GroundPeony: Crawling with Malice

GroundPeony: Crawling with Malice

Speakers: Rintaro Koike (Security Analyst, NTT Security Holdings); Shota Nakajima (Senior Threat Intelligence Analyst, Cyber Defense Institute)

Conference: HITCON CMT

YouTube: https://www.youtube.com/watch?v=Aguil6GF8oU

Overview

This article delves into the findings presented by Rintaro Koike and Shota Nakajima at HITCON CMT, introducing GroundPeony, a previously under-reported and highly skilled Advanced Persistent Threat (APT) group. The researchers, operating under the team name "NK," have meticulously tracked and named this group, highlighting its distinct tactics, techniques, and procedures (TTPs). GroundPeony is primarily characterized by its focus on government organizations, research institutions, and telecommunication sectors across East and South Asia, specifically Taiwan and Nepal.

The talk underscores the critical importance of understanding emerging APT threats that operate with a low public profile. GroundPeony has demonstrated a significant capability for exploiting zero-day vulnerabilities, most notably being among the earliest to weaponize CVE-2022-30190, also known as Follina. Furthermore, the group extensively leverages compromised legitimate websites for malware distribution, adding a layer of sophistication and obfuscation to its operations. The insights shared in this presentation are crucial for defenders in the targeted regions and beyond, offering a rare glimpse into the operational methodologies of a clandestine yet highly motivated adversary.

Background

▶ Watch: Introduction to GroundPeony APT group (0:00)

The landscape of cyber espionage is continuously evolving, with APT groups consistently developing novel methods to achieve their objectives. GroundPeony emerges within this context as a China-nexus APT group, believed to be identical or closely related to Mandiant's UNC3658 or UNC3347. Their activity has been traced back to at least 2021, targeting critical infrastructure and government entities in geopolitically significant regions like Taiwan and Nepal. The existence of such groups, operating with minimal public exposure, poses a substantial challenge to cybersecurity professionals tasked with defending national interests and sensitive data.

The problem that GroundPeony exemplifies is the persistent threat of sophisticated adversaries who are capable of developing or acquiring zero-day exploits. The exploitation of vulnerabilities like Follina before public disclosure grants these groups a significant advantage, allowing them to bypass conventional security measures for an extended period. Additionally, their strategy of compromising legitimate, often government-affiliated, websites for malware staging and distribution complicates detection and attribution, as network defenders must contend with traffic to seemingly benign sources. This talk addresses the gap in public knowledge regarding GroundPeony's operations, providing much-needed context and actionable intelligence for the cybersecurity community.

Key Findings

▶ Watch: Detailed analysis of Taiwan government attack (March 2023) (4:50)

The research presented on GroundPeony unveiled several critical findings that collectively paint a comprehensive picture of this sophisticated APT group:

• China-Nexus Attribution: Based on code analysis, particularly the presence of extensive Chinese comments in extracted Python code, GroundPeony is strongly attributed to a China-nexus APT group. This aligns with their geographical targeting.
• Zero-Day Exploitation Prowess: GroundPeony was identified as one of the earliest, if not the earliest, groups to exploit CVE-2022-30190, commonly known as Follina, during its zero-day period in April 2022. This demonstrates a high level of technical capability in vulnerability research and exploitation.
• Strategic Targeting: The group consistently targets government organizations, research industries, and telecommunication sectors primarily in East and South Asia, with a specific focus on Taiwan and Nepal. This suggests a strategic interest in intelligence gathering or disruptive capabilities related to these regions.
• Compromised Legitimate Infrastructure: A hallmark of GroundPeony's operations is the compromise of legitimate websites, including those of educational institutions and government services (e.g., Nepal's COVID-19 vaccine website), to host and distribute their malware. This tactic enhances the credibility of their phishing lures and evades reputation-based security controls.
• Sophisticated Infection Chains: Their attack methodology involves multi-stage infection processes, typically starting with spear-phishing emails containing malicious documents, followed by the use of DLL side-loading and custom malware loaders.
• Custom Malware Development: The group utilizes its own custom malware, referred to as Mcdown, which employs bespoke XOR encryption and decryption routines to obfuscate its components and configuration.
• Attribution to Known APTs: The researchers believe GroundPeony is identical or closely related to groups previously tracked by Mandiant as UNC3658 and UNC3347, providing a broader context for their activities within the threat landscape.
• Use of Popular Post-Exploitation Tools: Beyond custom tooling, GroundPeony also incorporates commercially available or widely used post-exploitation frameworks such as Cobalt Strike Beacon into its attack arsenal.

Technical Deep Dive

▶ Watch: GroundPeony's Follina zero-day exploitation timeline (20:50)

GroundPeony's attack methodology is characterized by its multi-stage approach, leveraging social engineering, compromised infrastructure, and custom malware to achieve initial access and maintain persistence. The talk detailed two primary attack campaigns: one against the Taiwanese government in March 2023 and another against Nepal in April 2022, which notably involved the Follina zero-day.

Taiwanese Government Attack (March 2023):

The attack initiated with a spear-phishing email written in Mandarin Chinese, purportedly discussing maritime issues between Taiwan and the USA. This email was specifically directed at Taiwan's Ministry of Economic Affairs, originating from a cable TV company in Taiwan (a likely spoofed or compromised sender). Attached was a malicious DOCX file, titled "regarding bilateral consultations with the USA."

Upon opening the DOCX, it displayed an error message, prompting the victim to "apply an update to resolve the error." The document contained a URL for downloading this "update." This URL was crafted to appear legitimate, resembling a Microsoft website, but its structure (e.g., cut.re redirector) revealed its true nature. Accessing this URL led to a compromised website belonging to a Taiwanese educational institution, which hosted a ZIP file containing the malware.

The downloaded ZIP file contained four primary components: two executable files (system_security_patch.exe and install.exe), one text file, and a directory named recycle.bin. Inside recycle.bin were four files masquerading with .docx extensions but were, in fact, additional malware components.

Execution of either system_security_patch.exe or install.exe initiated the infection chain. These executables copied the four files from recycle.bin into a newly created MC directory under ProgramData. The copied files were renamed to mc.exe, version.dll, mc.doc, and mc.bin. Crucially, mc.exe is a legitimate, digitally signed executable, which was then used to DLL side-load version.dll.

The version.dll is central to the next stage. It performs two critical functions:

1. Decrypts and executes mc.doc: mc.doc contains the primary payload, which the researchers named Mcdown. The decryption process is multi-layered. First, version.dll reads mc.doc into a memory area allocated with read/write/execute permissions. It then XOR-decrypts this data using a custom algorithm combining XOR, SUB, and ADD instructions. The decoded content is shared code. This shared code then further decrypts and decompresses itself, excluding initial jump instructions, to execute the main Mcdown functionality.
2. Loads and decrypts mc.bin: mc.bin holds the encrypted configuration data for Mcdown, specifically for communicating with its Command and Control (C2) server. The C2 configuration consists of a 0x40-byte host area and a 2-byte port area. At the time of analysis, the C2 IP address was 103.199.17.184, which belongs to 365 Online Technology, a hosting company based in Vietnam.

Finally, Mcdown downloads and executes additional shellcode from the C2 server. This shellcode is also encoded using a variant of the custom XOR algorithm, with a slight modification in the order of ADD/SUB/XOR instructions compared to the file encoding.

Nepal Attack (April 2022 - Follina Exploitation):

This campaign, occurring earlier, demonstrated GroundPeony's capability to exploit zero-day vulnerabilities. The specific origin of the attack was not fully known, but it involved a compromised Nepal government COVID-19 vaccine-related website, used to host the malicious ZIP file. This aligns with China's "One Belt, One Road" partnership, which includes providing vaccines to Nepal, though direct correlation with the attack motive remains unclear.

The initial vector was a DOCX file, masquerading as a "statement of accusation by a person claiming to be a student at Kathmandu University." This DOCX file contained external link settings designed to load an HTML file. The HTML file, in turn, contained JavaScript code that exploited CVE-2022-30190 (Follina) by leveraging the ms-msdt scheme to execute PowerShell code.

The PowerShell code downloaded, extracted, and executed a CAB file from a server. Inside the CAB file was an executable created using PyInstaller. This PyInstaller-generated executable acted as a downloader, fetching and executing Cobalt Strike Beacon from the domain one-rival.com. The C2 server for this campaign was 185.193.127.184, associated with Gigabit Hosting, a Hong Kong-based company.

A critical finding from this Nepal campaign was the timeline of Follina exploitation. GroundPeony was observed exploiting Follina on April 7-8, 2022. This predates the public disclosure of the vulnerability on May 27, 2022, and even before Microsoft acknowledged it as a vulnerability on April 12, 2022. This places GroundPeony among a very small number of APT groups, specifically a China-nexus group, with early access to or development capabilities for zero-day exploits. Further analysis of the PyInstaller binary revealed extensive Chinese comments within the decompiled Python code, reinforcing the China-nexus attribution.

Summary of Technical Elements:

• Initial Access: Spear-phishing with malicious DOCX files.
• Exploitation: CVE-2022-30190 (Follina) zero-day, DLL side-loading (using legitimate mc.exe).
• Malware Distribution: Compromised legitimate websites (educational, government).
• Custom Malware: Mcdown (custom XOR encryption/decryption, multi-stage execution).
• Post-Exploitation Tools: Cobalt Strike Beacon.
• Infrastructure: C2 IPs 103.199.17.184 (Vietnam), 185.193.127.184 (Hong Kong); domains cut.re, one-rival.com, a.1d.com.
• Attribution Indicators: Extensive Chinese comments in Python code, specific targeting patterns.

Demo / Proof of Concept

▶ Watch: Attribution to China-nexus APT group (Diamond Model) (24:50)

The presentation did not include a live demonstration or proof-of-concept. Instead, the speakers provided a detailed, step-by-step analysis of the observed attack chains and malware behavior, supported by diagrams and code snippets derived from their forensic investigations and malware analysis.

Defensive Implications

▶ Watch: Mcdown malware evolution and family attribution (Q&A) (30:20)

Understanding GroundPeony's TTPs is paramount for organizations, especially those in government, research, and telecommunications sectors across East and South Asia. Defenders should implement a multi-layered security strategy to mitigate the risks posed by this highly capable APT group:

• Vulnerability Management and Patching: Given GroundPeony's propensity for zero-day exploitation (e.g., CVE-2022-30190 Follina), organizations must maintain a rigorous patching regimen. Prioritize critical vulnerabilities, especially those affecting Microsoft Office, Windows components, and web browsers, as these are common initial access vectors.
• Enhanced Email Security: Implement advanced email filtering and anti-phishing solutions capable of detecting sophisticated spear-phishing attempts. This includes scrutinizing attachments, URLs, and sender authenticity. User awareness training on identifying malicious emails and attachments is also crucial.
• Endpoint Detection and Response (EDR) & Antivirus: Configure EDR solutions to detect and alert on suspicious processes, particularly those involving DLL side-loading (e.g., mc.exe loading version.dll), execution of files from unusual directories like ProgramData\MC, or unexpected PowerShell activity. Antivirus solutions should be updated regularly to detect known GroundPeony malware components and Cobalt Strike beacons.
• Network Monitoring and Threat Intelligence: Monitor network traffic for connections to known GroundPeony C2 infrastructure, including IP addresses (103.199.17.184, 185.193.127.184) and domains (cut.re, one-rival.com, a.1d.com). Implement egress filtering to restrict outbound connections to suspicious or unknown destinations. Integrate threat intelligence feeds related to China-nexus APT groups and their TTPs.
• Web Application Security: Organizations hosting public-facing websites, especially government or educational portals, must prioritize their security. Regular security audits, vulnerability scanning, and integrity checks are essential to prevent website compromises that GroundPeony leverages for malware distribution.
• Application Whitelisting: Consider implementing application whitelisting policies to prevent the execution of unauthorized executables, particularly those dropped by initial payloads or attempting to DLL side-load.
• Behavioral Analysis: Focus on detecting anomalous behavior rather than just signatures. For instance, legitimate applications loading unusual DLLs or processes accessing sensitive files in atypical ways could indicate compromise.
• Incident Response Planning: Develop and regularly test incident response plans specifically tailored for sophisticated APT attacks, including procedures for malware analysis, forensic investigation, and eradication.

Key Takeaways

• GroundPeony is a sophisticated, under-reported China-nexus APT group actively targeting government, research, and telecom sectors in East and South Asia, particularly Taiwan and Nepal.
• The group possesses advanced exploitation capabilities, demonstrated by its early zero-day exploitation of CVE-2022-30190 (Follina).
• A key operational tactic involves compromising legitimate websites (e.g., educational institutions, government portals) to host and distribute their malware, enhancing the credibility of their attacks.
• Their attack chains are multi-stage, employing spear-phishing, DLL side-loading, custom encryption routines (Mcdown), and leveraging tools like Cobalt Strike Beacon.
• Defenders must prioritize proactive patching, robust email security, continuous network and endpoint monitoring, and up-to-date threat intelligence to counter GroundPeony's adaptive methodologies.
• The attribution of GroundPeony to Mandiant's UNC3658/UNC3347 provides valuable context for understanding its broader activities and potential objectives.

About the Speaker(s)

Rintaro Koike is a Security Analyst at NTT Security Holdings. His work primarily involves threat research and malware analysis, contributing to the understanding and defense against advanced cyber threats.

Shota Nakajima is a Senior Threat Intelligence Analyst at the Cyber Defense Institute. Like Koike, he is deeply engaged in threat research and malware analysis.

Together, they operate under the team name "NK" and have a history of presenting their research at prominent security conferences, including a previous talk at HITCON Community in 2019. Their collaborative efforts bring valuable insights into the evolving landscape of APT operations.