BSidesSF 2019

### Overview In this BSidesSF 2019 session titled "Operation PZChao," Ivana (introduced alongside Devon Alexander and Chile) presents Bitdefender's investigation into a large-scale targeted attack campaign attributed to the Iron Tiger APT group. First observed in July 2017 through packed samples mimicking legitimate software, Bitdefender's telemetry uncovered that the campaign targeted approximately 10,000 institutions across Asia in the technology, government, education, and telecommunications sectors.

### Key Topics The presentation centers on the attack chain, the command-and-control (C&C) infrastructure, payload distribution, and the attribution indicators linking the campaign to the Iron Tiger threat group. The attack infrastructure relied on five subdomains performing specialized functions such as distributing additional tooling, exfiltrating stolen data, and managing remote access trojan (RAT) communications. Download servers resolved to IP addresses located in South Korea.

### Technical Details The initial compromise vector involved highly targeted spam emails delivering malicious documents that downloaded the first-stage payload: a self-extracting 7-Zip archive containing two malicious batch scripts and the legitimate `curl` utility. The first batch script scheduled the second script as a scheduled task disguised under the name "Adobe Flash Updater." To evade detection and interference, this script terminated legitimate Adobe Flash processes and installed security solutions before execution.

The scheduled task performed two main operations: downloading companion tools from a download server and exfiltrating data via a helper batch script named "360" (resembling a popular Chinese security suite). The script collected system fingerprints (domain, username, MAC address, and RDP port status) and scheduled weekly uploads of harvested credentials at 3:00 AM. In the second stage, attackers fetched two architectures of a Mimikatz-based password stealer and Bitcoin mining tools executing under the legitimate-looking name "Java Time" (scheduled every three weeks at 3:00 AM).

The core payload was a modified variant of the Gh0st RAT acting as a backdoor implant. It consisted of a Windows dropper that deployed the RAT server DLL disguised under the name "Oracle." Upon execution, the implant decrypted AES-encrypted C&C configurations within its binary and conducted a handshake sending OS version, IP address, hostname, and webcam availability flags. Capabilities included remote shell execution, keystroke logging, webcam/microphone monitoring, process listing, screen capture, and arbitrary file downloads. Analysis of the open directory listing on the attackers' HTTP download server revealed several Gh0st RAT variants (including compressed non-AES variants), a Python-developed RAT, port scanning utilities, and target IP subnet ranges in Asia.

Attribution to Iron Tiger was supported by specific persistence registry key names, process cleanup scripts, hardcoded strings used for AES key generation, dynamic DNS evasion configurations, and Mimikatz usage.

### Takeaways Defenders are advised to monitor for abnormal outbound network traffic, unauthorized scheduled tasks (e.g., disguised Adobe or Java entries), suspicious child processes, and abnormal CPU spikes caused by cryptocurrency miners. General defenses include avoiding spam attachments, keeping all software updated to patch exploitable entry points, and deploying multi-layered security solutions capable of catching intrusions across the multi-stage attack lifecycle.