Kaspersky Lab have announced its researchers investigated a threat actor that was undertaking aggressive cyber-espionage activity in the Asian region, targeting multiple diplomatic and government entities with a particular focus on China and its international affairs.
This group, named Dropping Elephant (also known as “Chinastrats”), used their unsophisticated tools to attack some high profile Western targets as well.
In February 2016, following an alert from a partner, Kaspersky Lab’s Global Research and Analysis Team began its investigation into this threat actor. They discovered that from November 2015 to June 2016, the group profiled hundreds to thousands of targets all around the world. The attackers rely heavily on social engineering, low-budget malware tools and old exploits; however, this approach seems to be effective, given that within the first couple of months of the operation, they managed to steal documents from at least a few dozen selected victims.
Tools: simple, yet effective
For its initial target profiling, Dropping Elephant mass-mails a number of email addresses it has collected on the basis of their relevance to its goals. The spear-phishing emails sent by the attackers contain references to remote content – it is not embedded in the email itself, but downloaded from an external source. The email has no malicious payload, except a simple “ping” request that is sent to the attackers’ server if the target opens the email. This automatically sends a message which contains some basic information about the recipient: IP address, type of browser and both the device used and its location.
After using this simple method to filter out the most valuable targets, the attackers proceed with another, more targeted spear-phishing email. This is either a Word document with CVE-2012-0158 exploit, or PowerPoint slides with an exploit for the CVE-2014-6352 vulnerability in Microsoft Office. Both exploits are public and have been known for a long time, but are still effective.
Some victims are targeted by a watering hole attack. These victims receive a link to a website disguised as a political news portal, focused on China’s external affairs. The majority of links on this website lead to additional content in the form of a PPS (PowerPoint Slides document) with a malicious payload inside.
Even though the vulnerabilities used in the attacks were patched by Microsoft, the attackers can still rely on a social engineering trick to compromise their targets, if they ignore multiple security warnings displayed and agree to enable dangerous features of the document. The content of the malicious PPS is based on carefully chosen, genuine news articles featuring widely discussed geopolitical topics, which makes the document look more trustworthy and likely to be opened. This leads many users to become infected.
After the successful exploitation of the vulnerability, a range of malicious tools are installed on the victim’s machine. These tools then collect and send attackers the following types of data: Word documents, Excel spreadsheets, PowerPoint presentations, PDF files, login credentials saved in the browser, etc.
In addition to social engineering attacks and exploiting old vulnerabilities, one of the Dropping Elephant backdoors uses a C&C communication method borrowed from other threat actors. It hides the real location of the C&C server in the comments section of articles on legitimate public websites. This technique has previously been observed, albeit with a far more complex execution, in operations conducted by Miniduke and other threat actors. This is done in order to make the investigation of the attack more complicated.
There are indicators pointing to the fact that this actor operated from India; however, at the same time, there is no solid proof that a nation-state might be involved in this operation.
Read more about Dropping Elephant activities on the Kaspersky Lab blog