Recorded Future Research Concludes Chinese Ministry of State Security Behind APT3
This is the first time researchers have been able to attribute a threat actor group with a high degree of confidence to the Ministry of State Security.
Key Takeaways
- APT3 is the first threat actor group that has been attributed with a high degree of confidence directly to the Chinese Ministry of State Security (MSS).
- On May 9, a mysterious group called “intrusiontruth” attributed APT3 to a company, Guangzhou Boyu Information Technology Company, based in Guangzhou, China.
- Recorded Future’s open source research and analysis has corroborated the company, also known as Boyusec, is working on behalf of the Chinese Ministry of State Security.
- Customers should re-examine any intrusion activity known or suspected to be APT3 and all activity from associated malware families as well as re-evaluate security controls and policies.
Introduction
El 9 de mayo, un grupo misterioso que se hacía llamar "intrusiontruth" identificó a un contratista del Ministerio de Seguridad del Estado chino (MSS) como el grupo responsable de las intrusiones cibernéticas de APT3.
Recorded Future timeline of APT3 victims.
Screenshot of a blog post from “intrusiontruth in APT3.”
"Intrusiontruth" documentó conexiones históricas entre dominios utilizados por una herramienta APT3 llamada Pirpi y dos accionistas de una empresa china de seguridad informática llamada Guangzhou Boyu Information Technology Company, Ltd (también conocida como Boyusec).
Registration information for a domain linked to the malware Pirpi. The details show the domain was registered to Dong Hao and Boyusec.
APT3 has traditionally targeted a wide-range of companies and technologies, likely to fulfill intelligence collection requirements on behalf of the MSS (see research below). Recorded Future has been closely following APT3 and has discovered additional information corroborating that the MSS is responsible for the intrusion activity conducted by the group.
Recorded Future Intelligence Card™ for APT3.
Background
APT3 (también conocido como UPS, Gothic Panda y TG-011) es un grupo de amenazas sofisticado que estuvo activo al menos desde 2010. APT3 emplea una amplia gama de herramientas y técnicas, incluyendo ataques de spearphishing, exploits de día cero y numerosas herramientas únicas y de acceso remoto (RAT) únicas y públicas. Las víctimas de las intrusiones de APT3 incluyen compañías de los sectores de defensa, telecomunicaciones, transporte y tecnología avanzada, así como departamentos y oficinas gubernamentales en Hong Kong, EE. UU. y varios otros países.
Analysis
En el sitio web de Boyusec, la compañía identifica explícitamente dos organizaciones con las que colabora de forma cooperativa: Huawei Technologies y el Centro de Evaluación de Seguridad de Tecnologías de la Información de Guangdong (o Guangdong ITSEC).
Captura de pantalla de la web de Boyusec donde están Huawei y Guangdong ITSEC
identificados como socios colaborativos.
In November 2016, the Washington Free Beacon reported that a Pentagon internal intelligence report had exposed a product that Boyusec and Huawei were jointly producing. According to the Pentagon’s report, the two companies were working together to produce security products, likely containing a backdoor, that would allow Chinese intelligence “to capture data and control computer and telecommunications equipment.” The article quotes government officials and analysts stating that Boyusec and the MSS are “closely connected,” and that Boyusec appears to be a cover company for the MSS.
Imagery ©2017 DigitalGlobe, Map data ©2017
Boyusec is located in Room 1103 of the Huapu Square West Tower in Guangzhou, China.
Boyusec’s work with its other “cooperative partner,” Guangdong ITSEC, has been less well-documented. As will be laid out below, Recorded Future’s research has concluded that Guangdong ITSEC is subordinate to an MSS-run organization called China Information Technology Evaluation Center (CNITSEC) and that Boyusec has been working with Guangdong ITSEC on a joint active defense lab since 2014.
El ITSEC de Guangdong es uno de una red nacional de centros de evaluación de seguridad certificados y gestionados por CNITSEC. Según medios estatales chinos, el ITSEC de Guangdong se convirtió en la decimosexta rama nacional de CNITSEC en mayo de 2011. El sitio de Guangdong ITSEC también se indica como Oficina de Guangdong de CNITSEC en su encabezado.
According to academic research published in China and Cybersecurity: Espionage, Strategy, and Politics in the Digital Domain, CNITSEC is run by the MSS and houses much of the intelligence service’s technical cyber expertise. CNITSEC is used by the MSS to “conduct vulnerability testing and software reliability assessments.” Per a 2009 U.S. State Department cable, it is believed China may also use vulnerabilities derived from CNITSEC’s activities in intelligence operations. CNITSEC’s Director, Wu Shizhong, even self-identifies as MSS, including for his work as a deputy head of China’s National Information Security Standards Committee as recently as January 2016.
Recorded Future research identified several job advertisements on Chinese-language job sites such as jobs.zhaopin.com, jobui.com, and kanzhun.com since 2015, Boyusec revealed a collaboratively established joint active defense lab (referred to as an ADUL) with Guangdong ITSEC in 2014. Boyusec stated that the mission of the joint lab was to develop risk-based security technology and to provide users with innovative network defense capabilities.
Job posting where Boyusec highlights the joint lab with Guangdong ITSEC. The translated text is, “In 2014, Guangzhou Boyu Information Technology Company and Guangdong ITSEC cooperated closely to establish a joint active defense lab (ADUL).”
Conclusion
El ciclo de vida de APT3 es emblemático de cómo el MSS realiza operaciones tanto en el ámbito humano como en el cibernético. Según los estudiosos de la inteligencia china, el MSS está compuesto por elementos nacionales, provinciales y locales. Muchos de estos elementos, especialmente a nivel provincial y local, incluyen organizaciones con misiones públicas válidas que sirven de tapadera para las operaciones de inteligencia del MSS. Algunas de estas organizaciones incluyen think tanks como CICIR, mientras que otras incluyen gobiernos a nivel provincial y oficinas locales.
In the case of APT3 and Boyusec, this MSS operational concept serves as a model for understanding the cyber activity and lifecycle:
- While Boyusec has a website, an online presence, and a stated “information security services” mission, it cites only two partners, Huawei and Guangdong ITSEC.
- Intrusiontruth and the Washington Free Beacon have linked Boyusec to supporting and engaging in cyber activity on behalf of the Chinese intelligence services.
- Recorded Future’s open source research has revealed that Boyusec’s other partner is a field office for a branch of the MSS. Boyusec and Guangdong ITSEC have been documented working collaboratively together since at least 2014.
- Academic research spanning decades documents an MSS operational model that utilizes organizations, seemingly without an intelligence mission, at all levels of the state to serve as cover for MSS intelligence operations.
- According to its website, Boyusec has only two collaborative partners, one of which (Huawei) it is working with to support Chinese intelligence services, the other, Guangdong ITSEC, which is actually a field site for a branch of the MSS.
Graphic displaying the relationship between the MSS and APT3.
Impact
Las participaciones son claras y amplias. La investigación de Recorded Future nos lleva a atribuir APT3 al Ministerio de Seguridad del Estado chino y a Boyusec con un alto grado de confianza. Boyusec tiene un historial documentado de producción de tecnología maliciosa y de colaboración con los servicios de inteligencia chinos.
APT3 is the first threat actor group that has been attributed with a high degree of confidence directly to the MSS. Companies in sectors that have been victimized by APT3 now must adjust their strategies to defend against the resources and technology of the Chinese government. In this real-life David versus Goliath situation, customers need both smart security controls and policy, as well as actionable and strategic threat intelligence.
APT3 is not just another cyber threat group engaging in malicious cyber activity; research indicates that Boyusec is an asset of the MSS and their activities support China’s political, economic, diplomatic, and military goals.
El MSS deriva los requisitos de recopilación de inteligencia de los líderes estatales y partidistas, muchos de los cuales se definen ampliamente cada cinco años en directivas oficiales del gobierno llamadas Planes Quinquenales. Muchas víctimas de APT3 cayeron en sectores destacados por el Plan Quinquenal más reciente, incluyendo energías verdes/alternativas, ciencia y tecnología relacionadas con la defensa, biomedicina y aeroespacial.