OceanLotus Targets Southeast Asia in New Watering Hole Campaign

December 03, 2018

A cyber-espionage group believed to be operating out of Vietnam has compromised over 20 websites as part of a watering hole campaign targeting users in Southeast Asia, ESET reports.

As part of the attacks, which are believed to have been active since September 2018, the websites of the Ministry of Defense of Cambodia, the Ministry of Foreign Affairs and International Cooperation of Cambodia, as well as several Vietnamese newspaper or blog websites were compromised.

The actor behind the attacks is believed to be OceanLotus, a group of cyber-spies active since at least 2012 and also known as APT32 and APT-C-00. The new campaign, ESET's security researchers say, appears to be an evolution of a watering hole scheme documented in 2017.

The new campaign shows the use of various techniques to hinder analysis, such as public key cryptography to exchange an AES session key used to encrypt further communications, and the use of WebSocket to hide their malicious communications.

The security researchers have identified 21 distinct websites compromised in the attack, each of them redirecting to a separate domain controlled by the attackers. Most of the websites are related to news media or the Cambodian government. Although the victims were notified in October, most of the websites continue to serve the malicious script injections, ESET says.

The attackers added JavaScript code to a page of the compromised websites, to load another script from a server controlled by the attackers. The scripts are obfuscated to prevent static extraction of the final URL, which looks like a real JavaScript library used by the website. Furthermore, different scripts and domains/URI were used for each of the compromised websites.

Based on the IP address of the visitor, either a decoy script (a random legitimate JavaScript library) or the first stage script is delivered. Thus, for the servers that have a location check enabled, only visitors from Vietnam and Cambodia are targeted with malware.

The malicious script contains checks to evade detection. It waits for the victim to scroll on the page, and also checks the resolution of the window and whether the Firebug browser extension is enabled. If the checks pass, it decrypts the command and control (C&C) domain using a custom algorithm.

Next, using WebSocket over SSL, the script sends a unique string to the server and receives and executes a second-stage script, which was designed for reconnaissance purposes. The attackers use a slightly modified version of Valve's fingerprintjs2 library, which is available on GitHub.

With all communication going through the WebSocket session opened by the first stage, traffic is difficult to detect and decrypt. The recon script builds a report and sends it to the second stage C&C server.

"The report generated contains detailed information about the victim browser and the website visited: the user-agent, the HTTP Referer, the local and external IP address, the browser plugins the browser's configured language preferences," ESET reports.

The server can then respond to additional JavaScript code, but the security researchers could not identify in-the-wild examples of payloads sent by the attackers, not to mention that the payloads are only delivered to specific targets. According to previous reports, however, the OceanLotus watering hole campaigns aim to phish victims, the researchers note.

To stay under the radar, the attackers registered a first stage and a second stage domain per compromised website, each hosted on a separate server with a distinct IP address. Overall, they registered more than 50 domains and 50 servers for the campaign.

"Despite being actively tracked by many researchers, the OceanLotus group is still very busy attacking targets in Southeast Asia. They also regularly improve their toolset, including their watering hole framework and their Windows and MacOS malware. The recent updates to their watering hole framework show a level of sophistication never before seen for OceanLotus," ESET concludes.