Monthly Archives: May 2013

Ready for Summer: The Sunshop Campaign

| By | Exploits, Targeted Attack, Threat Intelligence, Threat Research

We recently identified another targeted attack campaign that leveraged both the recently announced Internet Explorer zero-day, CVE-2013-1347, as well as recently patched Java exploits CVE-2013-2423 and CVE-2013-1493. This campaign appears to have affected a number of victims based on the use of the Internet Explorer zero-day as well as the amount of traffic observed at making requests to the exploit server. This attack was likely executed by an actor we have named the ‘Sunshop Group’. This actor was also responsible for the 2010 compromise of the Nobel Peace Prize website that leverage a zero-day in Mozilla Firefox.

Impacted Sites

The campaign in question compromised a number of strategic websites including:

• Multiple Korean military and strategy think tanks
• A Uyghur news and discussion forum
• A science and technology policy journal
• A website for evangelical students

A call to a malicious javascript file hosted at www[.]sunshop[.]com[.]tw was inserted into all of these compromised websites.

Continue reading »

Targeted Attack Trend Alert: PlugX the Old Dog With a New Trick

| By | Exploits, Targeted Attack, Threat Research

FireEye Labs has discovered a targeted attack towards Chinese political rights activists. The targets appear to be members of social groups that are involved in the political rights movement in China. The email turned up after the attention received in Beijing during the 12th National People’s Congress and the 12th National Committee of the Chinese People’s Political Consultative Conference, which is the election of a new core of leadership of the Chinese government, to determine the future of China’s five-year development plan [1].

The email contains a weaponized attachment that utilizes the Windows Office CVE-2012-0158 exploit to drop the benign payload components and decoy document. The Remote Access Tool (RAT) PlugX itself is known as a combination of benign files that build the malicious execution. The Microsoft file OInfoP11.exe also known as “Office Data Provider for WBEM” is a certified file found in the National Software Reference Library (NIST) and is a component from Microsoft Office 2003 suite. For integrity checking endpoint protection, this file would be deemed as a valid clean file. In Windows 7+ distributions, the svchost.exe will require user interaction by displaying a UAC prompt only if UAC is enabled. Although in Windows XP distributions, this attack does not require user interaction. The major problem is that this file is subject to DLL Sideloading. In previous cases, PlugX has been utilizing similar DLL Sideloading prone files such as a McAfee binary called mcvsmap.exe [2], Intel’s hkcmd.exe [3], and NVIDIA’s NvSmart.exe [4]. In this case, OInfoP11.exe loads a DLL file named OInfo11.ocx (payload loader posing as an ActiveX DLL) that decompresses and decrypts the malicious payload OInfo11.ISO. This technique can be used to evade endpoint security solution that relies on binary signing. Traditional anti-virus (AV) solutions will have a hard time to identify the encrypted and compressed payload. At the time of writing of this blog, there is only 1 out of 46 AV vendors can detect the OInfo11.ocx file. Continue reading »

IE Zero Day is Used in DoL Watering Hole Attack

| By | Exploits, Targeted Attack, Vulnerabilities

Similar to what we found before in a series of watering hole attacks, targeting CFR and Chinese Dissidents, zero-day and just patched vulnerabilities were used. In the latest watering hole attack against Department of Labor (DoL), our research indicates a new IE zero-day is used in this watering hole attack, although some other vendors claim they are using known vulnerabilities.

This particular exploit checks for OS version, and only runs on Windows XP. We are able to reproduce the code execution and confirm it’s a working zero-day exploit against IE8. During our research we also found the exploit constructs a ROP chain on non-ASLRed msvcrt.dll, and we verified it could also work against IE8 on Windows 7. So we believe there should be some other exploits targeting IE8 on Windows 7.

This post was intended to serve as a warning to the general public. We have notified Microsoft and are collaborating with them on research activities. We will continue to work with Microsoft on this in-the-wild discovery.

We will continue to update this blog as new information about this threat is found. FireEye would like to acknowledge and thank iSight Partners for their assistance in this research.

[Update 05-03-2013]: Microsoft release a security advisory and assigned CVE-2013-1347 to this issue.

[Update 05-09-2013]: Microsoft release a Fix it Solution for CVE-2013-1347.