Inside Pandora's Box: dissecting the latest arsenal and tactics of APT27

Inside Pandora's Box: dissecting the latest arsenal and tactics of APT27

Speakers: Naoki Takayama, Security Researcher, Internet Initiative Japan

Conference: Virus Bulletin

YouTube: https://www.youtube.com/watch?v=TUATnkPEsnc

Overview

In this insightful talk, Naoki Takayama, a security researcher at Internet Initiative Japan (IIJ), delves into the evolving toolkit and sophisticated tactics of APT27, a notorious China-nexus advanced persistent threat group. The presentation focuses on a recent attack campaign observed in July of the current year (presumably 2023), highlighting several new and updated techniques employed by the group. Takayama reveals how APT27 has refined its operational security and malware capabilities, including the novel use of legitimate VPN server software for persistent access, the deployment of new Cobalt Strike beacon downloaders that suggest potential code-sharing with other prominent APT groups, and a significantly improved version of their flagship Pandora rootkit.

The talk is crucial for understanding the cutting-edge methods of a highly active state-sponsored adversary. By dissecting the internal mechanisms of these threats and outlining practical detection methodologies, Takayama provides valuable intelligence for defenders. The research stems from a unique opportunity to observe APT27's infrastructure directly, which exposed their attacking tools, malware, and even exfiltrated files from a compromised Mongolian entity. This rare glimpse into an attacker's operations offers an unparalleled perspective on their current arsenal and strategic shifts, making the findings highly relevant for organizations facing targeted attacks.

Takayama’s analysis underscores the continuous evolution of APT groups, emphasizing their adoption of legitimate tools for stealth, advanced obfuscation techniques, and the integration of sophisticated kernel-level rootkits to maintain covert persistence. The detailed breakdown of techniques like Bring Your Own Vulnerable Driver (BYOVD) for rootkit installation and the intricate infection chains provides critical insights for enhancing detection and response strategies against such adaptive threats.

Background

▶ Watch: Introduction to APT27's latest arsenal and tactics (0:00)

APT27, also recognized by aliases such as Lucky Mouse and Iron Tiger, is a persistent and highly capable China-nexus APT group that has been actively conducting cyber espionage operations since at least 2010. Their primary objective is to steal valuable information, leading them to target a diverse range of industries, regions, and government entities globally. Over the years, APT27 has utilized a varied arsenal of malware, some of which are uniquely attributed to them, including Hyperbro, Pandora, and CIS update. They also commonly employ malware widely used across other China-nexus threat actors, such as PlugX.

The specific campaign dissected in this presentation involved a Mongolian entity, which had been compromised since at least June of the current year. Unlike typical incident response investigations, the research was initiated by observing an exposed portion of the attacker's infrastructure. This exposure provided a unique opportunity to directly acquire their attacking tools, malware samples, and even exfiltrated files from compromised hosts. The discovery of malware, particularly an updated rootkit attributed to APT27, confirmed the group's involvement and prompted a deeper analysis into their updated arsenal and post-exploitation tactics. This passive observation method offered an unfiltered view into the adversary's operational choices, revealing their latest techniques without the constraints of a reactive defensive posture.

Key Findings

▶ Watch: Evidence of APT27 and APT41 sharing malware code (11:00)

The in-depth analysis of APT27's exposed infrastructure and malware revealed several critical updates to their arsenal and tactics:

• Abuse of Legitimate SoftEther VPN Server for Persistence: APT27 has adopted the use of SoftEther VPN Server, a legitimate open-source VPN solution, to establish and maintain persistent access to compromised networks. This technique offers a stealthy and robust method for long-term control, often blending in with normal network traffic.
• New Cobalt Strike Beacon Downloader Payloads: Two distinct types of Cobalt Strike beacon downloader payloads were identified. Notably, the Type B loader exhibited strong similarities to malware used by APT41, another prominent China-nexus group, suggesting potential code sharing or collaboration between these sophisticated threat actors.
• Enhanced Pandora Rootkit with BYOVD: The group's flagship Pandora rootkit has undergone significant updates. It now leverages the Bring Your Own Vulnerable Driver (BYOVD) technique, specifically exploiting CVE-2017-15303 in the CPUZ141.sys driver, to load components in a stealthier, more fileless manner. Furthermore, the rootkit has integrated code from the open-source hidden.is rootkit, potentially to decrease detection risk.
• Modified Fast Reverse Proxy (FRP) Tool: APT27 utilizes a modified version of the legitimate FRP (Fast Reverse Proxy) tool, dubbed FRP modify. This variant receives configuration parameters directly from the command line, preventing sensitive server information from being written to the file system and complicating forensic analysis.
• Continued Use of Privilege Escalation Exploits: The group continues to employ known privilege escalation exploits like EFS Potato to elevate privileges on older Windows environments, particularly servers, highlighting the importance of patching even legacy vulnerabilities.
• Direct Observation of Attacker Infrastructure: The unique aspect of this research was the ability to observe an exposed attacker infrastructure, providing direct access to their tools, malware, and even exfiltrated data, offering an unparalleled view into their operational methods.

Technical Deep Dive

▶ Watch: Pandora rootkit's BYOVD technique with CPUZ driver (14:00)

APT27's latest campaign showcases a blend of well-established techniques with innovative adaptations, emphasizing stealth, persistence, and evasion. The technical details reveal a sophisticated adversary continuously refining its toolkit.

Post-Exploitation Tools

APT27 employs a range of tools for post-exploitation activities, including privilege escalation and maintaining access:

• EFS Potato: This is a known privilege escalation exploit for Windows, specifically targeting the Encrypted File System (EFS). EFS Potato abuses the EFS RPC OpenRaw function to elevate service accounts with the SeImpersonate privilege to NT AUTHORITY\SYSTEM. While known to be fixed in Windows 22H2, it remains effective against older systems, particularly servers, indicating that APT27 likely targets environments not fully updated.
• FRP (Fast Reverse Proxy) and FRP Modify: FRP is a legitimate, open-source tool designed to expose local services behind a NAT or firewall to the internet. APT27, like many other threat actors, abuses FRP to maintain persistent access to compromised hosts and networks. A key finding was the configuration file for the server-side component, FRPS, which contained an interesting privilege_token parameter set to UNOSC. This parameter directly relates to FRP modify, a custom version of FRP. Developed by a Chinese user named UNOSC, this modified tool receives configuration parameters (like server address and port) directly from the command line, rather than a file. This approach prevents configuration details from being written to disk, making digital forensic investigations significantly harder. The UNOSC user is also noted for publishing various other attacking tools and even malware source code on GitHub, raising questions about their potential links to threat actor groups.
• SoftEther VPN Server: A critical new tactic involves the abuse of SoftEther VPN Server, a legitimate, open-source, multi-protocol VPN software. APT27 leverages this software to maintain persistent access to the victim network. In the observed campaign, the VPN server appeared to be running on the victim's domain controller, created on June 2nd of the current year. The legitimate nature of SoftEther VPN allows the attackers to blend their persistent access within normal network operations. Detection involves looking for unexpected hosts running an HTTPS server on listening ports (e.g., 50443 in this case) that return specific SoftEther VPN responses, or by checking for the predefined service name SEVPNSERVER, which is less likely to be changed. The server also records statistics, timestamps, and hostnames in its configuration file, and a specific DDNS hostname was observed in its server certificate, though name resolution was unavailable at the time of investigation.

Cobalt Strike Beacon Downloader Payloads

The campaign featured two distinct types of Cobalt Strike beacon downloader payloads, both accessing the same C2 endpoint but differing in their execution mechanisms:

• Type A Payload: The infection chain begins with inetinfo.exe, a legitimate executable, which DLL sideloads a malicious DLL named calibrate_launcher.dll. This DLL acts as a shellcode loader, reading and Base64 decoding content from another file (e.g., lib*.tmp). It then executes this decoded shellcode using Fiber APIs like CreateFiber. The executed shellcode is a reflective DLL loader that further Base64 decodes and LZMA de-compresses a payload stored at its end, ultimately leading to the execution of the Cobalt Strike beacon downloader in memory.
• Type B Payload: This payload also starts with a legitimate executable, convert_moff_to_provider.exe (part of the Windows SDK), which DLL sideloads wmicodegen.dll. This DLL is another shellcode loader, but it is heavily obfuscated using control flow flattening and exception handlers to hinder both static and dynamic analysis. Intriguingly, this loader was developed based on a code sample named simpleHDRPC12 from the Xbox ATG (Advanced Technology Group) group. Research into this code sample led to a significant discovery: in July of the current year, Kaspersky identified a similar loader used by APT41 for stealer malware. Both loaders shared the same DLL sideloading binary, the same core code sample, and were used in attack campaigns within a similar timeframe (potentially extending into 2025 as stated in the talk). This strong correlation suggests a medium confidence that APT27 and APT41 might be sharing malware code, particularly for their loaders.
• C2 Endpoint: Both Type A and Type B loaders communicated with the domain cdn.windows-errorapis.com to retrieve their payloads. This domain resolved to a host serving as a Cobalt Strike C2 server and was observed to use a unique SSL certificate.

Pandora Rootkit and NDIS Proxy

The most sophisticated components observed were the updated Pandora rootkit and the NDIS proxy backdoor:

• Pandora Rootkit and RAT: Pandora is APT27's flagship passive backdoor, consisting of both a rootkit and a RAT (Remote Access Trojan) module, both developed in C++. Initially discovered by Trend Micro in 2021, the current samples show significant updates.
• Infection Flow: The process begins with a batch file, in.bat, which decompresses a password-protected RAR archive (VMware_x64.rar). Inside, it executes shell_run_as.exe, which is a renamed legitimate list.exe from Microsoft Sysinternals. This executable then DLL sideloads a malicious DLL named credui.dll.
• credui.dll: This DLL is a shellcode loader that self-decodes its own code. It reads the content of a file named update.url, XOR decodes it, LZNT1 decompresses it, and then executes it as shellcode in memory.
• Pandora Loader: The executed shellcode is a reflective DLL loader that loads Pandora_loader.dll. This loader prepares and loads the Pandora rootkit. It creates specific folders, moves extracted files, establishes a service for persistence, and creates registry keys containing the encrypted rootkit and RAT payloads. After these initial operations, Pandora_loader.dll injects the next stage payload, which executes the rootkit, into svchost.exe.
• BYOVD Technique: The injected payload then drops and loads two legitimate drivers: CPUZ141.sys and processhacker.sys. CPUZ141.sys is known to have a vulnerability, CVE-2017-15303, which allows arbitrary memory read/write. APT27 exploits this vulnerability to override the IOCTL (Input/Output Control) dispatch routine of processhacker.sys. This is a crucial update from previous Pandora versions, which directly turned off driver signature enforcement by accessing CPU control registers. The new BYOVD approach aims for a more fileless and stealthy rootkit loading procedure.
• Pandora Rootkit Functionality: Once loaded, the Pandora rootkit operates at the kernel level, providing capabilities to hide processes, files, registry keys, and any attacker-related artifacts. A significant update is the integration of code from the open-source hidden.is rootkit, which APT27 previously deployed separately. Combining these two rootkits likely aims to decrease detection risk by security products.
• Pandora RAT Functionality: The Pandora RAT module is injected into lsass.exe. It functions as an HTTPS server listening on TCP port 443. It processes requests sent to a specific path (e.g., /OWA/O_images/, noting a potential typo in O_images). The server verifies incoming HTTP requests by checking for a POST method and a specific string in the Cookie header. If these checks pass, the RAT handles commands embedded in the HTTP request body. Commands supported include file, process, and service manipulation, SOCKS5 proxy functionality, remote shell access, and the ability to relay HTTP requests to other infected hosts.
• Windows Filtering Platform (WFP) Abuse: Beyond port 443, the Pandora rootkit can also handle attacker commands filtered using the Windows Filtering Platform (WFP). WFP is a platform for developing application firewalls. This mechanism allows APT27 to stealthily access compromised hosts even if port 443 is already in use by a legitimate service (like IIS) or if the Pandora RAT fails to listen on that port, providing an out-of-band control channel.
• IOCTL Codes: The rootkit implements several IOCTL codes accessible from the RAT and potentially other payloads. One identified IOCTL code has the capability to disable PPL (Protected Process Light) for arbitrary processes, though it was not observed being used by the RAT itself, suggesting additional, unobserved payloads might leverage it.
• NDIS Proxy: This is another passive backdoor leveraged by APT27, offering similar but less extensive functionality compared to Pandora. While a new dropper payload for NDIS Proxy was observed in this campaign, the rootkit component it deploys remains the same as previously described in public reports (e.g., by Kaspersky, who has published detailed analyses).

Demo / Proof of Concept

▶ Watch: Detecting BYOVD attacks with event logs and Sysmon (20:30)

The presentation did not include a live demonstration or proof-of-concept of the observed tools and techniques. Instead, the speaker indicated that scripts useful for analyzing similar malware samples would be made available on GitHub. Additionally, a PDF version of the presentation slides, containing Indicators of Compromise (IOCs) such as malware configuration data, file hashes, and network indicators, was to be made available on the Virus Bulletin website after the talk. These resources serve as practical tools for researchers and defenders to further investigate and detect the threats discussed.

Defensive Implications

▶ Watch: Conclusion: Summary of APT27's updated TTPs and detection (22:00)

The sophisticated and evolving tactics of APT27 necessitate a multi-layered defensive strategy, focusing on proactive detection and robust endpoint security.

• Detecting BYOVD Attacks: The use of Bring Your Own Vulnerable Driver (BYOVD) for rootkit installation is a critical area for defenders.
• Event ID 7045 (System.evtx): This event is recorded when a service is installed on a system. If the Service Type indicates a kernel mode driver, it signifies a driver installation. While it's hard to distinguish malicious from legitimate drivers solely from this, checking the Service Name and Path provides a valuable pivot point. New driver installations are rare outside of system setup or update procedures, making this an anomalous event to monitor.
• Sysmon: Implementing Sysmon provides significantly enhanced visibility. It records the hash value and signature name of installed drivers, making it much easier to verify their legitimacy. Unusual driver hashes or unsigned drivers should trigger immediate alerts.
• Microsoft Vulnerable Driver Block List: For systems running Windows 22H2 or later, Microsoft's Vulnerable Driver Block List feature can prevent known vulnerable drivers (like CPUZ141.sys used by APT27) from loading. Ensuring this feature is enabled and updated is crucial.
• Event Logs for Blocked Drivers: Monitoring specific event logs is vital. Events generated when a driver installation is blocked due to security features or revoked certificates (e.g., similar to the upper and bottom-left figures or bottom-right figure mentioned in the talk) serve as strong indicators of attempted BYOVD attacks.
• Monitoring for Legitimate Tool Abuse:
• SoftEther VPN Server: Actively scan and monitor for instances of SoftEther VPN Server running on unexpected hosts or on unusual ports (e.g., 50443). Check for the presence of the SEVPNSERVER service. Analyze its configuration files for suspicious DDNS hostnames or unusual statistics.
• FRP (Fast Reverse Proxy): Look for frps.exe or frpc.exe processes. While command-line configuration makes detection harder, monitoring process command lines for suspicious parameters or network connections associated with FRP can still yield results.
• Endpoint Detection and Response (EDR) & Behavioral Analysis:
• DLL Sideloading: Implement EDR solutions capable of detecting DLL sideloading by legitimate executables (e.g., inetinfo.exe, convert_moff_to_provider.exe, shell_run_as.exe).
• Process Injection: Monitor for suspicious process injection into critical system processes like svchost.exe (for Pandora rootkit loading) and lsass.exe (for Pandora RAT).
• Kernel-Level Activity: Behavioral analysis should flag unusual kernel-level activity, such as attempts to modify IOCTL dispatch routines or hide processes/files, even if the rootkit successfully loads.
• Network Monitoring:
• Cobalt Strike C2: Continuously monitor network traffic for connections to known Cobalt Strike C2 indicators, including domains like cdn.windows-errorapis.com and suspicious SSL certificate characteristics.
• Pandora RAT C2: Look for HTTPS traffic on port 443 directed to specific paths (e.g., /OWA/O_images/) with unusual POST requests and specific Cookie header values.
• WFP Anomalies: Advanced network monitoring and firewall logging should be configured to detect and alert on unusual activity related to the Windows Filtering Platform (WFP), which could indicate out-of-band C2 communications.
• Patch Management: Ensure all systems, especially servers, are fully patched against known vulnerabilities, including older exploits like EFS Potato, as APT27 still targets these.

Key Takeaways

• APT27's Evolving TTPs: The group continues to evolve its tactics, incorporating legitimate software like SoftEther VPN Server for stealthy, persistent access and modifying tools like FRP to evade forensic detection.
• Sophisticated Rootkit Deployment: The updated Pandora rootkit demonstrates advanced evasion techniques, including BYOVD (exploiting CVE-2017-15303 in CPUZ141.sys) for fileless loading and integrating hidden.is for enhanced stealth at the kernel level.
• Potential Code Sharing Among APTs: The strong similarities between APT27's Type B Cobalt Strike loader and a loader used by APT41 suggest possible code sharing or collaboration between these prominent China-nexus threat actors.
• Cruciality of BYOVD Detection: Effective detection of BYOVD attacks is paramount. Leveraging tools like Sysmon, monitoring Event ID 7045, and utilizing features like the Microsoft Vulnerable Driver Block List are essential defensive measures.
• Multi-Channel C2 for Resilience: The Pandora RAT employs resilient C2 mechanisms, using HTTPS on port 443 with specific paths and cookie verification, and can also leverage the Windows Filtering Platform (WFP) for out-of-band control, even if standard listening ports are unavailable.
• Proactive Threat Intelligence and Research: The unique observation of APT27's exposed infrastructure highlights the immense value of proactive threat intelligence and research for understanding and countering advanced persistent threats.

About the Speaker(s)

Naoki Takayama is a Security Researcher at Internet Initiative Japan (IIJ), a leading Japanese commercial ISP company. He is an active member of IIJ SEC, the private CSIRT group within the IIJ group. In his daily role, Naoki is responsible for both threat research and incident response. His research primarily focuses on analyzing the tactics and malware employed in targeted attacks, with a specific emphasis on campaigns affecting Japan and other Asian countries. He maintains an active presence on X (formerly Twitter) for professional engagement and contact.