Security researcher says attacks on Russian government have Chinese fingerprints – and typos, too
(2021/06/09)
- Reference: 1623220205
- News link: https://www.theregister.co.uk/2021/06/09/mail_o_malware_maybe_chinese/
- Source link:
An advanced persistent threat that Russia found inside government systems was too crude to have been the work of a Western nation, says security researcher Juan Andrés Guerrero-Saade of Sentinel Labs, before suggesting the malware came from a Chinese entity.
Russian telco and IT services provider Rostelecom and the nation's National Coordination Center for Computer Incidents, an arm of the Russian Federal Security Service (FSB), in May published a joint [1]report that detailed their assessment of attacks on several Russian government entities detected in 2020.
The report said the attacks were made using malware named "Mail-O" and asserted that attackers used cloud storage services provided by Russian companies Yandex and Mail.ru Group. The malware mimicked legitimate cloud storage management apps Disk-O and Yandex Disk.
[2]
Guerrero-Saade [3]wrote that he feels the security industry has quickly defaulted to a view that Western actors were behind the attacks.
[4]
[5]
"I think we'll be relieved to find out that was most likely not the case – if solely because we've come to expect a higher standard for Western malware development," he wrote.
Guerrero-Saade reached that opinion after assessing samples of Mail-O and suggesting it is "a variant of a relatively well-known malware called PhantomNet or SManager used by a threat actor 'TA428'."
[6]
The researched makes that assertion because Mail-O, PhantomNet and SManager all share a function called "Entery" that he supposes is a misspelling of "Entry".
"Misspellings are a true gift for malware researchers," Guerrero-Saade wrote.
[7]Feds seize two domains used by SolarWinds intruders for malware spear-phishing op
[8]Russian gang behind SolarWinds hack returns with phishing attack disguised as mail from US aid agency
[9]It was Russia wot did it: SolarWinds hack was done by Kremlin's APT29 crew, say UK and US
[10]Ahem, Huawei, your USB LTE stick has a vuln. I SAID AHEM, Huawei, are you listening?
TA428, he added, has a history of attacking Russian and south-east Asian targets and is credibly assessed as having Chinese origins.
"These presumably Chinese clusters of activity are confusing and difficult to disentangle," he admitted. "Tooling is likely shared among multiple threat actors (likely including PhantomNet/SManager), and what's being referred to as 'TA428' is probably an amalgam of multiple threat groups."
Wherever it came from, Mail-0 is nasty. The software "acts as a downloader with a thin veneer of similarity to the legitimate Mail.ru Disk-O software" and disguises itself using a legitimate Disk-O version number. Once it infects a machine, the malware downloads a payload and creates the "Entery" function, then downloads a third piece of software that the Russian report claims attempts to subvert email accounts and exfiltrate documents. ®
Get our [11]Tech Resources
[1] https://rt-solar.ru/analytics/reports/2203/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YMCRQ0oNtLJQrkELRj-BwwAAAMs&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://labs.sentinelone.com/thundercats-hack-the-fsb-your-taxes-didnt-pay-for-this-op/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YMCRQ0oNtLJQrkELRj-BwwAAAMs&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YMCRQ0oNtLJQrkELRj-BwwAAAMs&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YMCRQ0oNtLJQrkELRj-BwwAAAMs&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2021/06/02/feds_seize_nobelium/
[8] https://www.theregister.com/2021/05/28/solar_winds_attacker_nobelium_returns/
[9] https://www.theregister.com/2021/04/15/solarwinds_hack_russia_apt29_positive_technologies_sanctions/
[10] https://www.theregister.com/2021/06/02/huawei_lte_usb_stick_vulnerability/
[11] https://whitepapers.theregister.com/
Russian telco and IT services provider Rostelecom and the nation's National Coordination Center for Computer Incidents, an arm of the Russian Federal Security Service (FSB), in May published a joint [1]report that detailed their assessment of attacks on several Russian government entities detected in 2020.
The report said the attacks were made using malware named "Mail-O" and asserted that attackers used cloud storage services provided by Russian companies Yandex and Mail.ru Group. The malware mimicked legitimate cloud storage management apps Disk-O and Yandex Disk.
[2]
Guerrero-Saade [3]wrote that he feels the security industry has quickly defaulted to a view that Western actors were behind the attacks.
[4]
[5]
"I think we'll be relieved to find out that was most likely not the case – if solely because we've come to expect a higher standard for Western malware development," he wrote.
Guerrero-Saade reached that opinion after assessing samples of Mail-O and suggesting it is "a variant of a relatively well-known malware called PhantomNet or SManager used by a threat actor 'TA428'."
[6]
The researched makes that assertion because Mail-O, PhantomNet and SManager all share a function called "Entery" that he supposes is a misspelling of "Entry".
"Misspellings are a true gift for malware researchers," Guerrero-Saade wrote.
[7]Feds seize two domains used by SolarWinds intruders for malware spear-phishing op
[8]Russian gang behind SolarWinds hack returns with phishing attack disguised as mail from US aid agency
[9]It was Russia wot did it: SolarWinds hack was done by Kremlin's APT29 crew, say UK and US
[10]Ahem, Huawei, your USB LTE stick has a vuln. I SAID AHEM, Huawei, are you listening?
TA428, he added, has a history of attacking Russian and south-east Asian targets and is credibly assessed as having Chinese origins.
"These presumably Chinese clusters of activity are confusing and difficult to disentangle," he admitted. "Tooling is likely shared among multiple threat actors (likely including PhantomNet/SManager), and what's being referred to as 'TA428' is probably an amalgam of multiple threat groups."
Wherever it came from, Mail-0 is nasty. The software "acts as a downloader with a thin veneer of similarity to the legitimate Mail.ru Disk-O software" and disguises itself using a legitimate Disk-O version number. Once it infects a machine, the malware downloads a payload and creates the "Entery" function, then downloads a third piece of software that the Russian report claims attempts to subvert email accounts and exfiltrate documents. ®
Get our [11]Tech Resources
[1] https://rt-solar.ru/analytics/reports/2203/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YMCRQ0oNtLJQrkELRj-BwwAAAMs&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://labs.sentinelone.com/thundercats-hack-the-fsb-your-taxes-didnt-pay-for-this-op/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YMCRQ0oNtLJQrkELRj-BwwAAAMs&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YMCRQ0oNtLJQrkELRj-BwwAAAMs&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YMCRQ0oNtLJQrkELRj-BwwAAAMs&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://www.theregister.com/2021/06/02/feds_seize_nobelium/
[8] https://www.theregister.com/2021/05/28/solar_winds_attacker_nobelium_returns/
[9] https://www.theregister.com/2021/04/15/solarwinds_hack_russia_apt29_positive_technologies_sanctions/
[10] https://www.theregister.com/2021/06/02/huawei_lte_usb_stick_vulnerability/
[11] https://whitepapers.theregister.com/
"too crude to have been the work of a Western nation"
Pascal Monett
But good enough to have infiltrated Russian government IT.
I like that they say that Western malware is of better quality. It's like these guys are playing a game.
werdsmith
I'm sure that putting in a few typos and some crude work typical of the ones used by some other criminal nationalities would be a very simple way of throwing some investigators off the trail.
Negative Charlie
> I'm sure that putting in a few typos and some crude work typical of the ones used by some other criminal nationalities would be a very simple way of throwing some investigators off the trail.
Oh yes, definately.
attacks on Russian government have Chinese fingerprints
which means it's probably the US agencies who done it. Or Chinese, who want to pass for the US agencies :)