OceanLotus Targets Southeast Asia in New Watering Hole Campaign


A cyber-espionage group believed to be operating out of Vietnam has compromised over 20 websites as part of a watering hole campaign targeting users in Southeast Asia, ESET reports.

As part of the attacks, which are believed to have been active since September 2018, the websites of the Ministry of Defense of Cambodia, the Ministry of Foreign Affairs and International Cooperation of Cambodia, as well as several Vietnamese newspaper or blog websites were compromised.

The actor behind the attacks is believed to be OceanLotus, a group of cyber-spies active since at least 2012 and also known as APT32 and APT-C-00. The new campaign, ESET’s security researchers say, appears to be an evolution of a watering hole scheme documented in 2017.

The new campaign shows the use of various techniques to hinder analysis, such as public key cryptography to exchange an AES session key used to encrypt further communications, and the use of WebSocket to hide their malicious communications.

The security researchers have identified 21 distinct websites compromised in the attack, each of them redirecting to a separate domain controlled by the attackers. Most of the websites are related to news media or the Cambodian government. Although the victims were notified in October, most of the websites continue to serve the malicious script injections, ESET says.

The attackers added JavaScript code to a page of the compromised websites, to load another script from a server controlled by the attackers. The scripts are obfuscated to prevent static extraction of the final URL, which looks like a real JavaScript library used by the website. Furthermore, different scripts and domains/URI were used for each of the compromised websites.

Based on the IP address of the visitor, either a decoy script (a random legitimate JavaScript library) or the first stage script is delivered. Thus, for the servers that have a location check enabled, only visitors from Vietnam and Cambodia are targeted with malware.

The malicious script contains checks to evade detection. It waits for the victim to scroll on the page, and also checks the resolution of the window and whether the Firebug browser extension is enabled. If the checks pass, it decrypts the command and control (C&C) domain using a custom algorithm.

Next, using WebSocket over SSL, the script sends a unique string to the server and receives and executes a second-stage script, which was designed for reconnaissance purposes. The attackers use a slightly modified version of Valve’s fingerprintjs2 library, which is available on GitHub.

With all communication going through the WebSocket session opened by the first stage, traffic is difficult to detect and decrypt. The recon script builds a report and sends it to the second stage C&C server.

“The report generated contains detailed information about the victim browser and the website visited: the user-agent, the HTTP Referer, the local and external IP address, the browser plugins the browser’s configured language preferences,” ESET reports.

The server can then respond to additional JavaScript code, but the security researchers could not identify in-the-wild examples of payloads sent by the attackers, not to mention that the payloads are only delivered to specific targets. According to previous reports, however, the OceanLotus watering hole campaigns aim to phish victims, the researchers note.

To stay under the radar, the attackers registered a first stage and a second stage domain per compromised website, each hosted on a separate server with a distinct IP address. Overall, they registered more than 50 domains and 50 servers for the campaign.

“Despite being actively tracked by many researchers, the OceanLotus group is still very busy attacking targets in Southeast Asia. They also regularly improve their toolset, including their watering hole framework and their Windows and MacOS malware. The recent updates to their watering hole framework show a level of sophistication never before seen for OceanLotus,” ESET concludes.

Related: "OceanLotus" Spies Use New Backdoor in Recent Attacks

Related: Vietnamese Spies Rival Notorious Russian Group in Sophistication

Copyright 2010 Respective Author at Infosec Island via Infosec Island Latest Articles "https://ift.tt/2FUqZLH"

Comments

Post a Comment

Popular posts from this blog

Evernote cuts staff as user growth stalls

Image
Note-taking app Evernote has fallen on hard times of late, culminating in its latest spate of job cuts impacting 15 percent of its workforce (54 employees). CEO Chris O' Neil -- an ex-Googler who took the reins in 2015 -- announced the firings at an all-hands meeting earlier today, reports TechCrunch . In a message on the Evernote blog , O' Neill admitted he'd set "incredibly aggressive goals" for the company in 2018. He continued: "Going forward, we are streamlining certain functions, like sales, so we can continue to speed up and scale others, like product development and engineering." The layoffs follow an exec exodus just weeks ago and the company's recent brand refresh (complete with a refined logo and wordmark). But critics are more concerned about its product, especially the free tier, which they claim lacks the perks to
Read more

The best air conditioner

Image
By Liam McCabe This post was done in partnership with Wirecutter . When readers choose to buy Wirecutter's independently chosen editorial picks, it may earn affiliate commissions that support its work. Read the full article here . After six summers of researching, testing, and recommending window air conditioners, we've learned that quiet and affordable ACs make most people the happiest—and we think the LG LW8016ER will fit the bill in most rooms. This 8,000 Btu unit cools as efficiently and effectively as any model with an equal Btu rating, and runs at a lower volume and deeper pitch than others at this price. Little extra features like a fresh-air vent, two-axis fan blades, and a removable drain plug help set it apart, too. The LG LW8016ER is a top choice for an office or den, and some people will find it quiet enough for a bedroom, too. If our main pic
Read more

We won't see a 'universal' vape oil cartridge anytime soon

Image
Pre-loaded cartridges of cannabis concentrate are currently among the most popular means of consumption, and for good reason. They're discreet to use and easy to handle, a far cry from the dark days of 2016 when we had to dribble hash oil or load wax into narrow-mouthed vape pens by hand. But, frustratingly, an ever increasing number of oil cartridge manufacturers employ one-off design standards so that their products won't work with those of their competitors, thereby locking customers into proprietary ecosystems. We've already seen this with nicotine vaporizers -- which has a seen a massive rise in "pod systems" in the last few years, each outfitted with a unique canister and battery built to be incompatible with those of their competition. Is it too late for the burgeoning cannabis industry to set a universal standard for their product designs?
Read more