Cuckoo Spear [B-Side]

Key takeaways

APT-10 has been active since 2006, using advanced tactics and evolving malware like LoadInfo and Noopdoor.
The malware employs sophisticated persistence mechanisms allowing it to remain undetected for years within enterprise networks.
Spear phishing and firewall vulnerabilities are primary methods of initial infiltration for APT-10.
APTs exhibit signs of significant resource allocation and operational planning, often adhering to defined 'working hours'.
Domain Generation Algorithms are employed by APTs to complicate network defenses and maintain communications.

Summary

Introduction to the Cuckoo Spear Campaign

The episode starts with the host, Ron Levy, introducing the B-side episode format where he interviews guests on less narrative-driven topics. This episode focuses on APT-10, a Chinese nation-state threat actor, and their espionage campaign targeting Japanese companies, notably using the backdoor malware LoadInfo. Ron introduces researchers Jean Ito and Luigi Castell from Cybereason's incident response team, who share their findings on APT-10's techniques and tools.

Insight into LoadInfo and Noopdoor Malware

Jean and Luigi describe LoadInfo as a sophisticated backdoor malware used by APT-10, providing extensive capabilities such as executing arbitrary commands and data exfiltration. The malware has been evolving since it was first used and has recently been replaced by Noopdoor, a more sophisticated version capable of evading detection and maintaining persistence within enterprise networks for extended periods.

Persistence Mechanisms and Attack Techniques

The discussion details various persistence mechanisms exploited by the malware, such as Task Scheduler, MSBuild, and WMI (Windows Management Instrumentation). The researchers describe how load info maintains a presence on compromised networks, explaining the techniques used for lateral movement and malware installation without leaving traditional disk evidence.

Infiltration Methods and Threat Actor Behavior

Emphasizing how APT-10 gains initial access, the researchers detail that spear phishing and vulnerabilities in popular VPN solutions served as methods of infiltration. They share insights into the operational behaviors of APT-10, which includes working within office hours and demonstrating a resource-rich environment that allows for sophisticated attacks.

Analysis of APT-10's Tactics, Tools, and Threat Landscape

The researchers explain the broader context of APT-10, noting its focus on Japan through the Cuckoo Spear campaign while also indicating its global reach. They emphasize the unique adaptations and tools APT-10 utilizes for evasion and persistence, including Domain Generation Algorithms to obscure command and control communications.

Show notes

APT-10 is a Chinese nation-state threat actor that in recent years has been targeting Japanese IT & Instrastructure organizations using a sophisticated backdoor malware known as LODEINFO. Recently, Jin Ito & Loic Castel, researchers from Cybereason's IR Team, uncovered a new tool used by the group: NOOPDOOR, which incorporates highly sophisticated persistence mechanisms, allowing APT-10 to evade detection and remain inside enterprise networks for two or even three years.

Advertising Inquiries: https://redcircle.com/brands