Billbug Apt: Intercepting Https Traffic And Attacking Digital Certificate Authority

The Billbug APT hackers group, also known as Lotus Blossom and Thrip, has been actively conducting cyber attacks since 2009, primarily targeting government and defense agencies. In their most recent attack, the group successfully compromised a digital certificate authority, resulting in significant consequences for several Asian countries. This breach has led to numerous victims being compromised, raising concerns about the issuance of valid digital certificates for malware and the interception of HTTPS traffic. The attackers utilized publicly available tools such as AdFind, Winmail, WinRAR, Ping, and Tracert, along with a penetration testing tool called Stowaway. Furthermore, they employed a backdoor named Sagerunex, employing AES256-CBC encryption with SHA256. The primary motive behind the attack appears to be data theft from the certificate authority and government victims, presumably for espionage purposes. The Billbug APT group demonstrates extensive attack capabilities and continues to persistently target government and defense agencies. The campaign has had a significant impact on government, defense, and certificate authority networks.

Key Takeaways

• Billbug APT hackers group, also known as Lotus Blossom and Thrip, have been active since 2009 and have previously targeted government and defense agencies in 2018 and 2019.
• The group compromised a digital certificate authority, impacting multiple Asian countries and potentially issuing valid digital certificates for malware and intercepting HTTPS traffic.
• The attackers utilized publicly available tools such as AdFind, Winmail, WinRAR, Ping, and Tracert, as well as a penetration testing tool called Stowaway and a Sagerunex backdoor.
• The campaign had motivations of data theft from certificate authorities and government victims, likely for espionage purposes, and involved highly skilled actors with extensive attack capabilities.

APT Hackers Group

The Billbug APT hackers group, also known as Lotus Blossom and Thrip, has been active since 2009 and has previously targeted government and defense agencies in 2018 and 2019, demonstrating their long-standing presence and focus on high-profile targets. This group employs advanced persistent threat (APT) hacker techniques, utilizing sophisticated tools and strategies to compromise their victims. Their attacks have prompted government countermeasures to enhance cybersecurity and defense against such threats. The Billbug APT group’s ability to persistently target and infiltrate government networks highlights the need for robust security measures and continuous monitoring to detect and mitigate potential breaches. The group’s motivations and capabilities indicate a high level of sophistication and expertise, making them a significant concern for government entities and organizations dealing with sensitive information. Understanding and countering the tactics employed by APT hacker groups like Billbug is crucial for maintaining the security and integrity of critical systems and data.

Compromise of Certificate Authority

Compromising the certificate authority resulted in the potential issuance of valid digital certificates for malicious purposes and the interception of encrypted network communications. This breach had significant implications for the affected parties. Here are four key points to consider:

1. Targeted Networks: The attackers specifically targeted government and certificate authority networks in multiple Asian countries. This suggests a sophisticated and well-planned operation.

2. Wide-scale Compromise: The compromise of the certificate authority resulted in a large number of victims being compromised. This included government agencies and defense organizations, which could have serious national security implications.

3. Malware and Traffic Interception: The attackers utilized a variety of dual-use and living-off-the-land tools to carry out their operation. These tools allowed them to infect systems, intercept HTTPS traffic, and potentially gain access to sensitive information.

4. Dangers of Digital Certificates: The hackers‘ ability to issue valid digital certificates for malware purposes raises concerns about the overall trust and security of digital certificates. This breach highlights the need for robust security measures to protect against such attacks in the future.

Malware Attack Infection Chain

Utilizing a range of tools and techniques, the attackers implemented a sophisticated malware attack infection chain to infiltrate targeted networks and potentially gain unauthorized access to sensitive information. The Billbug APT hackers group employed publicly available tools such as AdFind, Winmail, WinRAR, Ping, Tracert, Route, NBTscan, Certutil, and Port Scanner. These tools were used to query Active Directory, open winmail.dat files, archive or zip files, determine network responsiveness, and trace packet paths. Additionally, the group utilized a penetration testing tool called Stowaway, written in the Go language, which allowed for unauthorized access and control. The attackers employed a loader malware that dropped the Sagerunex backdoor, which utilized AES256-CBC encryption with SHA256 for communication with its command and control (CC) server. Symantec analyzed the encryption algorithm used for network communication and identified the presence of encrypted logs.

Encryption and Communication

By employing advanced encryption algorithms and establishing communication with their command and control server, the attackers demonstrated a calculated and meticulous approach to ensure the secrecy and integrity of their operations. Symantec’s analysis of encryption and communication methods in the Billbug APT attack revealed the following:

• The Sagerunex backdoor used AES256-CBC encryption with SHA256, indicating a strong level of encryption to protect their activities.
• Logs found during the investigation were encrypted, further highlighting the attackers‘ efforts to conceal their actions.
• The attackers utilized network communication to maintain contact with their command and control server, allowing them to receive instructions and exfiltrate stolen data.
• Symantec analyzed the communication logs, providing valuable insights into the attackers‘ tactics and techniques.

This analysis underscores the sophistication and technical capabilities of the Billbug APT group, demonstrating their commitment to maintaining operational security and evading detection.

Campaign Impact and Attribution

The impact of the Billbug APT campaign and the attribution to state-sponsored hackers has had significant consequences on government, defense, and Certificate Authority networks. The campaign has resulted in the compromise of multiple targets simultaneously, leading to widespread damage and potential data theft. The attackers have demonstrated extensive attack capabilities and persistence, targeting government and defense agencies with highly skilled actors and sophisticated tools and backdoors. The attribution analysis has firmly established the involvement of the Billbug APT group, a state-sponsored hacking group known for their previous attacks. The ongoing nature of the campaign raises concerns about the security of government and defense networks, as well as the integrity of digital certificate authorities. The impact assessment highlights the urgent need to strengthen security measures and enhance defenses against such advanced threats.

Frequently Asked Questions

How did the Billbug APT hackers group compromise the digital certificate authority?

The Billbug APT hackers group compromised the digital certificate authority by exploiting vulnerabilities within the network. They maintained persistence by using backdoor malware, such as the Sagerunex backdoor, which allowed unauthorized access and control.

Which tools did the Billbug attackers use in their malware attack infection chain?

The Billbug APT group used a variety of tools in their malware attack infection chain. These tools included AdFind, Winmail, WinRAR, Ping, Tracert, Route, NBTscan, Certutil, Port Scanner, and the penetration testing tool Stowaway. These tools allowed the attackers to evade detection and gain unauthorized access and control. The role of social engineering in the attack is not mentioned in this information.

What encryption algorithm was used by the Sagerunex backdoor for communication with the command and control server?

The Sagerunex backdoor utilized an encryption algorithm of AES256-CBC with SHA256 for its HTTPS communication with the command and control server. This encryption ensured the confidentiality and integrity of the communication between the backdoor and the server.

What is the motivation behind the Billbug APT group’s targeting of government victims?

The motivation behind the Billbug APT group’s targeting of government victims appears to be data theft, particularly from certificate authorities and government agencies. Their highly skilled actors likely engage in espionage and steal legitimate digital certificates.

What is the impact of the Billbug APT group’s attacks on government, defense, and certificate authority networks?

The impact of the Billbug APT group’s attacks on government, defense, and certificate authority networks includes compromise of critical infrastructure and potential interception of HTTPS traffic. Strategies for defending against APT attacks involve implementing robust security measures and continuously monitoring network activity.