ATK23

ATK23 (aka: Icefog) is an Chinese cyber espionange group active since at least 2011. This group is described by Kaspersky as "small, which a relative lack of complexity" but they sucessfully compromised their targets which are mostly the defense contractors, industrial campanies, shipbuilding companies, telecommunication operators and medias in Japan, Taiwan and South Korea. This group used spearphishing emails exploiting CVE-2012-0158 and CVE-2012-1856 or containg a web link to Oracle Java exploits CVE-2013-0422 and CVE-2012-1723. It uses already known and patched vulnerabilities. Its lure Word documents contains pictures of a woman or are related to political actuality. This group also used HLP files abusing Windows features to drop its malwares.

 

After the initial access, the group list folder on the disk, IP configuration and information about the victim network. If the victim is interesting it deploys additional softwares such as backdoor and lateral movement tools to dump password from Windows, IE or Outlook and a legitimage RAR compressing tool. It also try tool steal Windows address books (.WAB files) and XSL, DOC or HWP documents. The stolen document are compressed and split into multiple parts using WinRAR or CABARC to be transfered to the C2 server.

 

The lateral movment is done using multiple tools to dump credential from browsers or Outlook.

 

The C2 server are hosted on shared hosting plateforms and dedicated hosting. Their C2 infrastructure is very ephemeral. Icefog seems to use a "hit and run" strategy. They infects their victims, steal the data and the C2 infrastructure expires in few months. This strategy indicate that they knew what it his looking for. They did not maintain a persistent prensence on the compromised network when their goal is reached.

 

After the Kaspersky reports from September 2013 and January 2014, the group desapeared. In 2015 after nearly a year of silence, new variants of the ICEFOG (ICEFOG-M and ICEFOF-P) have been found, used during campaign which targets do not match with previously seen campaign.

 

NB: AccoRding to the researcher Chi-en Shen from FireEye, the new variants of the ICEFOG backdoor are used by multiple Chinese groups (APT9, APT15, Goblin Panda and another group name "Temp Group A" which can actually be the original Icefog group). The conclusion is that the ICEFOG backdoor cannot be used to attribute a campaign.

 

References :

• https://media.kasperskycontenthub.com/wp-content/uploads/sites/58/2013/09/21182446/icefog.pdf
• https://securelist.com/the-icefog-apt-hits-us-targets-with-java-backdoor/58209/
• https://speakerdeck.com/ashley920/into-the-fog-the-return-of-icefog-apt
• https://www.zdnet.com/article/ancient-icefog-apt-malware-spotted-again-in-new-wave-of-attacks/