Leaked Toolkit Exposes APT34’s Sophisticated Cyberattacks
- Actor Motivations: Espionage,Exfiltration
- Attack Vectors: Compromised Credentials,Vulnerability Exploitation,Backdoor,Malware,RAT
- Attack Complexity: High
- Threat Risk: High Impact/High Probability
Threat Overview
This NSFOCUS report details an analysis of a leaked toolkit belonging to the APT34 hacking group, also known for its similarities to OilRig. The report focuses on the toolkit's components, including Trojans such as Glimpse and PoisonFrog, and Webshells used for privilege escalation and data exfiltration, primarily targeting the energy and financial sectors, particularly in China and the Middle East. The analysis details the functionality and communication methods of the tools, which use DNS tunneling for command and control.
Detected Targets
| Type | Description | Confidence |
|---|---|---|
| Case | China Energy Conservation and Environmental Protection Group China Energy Conservation and Environmental Protection Group Corporation formerly known as China Energy Conservation Investment Corporation is a Beijing-based state-owned enterprise established in 1988 by the State Council of the People's Republic of China. China Energy Conservation and Environmental Protection Group has been targeted by APT34 as the main target. | Verified |
| Case | China Railway Construction Corporation China Railway Construction Corporation Limited (abbreviated CRCC) is a listed construction enterprise based in Beijing, China, that was the second largest construction and engineering company in the world by revenue in 2014. China Railway Construction Corporation has been targeted by APT34 as the main target. | Verified |
| Case | Western Securities Co., Ltd Western Securities Co., Ltd., which was founded and approved by the China Securities Regulatory Commission in January 2001, is a leading securities institution in northwest China with registered capital of 1billion RMB. Western Securities Co., Ltd has been targeted by APT34 as the main target. | Verified |
| Sector | Financial | Verified |
| Sector | Government Agencies and Services | Verified |
| Sector | Energy | Verified |
| Sector | Telecommunication | Verified |
| Sector | Transportation | Verified |
| Region | Albania | Verified |
| Region | Bahrain | Verified |
| Region | Cambodia | Verified |
| Region | China | Verified |
| Region | Egypt | Verified |
| Region | Israel | Verified |
| Region | Jordan | Verified |
| Region | Kuwait | Verified |
| Region | Lebanon | Verified |
| Region | Macau | Verified |
| Region | Mexico | Verified |
| Region | Myanmar | Verified |
| Region | Nigeria | Verified |
| Region | Palestine | Verified |
| Region | Qatar | Verified |
| Region | Saudi Arabia | Verified |
| Region | Somalia | Verified |
| Region | South Korea | Verified |
| Region | Taiwan | Verified |
| Region | Thailand | Verified |
| Region | Turkey | Verified |
| Region | United Arab Emirates | Verified |
| Region | Zimbabwe | Verified |
| Region | Middle East Countries | Verified |
Exploited Vulnerabilities
Extracted IOCs
- myleftheart[.]com
- 07e791d18ea8f2f7ede2962522626b43f28cb242873a7bd55fff4feb91299741
- 27e03b98ae0f6f2650f378e9292384f1350f95ee4f3ac009e0113a8d9e2e14ed
- 2943e69e6c34232dee3236ced38d41d378784a317eeaf6b90482014210fcd459
- 3ca3a957c526eaeabcf17b0b2cd345c0fffab549adfdf04470b6983b87f7ec62
- a6a0fbfee08367046d3d26fb4b4cf7779f7fb6eaf7e60e1d9b6bf31c5be5b63e
- b1d621091740e62c84fc8c62bcdad07873c8b61b83faba36097ef150fd6ec768
- c9d5dc956841e000bfd8762e2f0b48b66c79b79500e894b4efa7fb9ba17e4e9e
- dd6d7af00ef4ca89a319a230cdd094275c3a1d365807fe5b34133324bdaa0229
- fe1b011fe089969d960d2dce2a61020725a02e15dbc812ee6b6ecc6a98875392
Tip: 10 related IOCs (0 IP, 1 domain, 0 URL, 0 email, 9 file hash) to this threat have been found.
Overlaps
Source: IronNet - September 2019
Detection (one case): myleftheart[.]com
Source: Cyware - August 2019
Detection (nine cases): 07e791d18ea8f2f7ede2962522626b43f28cb242873a7bd55fff4feb91299741, 27e03b98ae0f6f2650f378e9292384f1350f95ee4f3ac009e0113a8d9e2e14ed, 2943e69e6c34232dee3236ced38d41d378784a317eeaf6b90482014210fcd459, 3ca3a957c526eaeabcf17b0b2cd345c0fffab549adfdf04470b6983b87f7ec62, a6a0fbfee08367046d3d26fb4b4cf7779f7fb6eaf7e60e1d9b6bf31c5be5b63e, b1d621091740e62c84fc8c62bcdad07873c8b61b83faba36097ef150fd6ec768, c9d5dc956841e000bfd8762e2f0b48b66c79b79500e894b4efa7fb9ba17e4e9e, dd6d7af00ef4ca89a319a230cdd094275c3a1d365807fe5b34133324bdaa0229, fe1b011fe089969d960d2dce2a61020725a02e15dbc812ee6b6ecc6a98875392
Source: Palo Alto Network - April 2019
Detection (seven cases): 27e03b98ae0f6f2650f378e9292384f1350f95ee4f3ac009e0113a8d9e2e14ed, 3ca3a957c526eaeabcf17b0b2cd345c0fffab549adfdf04470b6983b87f7ec62, a6a0fbfee08367046d3d26fb4b4cf7779f7fb6eaf7e60e1d9b6bf31c5be5b63e, c9d5dc956841e000bfd8762e2f0b48b66c79b79500e894b4efa7fb9ba17e4e9e, dd6d7af00ef4ca89a319a230cdd094275c3a1d365807fe5b34133324bdaa0229, fe1b011fe089969d960d2dce2a61020725a02e15dbc812ee6b6ecc6a98875392, myleftheart[.]com
Source: APT34 / OILRIG Leak, Quick Analysis - April 2019
Detection (10 cases): 07e791d18ea8f2f7ede2962522626b43f28cb242873a7bd55fff4feb91299741, 27e03b98ae0f6f2650f378e9292384f1350f95ee4f3ac009e0113a8d9e2e14ed, 2943e69e6c34232dee3236ced38d41d378784a317eeaf6b90482014210fcd459, 3ca3a957c526eaeabcf17b0b2cd345c0fffab549adfdf04470b6983b87f7ec62, a6a0fbfee08367046d3d26fb4b4cf7779f7fb6eaf7e60e1d9b6bf31c5be5b63e, b1d621091740e62c84fc8c62bcdad07873c8b61b83faba36097ef150fd6ec768, c9d5dc956841e000bfd8762e2f0b48b66c79b79500e894b4efa7fb9ba17e4e9e, dd6d7af00ef4ca89a319a230cdd094275c3a1d365807fe5b34133324bdaa0229, fe1b011fe089969d960d2dce2a61020725a02e15dbc812ee6b6ecc6a98875392, myleftheart[.]com
Hint: Overlaps are extracted automatically by examining the IOCs associated with all indexed threats and actors.