Why Panda Loves USB?: Observing Targeted Attacks by Chinese APTs

Why Panda Loves USB?: Observing Targeted Attacks by Chinese APTs

Speakers: Yuta Sawabe (SOC Analyst, NTT Security Holdings); Kazuya Nomura (SOC Analyst, NTT Security Holdings)

Conference: HITCON CMT

YouTube: https://www.youtube.com/watch?v=ja5hJ1A9S6M

Overview

This talk, "Why Panda Loves USB?: Observing Targeted Attacks by Chinese APTs," delivered by Yuta Sawabe and Kazuya Nomura, both SOC Analysts at NTT Security Holdings, delves into the persistent and sophisticated use of USB flash drives as an initial access vector by various Chinese Advanced Persistent Threat (APT) groups. The presentation highlights a crucial, yet often underestimated, aspect of modern cyber warfare: that even with highly advanced attack methodologies, traditional techniques like compromised USBs remain remarkably effective. The speakers present a compelling analysis based on real-world observations from their Security Operations Center (SOC), shedding light on the tactics, techniques, and procedures (TTPs) employed by APTs such as Mustang Panda, T410, and K.

The core of the discussion revolves around an intriguing question: why do Chinese APTs continue to favor USB drives for their targeted attacks, especially against seemingly security-conscious organizations? Through detailed case studies spanning manufacturing, media, and medical sectors, primarily targeting overseas branches of Japanese companies, Sawabe and Nomura dissect the infection chains, malware characteristics, and obfuscation techniques. They challenge common assumptions about geographical factors and security awareness, proposing that environmental and industrial contexts play a more significant role in dictating these APTs' preferences.

The talk is critically important for cybersecurity professionals, particularly those involved in threat intelligence, incident response, and security architecture. It underscores the enduring relevance of basic security hygiene, the necessity for robust endpoint detection and response (EDR) capabilities, and the need for a nuanced understanding of adversary motivations. By revealing specific TTPs and the underlying rationale for USB-based attacks, the speakers provide actionable intelligence for organizations to fortify their defenses against these persistent and evolving threats.

Background

▶ Watch: Introduction to targeted USB attacks by Chinese APTs (0:00)

In an era dominated by advanced persistent threats, zero-day exploits, and sophisticated supply chain attacks, it might seem counterintuitive that traditional initial access methods still hold significant sway. However, as highlighted by Sawabe and Nomura, methods such as fake software installers, malicious documents, and compromised USB drives remain highly effective and widely utilized, particularly by state-sponsored actors. The speakers emphasize that while APT groups possess sophisticated toolsets, they frequently revert to simpler, proven vectors for their initial foothold.

NTT Security Holdings' SOC observed a concerning trend of targeted attacks initiated via USB flash drives between June 2022 and March 2023. These incidents predominantly impacted overseas branches of Japanese companies across Asia, spanning diverse industries including manufacturing, media, and medical sectors. The specific APT groups identified in these campaigns were Mustang Panda, T410, and an actor referred to as K. These observations prompted the central inquiry of the presentation: given the advanced capabilities of these APTs, why do USB flash drives continue to be a favored method for initial compromise, even in sophisticated targeted attacks?

The context for this problem lies in the inherent vulnerabilities associated with removable media. USB drives, by their very nature, bridge the gap between digitally isolated environments and external networks, and their ubiquitous use in many operational contexts creates a ripe attack surface. Traditional security policies often struggle to fully mitigate the risks, especially in large, distributed organizations or those with diverse operational environments. The speakers' investigation seeks to unravel the specific environmental and strategic advantages that make USBs an attractive vector for these Chinese APTs, moving beyond simplistic explanations like generalized low security awareness.

Key Findings

▶ Watch: Mustang Panda case study: PlugX malware via USB (4:00)

The NTT Security Holdings team presented several key findings derived from their observations of USB-based targeted attacks by Chinese APTs. Across all incidents, several common characteristics emerged: the attacks were consistently attributed to China-associated APT groups, they primarily targeted overseas branches of Japanese companies, and USB drives served as the initial access vector. The specific campaigns detailed provided deeper insights into the TTPs.

Mustang Panda (aka Bronze President, Red Delta, TA416, Earth Preta):

• Observed in March 2023, targeting a Japanese company's Asia branch in the medical sector.
• Primarily targets non-governmental organizations globally.
• Deployment of WhaleRider malware, a variant of PlugX (also known as C-Plug), via USB.
• Heavy reliance on DLL side-loading techniques to execute malicious payloads using legitimate executables.
• Initial detection by Microsoft Defender for Endpoint through "tant actor activity detected" alerts, indicating suspicious USB drive activity.
• Noted extensive file creation activities on external drives, suggesting a strong intent for lateral movement and spreading via removable media.
• Links were drawn to external reports by Checkpoint (UNC4698) and Avast, confirming the use of WhaleRider and similar infection chains, including an incident where malware spread during a medical conference via shared USBs.

T410 (aka APT41, Winnti Group):

• Observed in June 2022, targeting a Japanese media company.
• Utilized the FlowCloud malware, a sophisticated backdoor known since 2012.
• Attacks were initialized by executing malicious files from USB drives at overseas locations, with confirmed C2 communications and data exfiltration.
• The malware configuration, extracted in memory, contained Chinese commands, reinforcing attribution to China.
• FlowCloud used non-standard ports 5562 and 5563 for C2 communication.
• A notable feature was a rootkit capable of hiding malicious processes by manipulating the undocumented EPROCESS structure in Windows, demonstrating support for newer Windows versions like Windows 11 version 21H2.
• Connections to T428 were suggested due to shared infrastructure and the use of droppers like WebCobra or SpacePilot.

K (Attribution Unclear, Chinese Involvement Suspected):

• Observed in June and August 2022, targeting a Japanese manufacturing company.
• The attack campaign, first seen in 2020, initiated with the execution of a LNK file on a USB device.
• This led to DLL side-loading using a "Bring Your Own Vulnerable Driver" (BYOVD) approach, where attackers bring legitimate, vulnerable executables alongside malicious DLLs.
• Ultimately, the target was infected with PlugX.
• Detection by Windows Defender with an alert named "system for disguised," indicating disguised Windows system files.
• A distinctive obfuscation technique involved crafting USB file paths with white spaces to hide malicious files from casual user inspection in Explorer.
• Similarities to Mustang Panda (PlugX, hidden folders with white space) suggested a possible connection, potentially involving a specific subgroup within Mustang Panda.

Why Chinese APTs Prefer USBs:

The speakers systematically debunked the hypothesis that USB prevalence in Asia is due to generally lower security awareness. They noted that cybercrime-type attacks using USBs (e.g., Raspberry Robin) are observed globally. Instead, they proposed that the preference for USBs by China Nexus APTs stems from environmental factors:

1. Isolated environments: USBs are ideal for attacking air-gapped systems or networks isolated from the internet where confidential information is handled.
2. Routine USB usage: Environments where USBs are routinely used for operations, such as manufacturing and transportation industries, present an easier target.
3. Shadow IT: In environments with strict USB prohibition policies, employees may resort to using personal USBs for convenience, creating an unmonitored risk vector.

A survey of their customer base showed a high rate of USB device usage in manufacturing and transportation industries, correlating strongly with the industries targeted by these incidents. This suggests that Chinese APTs adapt their initial access methods to the target environment, specializing in USB-based attacks where they are most effective.

Technical Deep Dive

▶ Watch: Why China Nexus APTs favor USB for initial access (20:00)

The talk provided a granular look into the technical intricacies of the observed USB-based attacks, emphasizing DLL side-loading, rootkit functionality, and obfuscation techniques.

DLL Side-Loading Mechanics:

A recurring theme across Mustang Panda, T410, and K campaigns was the extensive use of DLL side-loading. This technique exploits how legitimate applications load Dynamic Link Libraries (DLLs). Attackers bundle a legitimate, often signed, executable with a malicious DLL. When the legitimate executable is launched, it attempts to load its required DLLs. If a malicious DLL with the expected name is placed in a location searched before the legitimate one (e.g., the same directory as the executable), the operating system will load the malicious DLL instead, granting the attacker execution within a trusted process.

• Mustang Panda's WhaleRider: This malware leveraged DLL side-loading to execute PlugX. The attack flow involved a malicious USB flash drive leading to the execution of PlugX, which then launched a backdoor for exfiltrating files, keylogging, and taking screenshots. The report also mentioned the use of 3DS files and legitimate executables vulnerable to this technique. An SFX archive uploaded to VirusTotal in November 2012, originating from Japan, exhibited behavior matching the observed attack flow, further cementing these technical details.
• K's BYOVD (Bring Your Own Vulnerable Driver) with LNK Files: The K campaign initiated with a user executing a LNK file on the USB drive. This LNK file was crafted to launch a legitimate executable (e.g., expl.exe or ex.exe). These executables were vulnerable to DLL side-loading. The attack chain recursively spawned child processes, copied other malicious components from an "invisible" directory on the USB, and then performed the DLL side-loading to decrypt encrypted payloads and ultimately infect the system with PlugX. The speakers noted that attackers often rename the legitimate executable but keep the malicious DLLs with their original names, providing a potential detection heuristic.

T410's FlowCloud and Rootkit Capabilities:

T410's FlowCloud malware demonstrated a high level of sophistication.

• Configuration in Memory: FlowCloud extracted its configuration directly in memory, making static analysis more challenging. This configuration contained Chinese commands and specified non-standard C2 communication ports, 5562 and 5563, for its communication destination.
• Rootkit Functionality: A key technical finding was FlowCloud's ability to implement a rootkit to hide its processes. This was achieved by directly manipulating the undocumented EPROCESS structure, which Windows uses to manage processes. Specifically, the malware removed its targeted process entries from the process list within this structure. The speakers highlighted that the malware supported different offset variables for the EPROCESS structure across various Windows versions, indicating active development and support for newer operating systems, including Windows 11 version 21H2. This capability makes detection and eradication significantly harder as standard process enumeration tools would not see the malicious processes.
• Infrastructure and Droppers: The presentation also linked FlowCloud samples to specific C2 infrastructures, including www.d.com. Variants of the dropper used by T410 were identified as WebCobra or SpacePilot, which have also been associated with T428, suggesting potential collaboration or shared toolsets between these groups.

Obfuscation Techniques:

• Hidden Folders with White Spaces (K and Mustang Panda): Both K and Mustang Panda were observed using a clever obfuscation technique on the USB drives. They crafted folder paths that contained white spaces at the end, making these folders effectively invisible to users browsing in Windows Explorer. The LNK files would then reference these hidden paths, forcing users to execute malicious content without realizing the presence of hidden files. This significantly reduces the chances of a user manually discovering the malware.
• Renaming Legitimate Files: Attackers frequently rename legitimate executables (e.g., explorer.exe to expl.exe) to blend in with system processes while retaining their vulnerable DLL loading behavior.

These technical details underscore the adaptive and persistent nature of these APT groups, continuously evolving their TTPs to bypass defenses and exploit common user behaviors.

Demo / Proof of Concept

▶ Watch: USB usage rates by industry and targeted environments (30:00)

While the talk did not feature a live demonstration or proof-of-concept during the presentation, the speakers extensively detailed the observed attack chains and detection methods from their SOC environment, effectively serving as a retrospective demonstration of how these threats operate and how they were identified.

For instance, the detection of the K campaign was described through specific Windows Defender alerts. When the LNK file on the USB was executed, triggering the DLL side-loading chain, Windows Defender generated an alert named "system for disguised." Although the exact logic for this alert is proprietary, its description indicated the detection of a disguised Windows system file. The speakers illustrated the process tree: a starting executable (e.g., expl.exe) launched Safeguard.exe, then media.exe, and finally excel.exe in sequence. All of these were, in fact, the same legitimate, vulnerable executable being repeatedly side-loaded. The suspicious behavior was specifically flagged when another file, s_host.exe, was launched, indicating malicious activity.

Similarly, the detection of T410's FlowCloud was attributed to a "cloud of file" alert, which triggered upon the execution command and scripting interpreter, followed by the execution of a legitimate executable from a suspicious location. This detailed description of the detection logic, even without a live demo, provides valuable insights into the artifacts and behaviors that security products can flag.

For Mustang Panda, the initial detection was credited to Microsoft Defender for Endpoint, which generated an alert for "tant actor activity detected." This signature, as defined by Microsoft, was linked by the speakers to suspicious USB drive activity, specifically attempts to execute malicious files from a USB drive. The observation of extensive file creative activities on external drives further corroborated the malicious intent and lateral movement strategy.

These retrospective accounts, coupled with the detailed technical explanations of DLL side-loading, rootkit functionality, and obfuscation, effectively communicated the operational aspects of the attacks and the capabilities of modern EDR solutions to identify them, even if a real-time PoC was not part of the conference presentation.

Defensive Implications

▶ Watch: Q&A: USB management policies in Japanese companies (36:00)

The insights gleaned from observing Chinese APTs' persistent reliance on USB-based attacks offer critical defensive implications for organizations. The speakers emphasized a multi-layered approach, combining policy, education, and technical controls.

1. Restrict USB Usage and Enforce Policies: The most straightforward defense is to restrict the use of USB devices within the organization. This involves establishing clear, enforceable security policies that prohibit or strictly control the connection of unauthorized USB drives. Beyond policy, technical controls are essential, such as restricting USB ports at the operating system or hardware level. However, policies alone are insufficient, especially if they lead to Shadow IT, where employees bypass restrictions for convenience. Organizations must find a balance between security and operational necessity, potentially implementing whitelisting for approved devices or secure USB solutions.

1. Employee Training and Awareness: A significant portion of USB-based attacks relies on social engineering or user error. Comprehensive and ongoing employee training is crucial to raise awareness about the dangers of compromised USBs. This includes educating staff on:

• The risks of plugging in unknown USB drives.
• Identifying suspicious LNK files or disguised executables.
• The potential for targeted attacks via shared drives, especially in conference or collaborative settings.
• The importance of reporting suspicious activity.

Such training helps reduce the risk of Shadow IT by making employees understand the "why" behind security policies.

1. Enhanced Post-Infection Detection and Response: Since not all initial access attempts can be prevented, robust detection and response capabilities are paramount:

• Custom Signatures and Behavioral Detections: Attackers often use specific techniques like DLL side-loading, which can be detected by monitoring DLLs loading from unusual locations (e.g., the same directory as a legitimate executable, rather than system directories). Developing custom signatures for known malware variants (e.g., specific PlugX or FlowCloud behaviors) and their associated TTPs is vital.
• EDR/XDR Solutions: Modern Endpoint Detection and Response (EDR) or Extended Detection and Response (XDR) solutions are critical. They can detect suspicious process trees (e.g., LNK file launching a legitimate executable that then spawns other suspicious processes), identify rootkit activity (though harder for kernel-level ones like FlowCloud's EPROCESS manipulation), and flag unusual file operations. Alerts such as "system for disguised" (Windows Defender) or "tant actor activity detected" (Microsoft Defender for Endpoint) highlight the value of these tools.
• Monitoring File Exfiltration: Many APTs use USBs not just for initial access but also for data exfiltration. Monitoring for a large number of file creative activities on external drives can indicate attempts to copy sensitive data off the network.
• Vulnerability Management: Regularly patching legitimate software and operating systems can mitigate the effectiveness of "Bring Your Own Vulnerable Driver" (BYOVD) attacks, although attackers often target older, unpatched systems or specific vulnerable applications.

1. Network Segmentation and Isolation: For critical or sensitive environments, particularly those handling confidential information, network segmentation or air-gapping can limit the blast radius of a successful USB compromise. However, as the speakers noted, these isolated environments are precisely what make USB attacks attractive to adversaries.

By implementing these defensive strategies, organizations can significantly reduce their susceptibility to USB-based targeted attacks and enhance their ability to detect and respond effectively when such incidents occur.

Key Takeaways

• USB Drives Remain a Potent Initial Access Vector: Despite their "traditional" nature, USB flash drives are still highly effective for initial compromise, especially for sophisticated Chinese APTs like Mustang Panda, T410, and K, targeting overseas branches of Japanese companies.
• DLL Side-Loading is a Dominant Technique: These APTs heavily leverage DLL side-loading, where malicious DLLs are placed alongside legitimate, often signed, executables to achieve execution within trusted processes and bypass traditional defenses.
• Environmental Factors Drive APT Attack Vector Choice: The preference of China Nexus APTs for USBs is primarily driven by environmental context (e.g., isolated networks, routine USB usage in industries like manufacturing, prevalence of Shadow IT) rather than generalized regional security awareness.
• Advanced Obfuscation and Persistence: APTs employ sophisticated techniques such as rootkits (e.g., T410 manipulating Windows EPROCESS structures for process hiding, supporting Windows 11 21H2) and clever obfuscation (e.g., K and Mustang Panda using white spaces in folder paths on USBs to hide malicious files).
• Multi-Layered Defense is Essential: Effective defense requires a combination of strict USB usage policies, continuous employee training to counter social engineering and Shadow IT, and robust EDR/XDR solutions capable of detecting specific TTPs like unusual DLL loading, suspicious process activity, and file exfiltration attempts.
• Industry-Specific Risk Assessment: Organizations should assess their risk based on their industry's USB usage patterns. Industries with high routine USB interaction (e.g., manufacturing, heavy industry, medical) are more likely targets for these types of attacks.

About the Speaker(s)

Yuta Sawabe and Kazuya Nomura are both dedicated SOC Analysts at NTT Security Holdings. Their work involves the critical task of monitoring, analyzing, and responding to sophisticated cyber threats targeting their clients. Their expertise lies in dissecting complex attack campaigns, attributing them to specific threat actors, and extracting actionable intelligence on their tactics, techniques, and procedures (TTPs). In this talk, they showcased their deep understanding of targeted attacks, particularly those leveraging USB flash drives, drawing from real-world observations within their Security Operations Center environment. Their presentation reflects NTT Security Holdings' commitment to understanding the evolving threat landscape and providing advanced security insights.