FireEye investigated on the attacks revealing that they targeted organizations in Japan, according evidences collected behind the Operation DeputyDog there is the same threat actor that compromised Bit9 in February 2013, when during the hack were stolen digital certificates used later in further attacks to sign malware. The payload used in these attacks on August 23th 2013 against entities in Japan was hosted on a server in Hong Kong with IP address equal to 210.176.3.130. Despite the payload is named img20130823.jpg in reality it is  an executable, once run it writes a dll named “28542CC0.dll” in the following path:

C:\Documents and Settings\All Users\Application Data\28542CC0.dll

To be able to execute the malware on every machine restarts the malicious agent also adds this registry key:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\28542CC0 rundll32.exe “C:\Documents and Settings\All Users\Application Data\28542CC0.dll”,Launch

The malware connects to a host in South Korea (180.150.228.102), it is curious that callback traffic is not encrypted HTTP over port 443.  The FireEye security experts identified the signature for the attacks that allowed the detection of at least 5 samples that were compiled on 2013-08-19, within 1 second of each other.

The malicious domains identified are:

Campaign such as the Operation DeputyDog are the demonstration that groups of persistent collectors are very active and use sophisticated techniques for their attacks. The hackers exploited the knowledge of a zero-day during last attacks, circumstance that lets me think of the responsibility of state-sponsored hackers. Governments are primary entities that exploit zero-day flaws during their attack, cybercrime ecosystem in fact is more oriented in the sale of these exploits instead to use it for illegal activities. If you are interested to go deep in the technical analysis of the ATP read the following post published by FireEye.

Pierluigi Paganini

(Security Affairs –  FireEye, Operation DeputyDog, cyberespionage)

[adrotate banner=”5″]

[adrotate banner=”13″]