Scope Note: Recorded Future analyzed new malware targeting the Tibetan community, resulting in a detailed analysis of the malware and its associated infrastructure. Sources include Recorded Future’s platform, VirusTotal, ReversingLabs, and third-party metadata, as well as common OSINT and network metadata enrichments, such as DomainTools Iris and PassiveTotal. This research is part of a series highlighting the breadth of sophisticated techniques used by the Chinese state against perceived domestic threats.​​ 

Executive Summary​​ 

Following our research uncovering the Chinese RedAlpha campaigns targeting the Tibetan community, Recorded Future’s Insikt Group identified a novel Linux backdoor called “ext4,” deployed against the same Tibetan victim group. By analyzing the backdoor, we uncovered repeated attempted connections to the same compromised CentOS web server emanating from infrastructure registered to Tsinghua¹ University, an elite Chinese academic institution.​​ 

We also identified network reconnaissance activities being conducted from the same Tsinghua University infrastructure targeting many geopolitical organizations, including the State of Alaska Government, Alaska’s Department of Natural Resources, the United Nations office in Nairobi, and the Kenya Ports Authority. Additionally, we identified the targeted scanning of German automotive multinational Daimler AG that began a day after it cut its profit outlook for the year, citing the growing trade tensions between the U.S. and China. In several cases, these activities occurred during periods of Chinese dialogue for economic cooperation with these countries or organizations.​​ 

We assess with medium confidence that the network reconnaissance activities we uncovered were conducted by Chinese state-sponsored actors in support of China’s economic development goals.​​ 

Key Judgments​​ 

• Tsinghua IP 166.111.8[.]246 engaged in network reconnaissance targeting organizations in Alaska, Kenya, Brazil, and Mongolia during times of economic dialogue or publicity around China’s investment in foreign infrastructure projects concerning China’s flagship Belt and Road Initiative (BRI).​​ 
• The network reconnaissance activity against Alaskan organizations increased following the governor of Alaska’s trade delegation trip to China in late May. Organizations targeted by the reconnaissance activity were in industries at the heart of the trade discussions, such as oil and gas.​​ 
• The targeting of German automotive multinational Daimler AG was observed a day after it announced a profit warning in light of the growing U.S. and China trade tensions.​​ 
• The Tsinghua IP made at least one attempt to subscribe to a U.S.-based hotel’s high-speed internet portal. We assess with low confidence that this may demonstrate an intent to breach Nomadix internet gateways within the hospitality sector running vulnerable WindWeb servers.​​ 
• The Tsinghua IP repeatedly attempted to connect with a Tibetan network that was compromised with a highly sophisticated backdoor, “ext4.”​​ 
• “ext4” only allowed incoming TCP 443 connections to the compromised network during a 180-second window every hour, with packets requring a unique combination of TCP header options to successfully connect. In over 20 observed attempts, the Tsinghua IP did not transmit the correct TCP options to activate the backdoor. This suggested:​​ 
• The threat actors connecting from the Tsinghua IP were ill-informed of the correct “ext4” backdoor connection sequence and were making mistakes.​​ 
• The targeting of the Tibetan network is not associated with the presence of the “ext4” backdoor and the network was being probed in line with wider geopolitical and economic network reconnaissance activity being conducted by the Tsinghua IP.​​ 

Background​​ 

La República Popular China (RPC) reclama la soberanía sobre el Tíbet y considera todos los movimientos independentistas tibetanos como amenazas separatistas. Aunque la RPC utiliza muchas formas de coacción contra la comunidad tibetana, el ciberespionaje contra objetivos tibetanos se ha convertido en una herramienta frecuente, especialmente en tiempos de tensiones elevadas. El primer incidente conocido de ciberespionaje chino contra el Tíbet, denominado GhostNet, fue en 2008. Esto formaba parte de un intento más amplio de vigilar objetivos extranjeros de interés nacional. Desde entonces, se han documentado numerosas campañas de ciberespionaje contra los tibetanos, incluyendo en el reciente informe RedAlpha de Recorded Future.​​ 

Tsinghua University is located in the Haidian District in Beijing. Dubbed “China’s MIT,” it is one of China’s premier technical research universities. Chinese universities have often been associated with Chinese state-sponsored cyber capabilities both directly and indirectly. In 2015, APT17 infrastructure was connected to a professor at China’s Southeast University, and in 2017, the People’s Liberation Army (PLA) partnered with Xi’An Jiaotong University to create a cyber militia program. Tsinghua University is itself a state-owned institution and is among the world’s top research and engineering schools. Its students’ offensive cyber capabilities are most famous through Blue-Lotus, a security research team composed of Tsinghua University-affiliated individuals. The team finished second in DEF CON’s 2016 capture the flag competition.​​ 

Research branches of Tsinghua University also have connections to state organizations with a history of stealing U.S. technology. Tsinghua University’s Office of Scientific Research and Development met with China CITIC Group for Communist Party meeting activities in May 2018, during which they discussed strategic cooperation between enterprises and research institutes to serve the development of the country. In the 1999 Select Committee on U.S. National Security and Military/Commercial Concerns with the PRC (the so-called “Cox Report”), CITIC was linked to PLA covert operations and the theft of sensitive U.S. technology. The Cox Report also cited an attempt in 1990 by CITIC to acquire a U.S. aircraft parts manufacturer on behalf of the PLA in order to access U.S. export-controlled aerospace technology. Further, CITIC’s former chairman, Wang Zhen, was involved in the 1996 Poly Technologies indictment stemming from the company’s attempt to smuggle 2,000 Chinese AK-47 assault rifles into the United States.​​ 

El Instituto de Sistemas de Información e Ingeniería de Tsinghua también está convertido en miembro abiertamente a los programas nacionales chinos 863 y 973. El Programa 863, también conocido como el Plan Estatal de Desarrollo de Alta Tecnología, se centra en el desarrollo de las capacidades nacionales dentro de las industrias tecnológicas clave de China, mientras que el Programa 973, establecido por primera vez en 1997, se centra en el desarrollo de las tecnologías básicas necesarias para lograr la superioridad tecnológica en las industrias clave. Ambos programas tuvieron el efecto de facilitar a China el robo de propiedad intelectual para lograr los objetivos del programa.​​ 

In the past 10 years, a number of Chinese state-sponsored cyber threat actors have been identified conducting widespread cyberespionage directly reflecting China’s policy directives to gain scientific, technical, and economic advantage in key strategic industries. This activity can be observed most recently in operations by APT10 targeting managed IT service providers and APT17, which conducted massive supply chain attacks against the popular software product CCleaner in 2017.​​ 

Recorded Future timeline of Tsinghua IP activity in correlation with Tibetan protests.​​ 

Threat Analysis​​ 

Recorded Future discovered the presence of the “ext4” backdoor during our ongoing research into the targeting of the Tibetan community. This backdoor was configured to run on a Linux web server running CentOS and was stealthily designed to be embedded within a system file. The backdoor was mostly inactive other than during a three-minute window every hour when it would activate and accept incoming connections on TCP port 443.​​ 

In total, Recorded Future’s unique coverage enabled us to observe 23 attempted connections to the same compromised CentOS server between May and June 2018. Every attempt originated from the same IP, 166.111.8[.]246, which resolved to the China Education and Research Network Center. WHOIS records reveal that the IP sits within a large /16 CIDR range registered to an address at “Tsinghua University.”​​ 

A unique selection of options in the TCP header, set at the maximum possible segment size of 60 bytes, were observed in every packet that attempted to connect to the Tibetan network from the Tsinghua IP, as noted in the PCAP below.​​ 

PCAP of connection attempt from Tsinghua IP to compromised Tibetan CentOS server.​​ 

The “ext4” code appears to be unique, with no prominent traces online for code or naming similarity. Aside from our submission, no uploads of a backdoor resembling the key characteristics of “ext4” were observed in leading multi-scanner repositories as of August 3, 2018. A detection ratio of 0/58 in VirusTotal confirmed that the “ext4” sample we discovered was a new and unique backdoor targeting the Tibetan community.​​ 

A detailed analysis of the “ext4” binary can be found in the Technical Analysis section of this report.​​ 

Tsinghua University IP 166.111.8[.]246​​ 

This IP was first observed in Recorded Future on March 23, 2018, and resolved to the Chinese Education and Research Network Center (CERNET), according to several IP enrichment sources. CERNET is one of China’s six major backbone networks and is a catchall organization serving a large swath of addressable IP space reserved for Chinese academic and research institutes. As noted previously, WHOIS records confirm the IP sits within a range registered to “Tsinghua University.”​​ 

Los datos de escaneo de puertos disponibles revelaron que la IP está configurada actualmente con varios servicios en ejecución activa, incluidos PPTP (puerto TCP 1723), MySQL (3306) y MAMP (8888), así como los servicios más comunes OpenSSH (22), HTTP (80, 8080, 8008), SSL (443, 8443, 9443) y VPN IKE (500), entre otros. Los puertos HTTP parecían estar configurados como servidores sitio web NGINX, probablemente como proxies inversos o balanceadores de carga, dada la naturaleza de la actividad que observamos desde esta IP. La gran cantidad de puertos abiertos y servicios asociados indican que la IP de Tsinghua podría ser una puerta de enlace a Internet o un punto final de VPN.​​ 

Recorded Future Intelligence Card™ for Tsinghua IP 166.111.8[.]246.​​ 

Los enriquecimientos futuros grabados de la IP muestran que fue la fuente de escaneo, ataques de fuerza bruta e intentos de explotación activa en el pasado. Activó varias normas de riesgo, incluyendo ser señalado por la Oficina de Educación de la ciudad de Taichung en Taiwán, que rastrea indicadores cibernéticos maliciosos de origen chino, y aparece en una lista negra de AlienVault. El análisis de metadatos de la IP indica además que probablemente sea una pasarela, NAT o proxy, y que la verdadera máquina originadora de esta actividad está detrás de esta IP.​​ 

The same IP address was also observed conducting large-scale network reconnaissance of organizations that were engaged in key trade discussions with Chinese state-owned entities at the time. We believe these reconnaissance activities were not coincidental as they align broadly with China’s strategic and economic interests.​​ 

“Opportunity Alaska”​​ 

Between April 6 and June 24, 2018, we observed over one million IP connections between the Tsinghua IP and several networks in Alaska including:​​ 

• The Alaska Communications Systems Group​​ 
• Alaska Department of Natural Resources​​ 
• Alaska Power & Telephone Company​​ 
• State of Alaska Government​​ 
• TelAlaska​​ 

The vast number of connections between the Tsinghua IP and the above organizations relate to the bulk scanning of ports 22, 53, 80, 139, 443, 769, and 2816 on the Alaskan networks and were likely conducted to ascertain vulnerabilities and gain illegitimate access. The scanning activity was conducted in a systematic manner with entire IP ranges dedicated to the organizations probed for the above ports.​​ 

Este objetivo contra el Gobierno del Estado de Alaska siguió a la gran misión comercial de Alaska en China llamada "Alaska Oportunidad". Esta misión comercial tuvo lugar a finales de mayo y estuvo liderada por Bill Walker, gobernador de Alaska. Durante estas conversaciones, tuvo lugar una de las discusiones de mayor perfil en torno a la posibilidad de un gasoducto entre Alaska y China. A pesar del temor a una guerra comercial entre China y Estados Unidos, la oficina del gobernador Walker afirmó que la misión comercial "representaba algunas de las mejores opciones que Alaska tiene para ofrecer, y... [destacó] el amplio alcance de nuestros intereses compartidos con nuestro mayor socio comercial." Opportunity Alaska estaba formada por delegados de empresas de Alaska de los sectores de pesca, turismo, arquitectura e inversión, y realizó atajada en Pekín, Shanghái y Chengdu.​​ 

Network probing events conducted by Tsinghua IP targeting Alaskan institutions coinciding with Alaskan trade delegation to China in May 2018.​​ 

Recorded Future first observed the scanning activity against Alaskan networks in late March, only a few weeks after Gov. Walker announced a trade delegation to China. The activity picked up for a few days prior to the delegation arriving on May 20, 2018, and dropped off as the delegation arrived. Probing of the Alaskan networks remained at low levels until May 28 as the delegation concluded its activities, then ramped up considerably as delegates left China. The spike in scanning activity at the conclusion of trade discussions on related topics indicates that the activity was likely an attempt to gain insight into the Alaskan perspective on the trip and strategic advantage in the post-visit negotiations.​​ 

Hubo un nuevo aumento de interés entre el 20 y el 24 de junio contra las redes del Estado de Alaska y del Departamento de Recursos Naturales de Alaska. Esto posiblemente fue en respuesta al anuncio del gobernador Walker el 19 de junio de que tenía la intención de visitar Washington D.C. para reunir con funcionarios estadounidenses y chinos y expresar sus preocupaciones sobre la creciente disputa comercial entre ambas naciones.​​ 

The “Belt and Road Initiative” and China’s Economic Goals​​ 

During the course of our research, we also observed the Tsinghua IP scan ports and probe government departments and commercial entities networks in Mongolia, Kenya, and Brazil. Each of these countries are key investment destinations as part of China’s Belt and Road Initiative.​​ 

La Iniciativa de la Franja y la Ruta (BRI) de China es uno de los programas más ambiciosos del presidente Xi Jinping. Concebido para proyectar la influencia geopolítica transformadora de China en todo el mundo, la escala y el alcance del proyecto no tienen precedentes. Pekín comprometió 4 billones de dólares en inversiones para proyectos de infraestructura y desarrollo en 65 países, que afectan al 70 por ciento de la población mundial y al 75 por ciento de las reservaciones energéticas mundiales. El proyecto está diseñado para conectar los principales centros económicos de Eurasia por tierra y mar, muchos de los cuales históricamente formaron parte de la antigua Ruta de la Seda hace dos mil años.​​ 

Según The Diplomat, "la BRI pretende estabilizar las periferias occidentales de China, reavivar su economía, impulsar instituciones económicas internacionales no occidentales, ganar influencia en otros países y diversificar proveedores/rutas comerciales mientras se evade el giro de Estados Unidos hacia Asia."​​ 

La Iniciativa de la Franja y la Ruta de China. Fuente: Instituto Mercator de Estudios Chinas, merics.org​​ 

The BRI also aims to further strengthen China’s geopolitical and economic influence in Africa, capitalizing on significant infrastructure investments made across the continent. Kenya in particular has commanded increased attention due to its strategic geographical advantage in China’s Maritime Silk Road Initiative (MSRI) — the sea-based component of China’s BRI initiative.​​ 

Earlier this year, Kenya announced that it would be lobbying for regional projects under the BRI. China has already funded a 480-kilometer railway between the Kenyan port city of Mombasa and its capital, Nairobi; the railway is eventually expected to extend to neighboring countries Uganda, Rwanda, and Burundi as well. However, in May 2018, Kenya announced that it would not sign a free trade deal with China that had been under discussion with East African Community (EAC) states, raising tensions between Beijing and Nairobi.​​ 

In early June 2018, we observed the Tsinghua IP address aggressively scanning ports 22, 53, 80, 389, and 443 of various Kenyan internet-hosting providers and telecommunications companies, as well as ranges dedicated to the Kenya Ports Authority, a state corporation responsible for the maintenance and operation of all of Kenya’s seaports. Recorded Future also identified network reconnaissance activities directed at the United Nations Office in Nairobi, Kenya’s Strathmore University, and a broader national education network.​​ 

This chart below shows a clear spike in network reconnaissance activity against Kenyan organizations from the Tsinghua IP. This spike occurred merely two weeks after Kenya announced its intentions not to support the China-EAC free trade agreement.​​ 

Network recon events conducted by Tsinghua IP targeting Kenyan institutions overlayed with key China-Kenya economic developments, March 2018 to June 2018.​​ 

In April of this year, President Xi added Brazil to the list of countries receiving Chinese investment in infrastructure from the BRI. Funding for a new $520 million port in the northeastern state of Maranhão was announced, building on the extensive 2016 Chinese investment into the education and energy sectors in another Brazilian state, Amapá.​​ 

Our research uncovered repeated attempts from the Tsinghua IP to connect to the Ministério Público do Estado Do Amapá in Brazil (Public Ministry of the State of Amapá) between April 2 and June 11, 2018, just one month after Beijing-based China Communications Construction Co. began construction on the Maranhão port.​​ 

We also observed repeated attempts to connect to organizational networks such as the National Data Center Building in Mongolia and the Mongolian University of Science and Technology between April 6 and April 12, 2018. Mongolia also plays a vital role in China’s BRI plans; the overland component of the BRI, known as the Silk Road Economic Belt (SREB), proposes a new Eurasia land bridge and no less than five new economic corridors, including a China-Mongolia-Russia corridor.​​ 

We assess with medium confidence that the consistent reconnaissance activity observed from the Tsinghua IP probing networks in Kenya, Brazil, and Mongolia aligns closely with the BRI economic development goals, demonstrating that the threat actor using this IP is engaged in cyberespionage on behalf of the Chinese state.​​ 

Recorded Future timeline of Tsinghua IP activity in correlation with Opportunity Alaska and key BRI announcements.​​ 

The Impact of Growing U.S. and China Trade Tensions​​ 

On June 20, 2018, German multinational automotive corporation Daimler AG was the first prominent company to cut its profit outlook due to the escalating trade tensions between the U.S. and China. The next day, on June 21, we observed network reconnaissance activity specifically targeting ports 139, 22, 443, and 53 on networks resolving to Daimler AG. The probes originated from the same Tsinghua University IP.​​ 

Tsinghua IP probing Daimler AG networks on ports 139, 22, 443, and 53 between June 20 to 24, 2018.​​ 

Interaction With U.S. Managed Hotel Network Solutions Provider​​ 

Una consulta Shodan en la IP de Tsinghua devolvió una respuesta HTTP 302 que servía a “snap.safetynetaccess.com”. Aviso de redireccionamiento. Safety NetAccess, con sede en Needham, Massachusetts, construye redes inalámbricas para hoteles, complejos turísticos y otras propiedades públicas; entre sus clientes se incluyen las cadenas hoteleras Hilton, Marriott, Sonesta y Wyndham. Según el sitio web de Safety NetAccess, SNAP es su "programa de software avanzado de back-end" que proporciona a los agentes de Safety NetAccess "atajo a todos y cada uno de los equipos gestionados en cualquier ubicación". Aunque los campos que aparecen en el aviso de redireccionamiento puedan parecer confusos, corresponden a los parámetros de la página del portal de Nomadix Internet Gateways, el principal proveedor de equipos de enrutamiento y puerta de enlace de Safety NetAccess.​​ 

Shodan query reveals Tsinghua IP 166.111.8[.]246 “subscribed” to a Safety NetAccess portal.​​ 

The HTTP header response (above) showed that the Cox Communications IP 98.180.88[.]145 was originally requested by the “subscriber” (SIP), the Tsinghua IP 166.111.8[.]246. Navigating to the Cox Communications IP redirects users to a Safety NetAccess guest internet portal at a Holiday Inn hotel based in Ocala, Florida.​​ 

Safety NetAccess portal login for a Holiday Inn in Ocala, Florida.​​ 

Al desglosar la URL en el campo "Ubicación" en la respuesta HTTP obtenemos la dirección MAC del dispositivo Tsinghua (00:13:5F:07:87:D9) y la dirección IP del dispositivo Nomadix (68.105.161[.]74), se muestra como UIP en la URL. La dirección IP única (UIP) apunta a Cox Communications en Ocala, Florida, y las investigaciones de código abierto indican que el dispositivo que aloja esta UIP es una puerta de enlace a Internet AG 3100 Nomadix montada en rack, que admite DNS y redirección HTTP mediante una IP mágica. Esta UIP también parece estar ejecutando un servidor WindWeb vulnerable en el puerto 443. Los resultados de Shodan muestran intentos fallidos de inicio de sesión FTP en la puerta de enlace de Internet, así como eventos de Telnet.​​ 

From the limited data available to us, we assess with low confidence that the Tsinghua IP was attempting to leverage the remote administrative access controls enabled by Safety NetAccess’s SNAP portal for the Holiday Inn hotel in Florida.​​ 

Is the “ext4” Backdoor Associated With the Tsinghua IP?​​ 

The discovery of the “ext4” backdoor on a Tibetan device enabled us to identify the wider targeting of the device from the Tsinghua University IP. However, none of the attempted connections to the Tibetan device from the Tsinghua IP resulted in the successful activation of the backdoor, leaving it unclear whether the threat actors behind the widespread network recon activities were also responsible for the “ext4” backdoor.​​ 

That leaves us with two possible scenarios explaining the involvement of the “ext4” backdoor on a Tibetan network with the Tsinghua IP:​​ 

• The Tsinghua IP is being used by a threat actor to access the “ext4” backdoor, but a technical fault or operator error is resulting in the misconfiguration of the TCP connection packets required to establish communication with the backdoor.​​ 
• La propiedad intelectual Tsinghua se está empleando extensamente para realizar reconocimiento de redes y ciberespionaje contra intereses estratégicos, económicos y nacionales, no solo atacando países con los que China interactúa bajo la BRI, sino también organizaciones "Cinco ^{Venenos 2} ", como la red tibetana. Por tanto, es probable que la puerta trasera "ext4" pertenezca a otro actor amenazante que no participe en la actividad de escaneo de red contra las organizaciones descritas anteriormente en este reporte.​​ 

Technical Analysis​​ 

The “ext4” Backdoor​​ 

“ext4” backdoor key characteristics.​​ 

“ext4” is a novel Linux backdoor that was present on the victim network during the same time that the Tsinghua IP reconnaissance activity was observed (May to June, 2018). In total, 23 attempts to connect to the victim device over TCP 443 were made from the Tsinghua IP during this period.​​ 

La puerta trasera "ext4" fue identificada ejecutar dentro de un archivo legítimo "cron" del sistema en un servidor sitio web CentOS comprometido convertido en miembro a la comunidad tibetana. Un análisis de archivos de sistema modificados reveló que el archivo "cron" "0anacron" fue modificado para ejecutar un binario no estándar llamado "ext4" ubicado en el directorio /usr/bin/ext4 del servidor comprometido. El binario estaba configurado para ejecutar cada hora y, curiosamente, como proceso en segundo plano. Esto suprimiría cualquier salida que apareciera en la salida estándar del terminal Linux, haciéndola menos detectable para el administrador del servidor sitio web.​​ 

Modified etc/cron.hourly/0anacron script to include “ext4” backdoor function.​​ 

El binario "ext4" era relativamente pequeño, con solo 9511 bytes, y estaba compuesto por funciones simples. Estaba enlazado dinámicamente a la biblioteca libpcap, que está presente en sistemas Unix para permitir la captura de paquetes (archivos pcap ) que suelen usar los "sniffers de red".​​ 

There were three primary functions that drive the operation of the backdoor: “main,” “process,” and “my_pcap_handler.” All of these functions flow together to perform the main functionality of the backdoor.​​ 

Main Function​​ 

The main function performed three central tasks: to remove the file “tmp/0baaf161db39,” to create a child process that executes the backdoor functionality, and to set a sleep timer of 180 seconds. The process is terminated when the sleep timer limit is reached.​​ 

Additionally, the main function also checked the command line arguments to determine which network interface to monitor on the compromised network. By default, “ext4” used “eth0.”​​ 

Process Function​​ 

The main purpose of the process function was to create a handle to capture network traffic, which was done by use of the libpcap function, “pcap_open_live.”​​ 

Once the handle had been created, another libpcap function, “pcap_loop,” was executed, which processed all of the packets sent to the interface specified in “pcap_open_live” and sent them to the function “my_packet_handler” to parse and perform actions based on the type of packet sent.​​ 

“my_packet_handler” Function​​ 

All packets sent to a specified network interface were received by the “my_packet_handler” function. The handler then parsed the Ethernet, IP, and TCP headers³ to perform a series of checks to validate if it is a packet that it is meant to process. Once validated, the function decoded the payload, which would typically be a command fed to a bash shell on the compromised CentOS host.​​ 

The below steps demonstrate the parsing and validation criteria the function used to ensure that it processed the correct packets. If at any point the function receives unexpected results, the packet is dropped from the function and the next one is processed.​​ 

• Check the ethernet header to ensure the type is IP (Type 2048).​​ 
• IP header length is parsed from the IP header.​​ 
• Parse the IP header to ensure the protocol is TCP (Type 6).​​ 
• Parse the TCP header to ensure the destination port is 443.​​ 
• Find the data offset or the start of the payload.​​ 
• Check that the TCP flags equal 322, which equates to the following flags being set: NS (Nonce Sum), ECE (ECN-Echo), and SYN.​​ 

The breakdown of the flags is important, as it looks for the SYN and ECE to be set, as well as the NS flag. The NS flag is used to protect against accidental or malicious concealment of marked packets from the TCP sender.​​ 

La bandera ECE es responsable de indicar si el par TCP es compatible con la Notificación de Congestión Explícita (ECN). ECN es una extensión opcional de TCP que evita que los paquetes se pierdan debido a la congestión. Aunque el uso de ECN puede ser normal en grandes compañías con routers compatibles con ECN, el uso del bit NS parece experimental y no se emplea oficialmente en ninguna implementación TCP.​​ 

If a packet passes all of the criteria, the function gets the length of the payload and checks that it is between five and 1024 bytes. After that, it allocates memory and then saves the payload into memory.​​ 

The payload is XOR-encoded, and the first byte of the payload is the XOR key. The function will use the first byte of payload to decode the next five bytes and check to see if they equal the string “anti:.”​​ 

If the decoded bytes equal “anti:,” then the rest of payload will be decoded and passed as a final argument to run a bash command using the execl call.​​ 

Outlook​​ 

China continues to use cyber operations to monitor and track threats to domestic stability, neatly summarized as the “Five Poisons.” This focus on domestic threats enables security researchers to identify new campaigns and tools being aggressively used against persecuted communities. “ext4” is a sophisticated lightweight Linux backdoor designed to enable the threat actor to access the compromised device and conduct further malicious activity. It is also an example of a tool probably being used by Chinese nation-state actors to target the Tibetan community.​​ 

Further, the widespread use of CentOS servers, many of which are unpatched and used in production systems, highlights the breadth of the potential attack surface.​​ 

La Iniciativa de la Franja y la Ruta de China y su inversión a largo plazo en infraestructuras africanas permitieron a China ejercer una enorme influencia en los países afectados por estas políticas. Evaluamos con confianza media que las actividades de reconocimiento de redes generalizadas que emanan de la infraestructura de la Universidad de Tsinghua y que tienen como objetivo intereses económicos en Kenia, Mongolia y Brasil están dirigidas por el Estado.​​ 

China has repeatedly conducted cyberespionage in support of its national economic interests. In November 2017, the DOJ indicted three Chinese hackers found guilty of economic cyberespionage. Further, in its recent report on Foreign Economic Espionage in Cyberspace, the U.S. National Counterintelligence and Security Center highlighted Chinese threat actors APT10, KeyBoy, and Temp.Periscope as having conducted extensive cyberespionage in support of strategic national and economic benefit.​​ 

Other than the discovery of the “ext4” backdoor targeting the Tibetan community, we have not identified the presence of malware in any of the documented organizations in this report, as the bulk of our analysis was based on third-party metadata. However, we assess with medium confidence that the targeted scanning and probing of networks during the timeframe of bilateral trade and strategic dialogue between China and its Alaskan, Kenyan, Brazilian, and Mongolian counterparts indicates the activity is being conducted by a threat actor (or multiple threat actors with access to the same Tsinghua endpoint) directed by the Chinese state.​​ 

Network Defense Recommendations​​ 

Recorded Future recommends organizations conduct the following measures when defending against hostile network reconnaissance and the potential deployment of a CentOS backdoor from the Chinese threat actor detailed in this report:​​ 

• Configure your intrusion detection systems (IDS) and intrusion prevention systems (IPS) to alert and block connection attempts from Tsinghua University IP 166.111.8[.]246.​​ 
• Using the provided Yara rule for the “ext4” backdoor, conduct scans of any Linux hosts on networks for presence of the backdoor.​​ 
• If applicable, ensure the “ext4” Yara rule is deployed to the endpoint protection appliance used in your organization. Scan Linux hosts for the presence of the “/usr/bin/ext4” and “/tmp/0baaf161db39” files.​​ 

Additionally, we advise organizations to follow the following general information security best practice guidelines:​​ 

• Keep all software and applications up to date; in particular, operating systems, antivirus software, and core system utilities.​​ 
• Filter email correspondence and scrutinize attachments for malware.​​ 
• Make regular backups of your system and store the backups offline, preferably off-site so that data cannot be accessed via the network.​​ 
• Have a well-thought-out incident response and communications plan.​​ 
• Adhere to strict compartmentalization of company-sensitive data. In particular, look at which data anyone with access to an employee account or device would have access to (for example, through device or account takeover through phishing). Strongly consider instituting role-based access, limiting company-wide data access, and restricting access to sensitive data.​​ 
• Employ host-based controls — one of the best defenses and warning signals to thwart attacks is to conduct client-based host logging and intrusion detection capabilities.​​ 
• Implement basic incident response and detection deployments and controls like network IDS, netflow collection, host logging, and web proxy, alongside human monitoring of detection sources.​​ 
• Be aware of partner or supply chain security standards. Being able to monitor and enforce security standards for ecosystem partners is an important part of any organization’s security posture.​​ 

Consulte el apéndice en la versión PDF de este análisis para ver la lista completa de los indicadores asociados de compromiso.​​ 

¹Tsinghua University is also romanized as Qinghua University.​​ 

²The “Five Poisons” are threats the Chinese Communist Party sees to its stability, including Uyghurs, Tibetans, Falun Gong, the Chinese democracy movement, and Taiwan’s independence movement.​​ 

³For reference, we have provided a table in Appendix A that shows the offsets for the ethernet, IP, and TCP headers. This can be used to help follow how this function parses the headers.​​