Chinese-Speaking Threat Actor Using Unknown Rootkit in Targeted Attacks

guest · Jul 30, 2021

Chinese-Speaking Threat Actor Using Unknown Rootkit in Targeted Attacks
Security vendor says it first spotted 'GhostEmperor' when investigating attacks targeting Microsoft Exchange flaws.
July 29, 2021
https://www.darkreading.com/attacks...tor-using-unknown-rootkit-in-targeted-attacks

Kaspersky says it stumbled across the new threat actor — who it is tracking as GhostEmperor — while investigating a rash of attacks against the Microsoft Exchange vulnerabilities, collectively called ProxyLogon, earlier this year.

The threat actor's activity stood out because it involved the use of a previously unknown Windows kernel-level rootkit and a unique method to load it by bypassing the Windows Driver Signature Enforcement mechanism using a component of an open source tool called "Cheat Engine."
Click to expand...

According to Kaspersky, the multistage malware framework that GhostEmperor used in the attacks was sophisticated and designed to give the attacker complete remote control over compromised servers. The malware bore no similarity to anything that Kaspersky had tracked before and appeared to have been in use since at least July 2020, the vendor said.

"Cheat Engine is a program used for cheating in video games by providing the user with tools to edit the game’s running memory in order to modify various values in it," says Kaspersky security researcher Ariel Jungheit. For example, gamers can use the tool to modify the extent of damage to weapons or edit their score, player health, available time, and other metrics, he says.
"This program is shipped with a signed driver named ‘dbk64.sys,’ which the actor abused ultimately to load the rootkit," he adds.
Click to expand...

Kaspersky: GhostEmperor APT targets high-profile victims using unknown rootkit

Today Kaspersky announced its discovery of a unique, long-running operation, called GhostEmperor.
GhostEmperor is a Chinese-speaking threat actor that has mostly focused on targets in Southeast Asia, including several government entities and telecom companies.

This advanced toolset is unique and Kaspersky researchers see no similarity to already known threat actors. Kaspersky experts have surmised that the toolset has been in use since at least July 2020.
Click to expand...

Rasheed187 · Jul 31, 2021

OK so "Windows Driver Signature Enforcement" isn't good enough to block rootkits?

EASTER · Jul 31, 2021

Rasheed187 said: ↑

OK so "Windows Driver Signature Enforcement" isn't good enough to block rootkits?
Click to expand...

Good question. Of all the RAW Windows little security preventions this another one of even more importance.
Never thought I would read or see of anymore rootkits after PatchGuard and x64bit was introduced but then it looks like nothing is really nor can be made 100% foolproof with the current coding. Which is how many years old now?

itman · Jul 31, 2021

"This program is shipped with a signed driver named ‘dbk64.sys,’ which the actor abused ultimately to load the rootkit," he adds.
Click to expand...

This is not the first time these gamer cheat hack tools have been able to access kernel mode code. Assume this cheat engine hack tool allows access to its driver code. The attacker exploit this and used the legit driver to drop his rootkit.

Rasheed187 · Aug 5, 2021

EASTER said: ↑

Good question. Of all the RAW Windows little security preventions this another one of even more importance.
Never thought I would read or see of anymore rootkits after PatchGuard and x64bit was introduced but then it looks like nothing is really nor can be made 100% foolproof with the current coding. Which is how many years old now?
Click to expand...

Yes it's a bit tricky, PatchGuard is good, but not good enough. So once a rootkit is installed, it's probably game over. Now that I think about it, would be nice to know which AV's are good at catching already installed rootkits, in other words malicious drivers.

itman · Aug 5, 2021

Rasheed187 said: ↑

PatchGuard is good, but not good enough.
Click to expand...

As long as you have Hyper-visor code integrity; i.e. memory integrity, enabled: https://www.bleepingcomputer.com/ne...g-new-windows-10-kdp-anti-malware-protection/ , rootkits are pretty well nutered. I saw this first hand with a very nasty rootkit I had. Once I was able to enable HVCI, the rootkit activity stopped; at least the nasty part of what it was doing.

The big thing currently are bootkits that infect the UEFI.

Rasheed187 · Aug 7, 2021

itman said: ↑

As long as you have Hyper-visor code integrity; i.e. memory integrity, enabled: https://www.bleepingcomputer.com/ne...g-new-windows-10-kdp-anti-malware-protection/ , rootkits are pretty well nutered. I saw this first hand with a very nasty rootkit I had. Once I was able to enable HVCI, the rootkit activity stopped; at least the nasty part of what it was doing.

The big thing currently are bootkits that infect the UEFI.
Click to expand...

Cool, didn't know about this stuff, so at least M$ is finally trying to do something about it. I wish they also came up with a way to block malware from unhooking security tools. Of course I'm then talking about user mode hooks. I believe HMPA added some type of protection against it, but they removed it for now, because it caused certain problems.

https://blogs.blackberry.com/en/2017/02/universal-unhooking-blinding-security-software

lucd · Aug 19, 2021

@itman if you import HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 1

you get a bsod at startup if you have shadow defender installed, attachaded image, its not mine but its the same

tweaks to dabble with (you have option to set it "locked", off in this code) if you don't have SD are

reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "EnableVirtualizationBasedSecurity" /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "RequirePlatformSecurityFeatures" /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "Locked" /t REG_DWORD /d 0 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Locked" /t REG_DWORD /d 0 /f

itman · Aug 19, 2021

lucd said: ↑

@itman if you import HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 1

you get a bsod at startup if you have shadow defender installed, attachaded image, its not mine but its the same

tweaks to dabble with (you have option to set it "locked", off in this code) if you don't have SD are
Click to expand...

Personally, I wouldn't advise fooling around with these settings since they are set dynamically at boot time in Win 10 based of your existing hardware configuration.

guest · Sep 30, 2021

Chinese espionage group deploys new rootkit compatible with Windows 10 systems
September 30, 2021
https://therecord.media/chinese-esp...w-rootkit-compatible-with-windows-10-systems/

At the SAS 2021 security conference today, analysts from security firm Kaspersky Lab have published details about a new Chinese cyber-espionage group that has been targeting high-profile entities across South East Asia since at least July 2020.

Named GhostEmperor, Kaspersky said the group uses highly sophisticated tools and is often focused on gaining and keeping long-term access to its victims through the use of a powerful rootkit that can even work on the latest versions of Windows 10 operating systems.

“We observed that the underlying actor managed to remain under the radar for months,” Kaspersky researchers explained today.
Kaspersky believes the group used exploits for Apache, Oracle, and Microsoft Exchange servers to breach a target’s perimeter network and then pivoted to more sensitive systems inside the victim’s network.
Click to expand...

Kaspersky said GhostEmperor used Cheat Engine’s powerful drivers to bypass the Windows PatchGuard security feature and install a rootkit inside the victim’s Windows OS.
Called Demodex, researchers said the rootkit was extremely advanced and allowed the group to maintain access to the victim’s device even after OS reinstalls and even on systems running recent versions of the Windows 10 OS.

But this wasn’t GhostEmperor’s only trick. Kaspersky also noted that the group’s malware was full of “a broad set of unusual and sophisticated anti-forensic and anti-analysis techniques” that tried to prevent or hinder security researchers trying to analyze their malware.
Click to expand...

While Kaspersky did not reveal the name of the group’s targets, they said GhostEmperor went after governmental entities and telecommunication companies across South East Asia (Malaysia, Thailand, Vietnam, and Indonesia), with outliers in Egypt, Afghanistan, and Ethiopia.
Click to expand...

Technical report: "GhostEmperor’s infection chain and post-exploitation toolset"
(PDF): https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2021/09/30094337/GhostEmperor_technical-details_PDF_eng.pdf

Log in or Sign up

Chinese-Speaking Threat Actor Using Unknown Rootkit in Targeted Attacks

guest Guest

Rasheed187 Registered Member

EASTER Registered Member

itman Registered Member

Rasheed187 Registered Member

itman Registered Member

Rasheed187 Registered Member

lucd Registered Member

Attached Files:

20181210_191650.jpg

itman Registered Member

guest Guest

Log in or Sign up

Chinese-Speaking Threat Actor Using Unknown Rootkit in Targeted Attacks

guest Guest

Rasheed187 Registered Member

EASTER Registered Member

itman Registered Member

Rasheed187 Registered Member

itman Registered Member

Rasheed187 Registered Member

lucd Registered Member

Attached Files:

20181210_191650.jpg

itman Registered Member

guest Guest

Useful Searches