Pierluigi Paganini August 28, 2017

Researchers at Proofpoint spotted a cyber espionage campaign leveraging recent Game of Thrones episode leaks and attribute it to Chinese APT17 group.

Security researchers at Proofpoint have uncovered a cyber espionage campaign leveraging recent Game of Thrones episode leaks to trick victims into opening malicious documents sent via email.

Experts have observed during the past week, the threat actor sending emails to victims with the subject of “Wanna see the Game of Thrones in advance?”

The malicious messages use weaponized documents booby-trapped with an embedded LNK file that runs a Powershell script to installs the 9002 remote access trojan and gain full access to the victim’s machine.

“Proofpoint recently observed a targeted email campaign attempting a spearphishing attack using a Game of Thrones lure. The malicious attachment, which offered salacious spoilers and video clips, attempted to install a “9002” remote access Trojan (RAT) historically used by state-sponsored actors.” reads the analysis published by Proofpoint.

The 9002 RAT was well known by experts in the IT security community, below a list of operations that involved it:

• Operation Aurora, an attack on companies such as Google, widely attributed to the Chinese government.
• Operation Ephemeral Hydra, a strategic website compromise utilizing an Internet Explorer zero-day [3], which FireEye attributed to an APT actor without a country attribution
• Attacks on Asian countries described by Palo Alto.

The experts attributed the attack to a cyber-espionage group tracked as Deputy Dog, Group 27, or APT17, that according to the reports of many security firms, is composed of Chinese hackers operating out of China.

Researchers found many similarities with a campaign conducted by the APT group far back as April 2014. Several ZIP compressed files containing a similar LNK downloader were uploaded to a malicious file scanning service.

“Based on several shared identifiers, it is possible that the recent campaigns were conducted by the same actor that conducted the campaigns in early- to mid-2014. The malicious LNK files in both campaigns (2014 vs. 2017) have the same Volume Serial Number of 0xCC9CE694. Furthermore, the LNK filename used in one of the campaigns this year is almost identical to the campaigns in 2014: Party00[1-35].jpg.lnk (2017) vs. Party-00[1-5].jpg.lnk (2014). Finally, the theme of party pictures and stock-JPGs used in both the 2017 and 2014 campaigns are extremely similar.” states the analysis. “Another possible similarity is the use of some of the code from the Java Reverse Metasploit-Stager [6] in the exploits previously analyzed by FireEye [7] as well as the PhotoShow.jar payload.”

The most popular campaign attributed to the APT17 group is the attack on the Google’s infrastructure, also known as Operation Aurora. For almost a decade the APT17 targeted government organizations in several Southeast Asian countries and the US, NGOs, defense contractors, law firms, IT firms, and mining companies.

The APT17 attempted to exploit the attention of the media on the HBO hack and the Game of Thrones leaks to increase the efficiency of their hacking campaign.

“Based on similarities in code, payload, file names, images, and themes, it is possible that this attack was carried out by a Chinese state-sponsored actor known as Deputy Dog.” concluded Proofpoint. “The use of a Game of Thrones lure during the penultimate season of the series follows a common threat actor technique of developing lures that are timely and relevant, and play on the human factor – the natural curiosity and desire to click that leads to so many malware infections. While Proofpoint systems blocked this attack, the use of such lures, combined with sophisticated delivery mechanisms and powerful tools like the latest version of the 9002 RAT can open wide doors into corporate data and systems for the actors behind these attacks”

Pierluigi Paganini

(Security Affairs – APT17, Game of Thrones)

[adrotate banner=”5″]

[adrotate banner=”13″]