from securityaffairs.com · click to collapse
Check Point Research (CPR) said that the Chinese APT group SharpPanda spent three years developing a new backdoor to spy on Asian governments.
Researchers from Check Point Research (CPR) discovered a new backdoor while investigating a cyber espionage campaign conducted by Chinese APT group SharpPanda and aimed at Southeast Asian government’s Ministry of Foreign Affairs.
The attackers use spear-phishing messages and leverage exploits for old Microsoft Office vulnerabilities, along with the chain of in-memory loaders to deliver a previously unknown backdoor on target’s machines.
The spear-phishing messages impersonate departments of the targeted governments.
“Our investigation shows the operation was carried out by what we believe is a Chinese APT group that has been testing and refining the tools in its arsenal for at least 3 years.” reads the analysis published by CheckPoint. “The investigation starts from the campaign of malicious DOCX documents that are sent to different employees of a government entity in Southeast Asia. In some cases, the emails are spoofed to look like they were from other government-related entities. The attachments to these emails are weaponized copies of legitimate looking official documents and use the remote template technique to pull the next stage from the attacker’s server.”
Upon opening the bait files, the malicious code loads remote .RTF templates weaponized using a variant of a tool named RoyalRoad, which is commonly used by Chinese APT groups The tool was used by the Chinese threat actors to create weaponized documents with embedded objects that exploit the Equation Editor vulnerabilities of Microsoft Word. Despite the fact that these vulnerabilities are few years old, they are still used by multiple attack groups, and especially popular with Chinese APT groups.
The documents generated by the tool exploit a set of vulnerabilities in Microsoft Word’s Equation Editor, including CVE-2017-11882, CVE-2018-0798, and CVE-2018-0802.
All the documents created with the RoyalRoad RTFs include encrypted payload and shellcode. The encrypted payload creates a scheduled task and checks the presence of a sandbox before starting the process to drop the final custom backdoor (VictoryDll_x86.dll).
The backdoor supports multiple functions that allow to spy on the victims and steal sensitive data, including:
- Delete/Create/Rename/Read/Write Files and get files attributes
- Get processes and services information
- Get screenshots
- Pipe Read/Write – run commands through cmd.exe
- Create/Terminate Process
- Get TCP/UDP tables
- Get CDROM drives data
- Get registry keys info
- Get titles of all top-level windows
- Get victim’s computer information – computer name, user name, gateway address, adapter data, Windows version (major/minor version and build number) and type of user
- Shutdown PC
The backdoor sends stolen data back to the C2 that could be used to deliver additional malware. Experts noticed that first-stage C2 servers are hosted in Hong Kong and Malaysia, while the C2 for the final backdoor is hosted by a US provider.
The threat actor operates the C&C servers in a limited daily window (1.00 am — 8.00 am UTC), making it harder to gain access to the advanced parts of the infection chain.
Checkpoint researchers also reported that samples of the threat were uploaded to VirusTotal from China in 2018, they contained connectivity checks with Baidu’s web address, a circumstance that suggests the involvement of China-linked APT. The C2 servers did not return any payload specifically between May 1st and 5th which is the period when the Labor Day holidays in China took place.
“We unveiled the latest activity of what seems to be a long-running Chinese operation that managed to stay under the radar for more than 3 years. In this campaign, the attackers utilized the set of Microsoft Office exploits and loaders with anti-analysis and anti-debugging techniques to install a previously unknown backdoor.” concludes the report.
“Analyzing the backdoor’s code evolution since its first appearance in the wild showed how it transformed from a single executable to a multi-stage attack, making it harder to detect and investigate.”
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, SharpPanda APT)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/118652/apt/sharppanda-apt-backdoor.html