An inside look at NSA tactics, techniques and procedures from China's lens
Chinese cybersecurity reports link the NSA's Equation Group to a 2022 cyberattack on Northwestern Polytechnical University, revealing tactics like zero-day exploits and highlighting differences in incident response methodologies.
Read original article
The blog post discusses the insights gained from Chinese cybersecurity reports regarding the NSA's cyber operations, specifically focusing on the alleged tactics, techniques, and procedures (TTPs) of the NSA's Equation Group, referred to as APT-C-40. The author, based in Australia, explores how Chinese entities like Qihoo 360 and the National Computer Virus Emergency Response Center (CVERC) attribute various cyberattacks to the NSA, including a significant breach of China's Northwestern Polytechnical University in 2022. The attack reportedly involved over 40 unique malware strains and sophisticated methods such as zero-day exploits, spear phishing, and man-in-the-middle (MiTM) techniques. The investigation revealed patterns in the timing of attacks, the use of American English, and human errors that led to the identification of NSA tools. The author notes the differences in incident response methodologies between China and Western countries and expresses interest in adapting some of these insights into their own practices. The post concludes with a suggestion to continue exploring other Chinese reports on CIA operations and another North American group.
- The NSA's Equation Group (APT-C-40) is linked to a cyberattack on China's Northwestern Polytechnical University.
- Chinese cybersecurity firms attribute various TTPs to the NSA, including the use of zero-day exploits and sophisticated malware.
- The investigation revealed patterns in attack timing and human errors that helped identify NSA tools.
- The author reflects on the differences in incident response methodologies between China and the West.
- Future posts may explore additional findings on CIA operations and other North American cyber groups.
Related
China's APT40 gang can attack new vulnerabilities within hours
China's APT40, or Kryptonite Panda, a state-sponsored cyber group, exploits vulnerabilities rapidly. It targets organizations, using end-of-life devices and malware for data theft. Mitigation strategies are advised, but APT40's persistent attacks remain a global cybersecurity concern.
CISA join ASD to release advisory on PRC State-Sponsored Group, APT 40
CISA and ASD's ACSC warn about APT 40, a Chinese state-sponsored cyber group targeting organizations globally. Urging vigilance, they advise reviewing the advisory to prevent intrusions and enhance software security.
China-linked cyber-spies infect Russian govt, IT sector
Chinese cyber-spies compromised Russian government and IT systems using malware, including GrewApacha and CloudSorcerer, through phishing emails and cloud services, indicating collaboration among state-sponsored hacking groups.
Chinese hackers access US telecom firms, worrying national security officials
Chinese government-linked hackers infiltrated U.S. telecom firms, accessing sensitive information. The Chinese Embassy denies allegations, while U.S. officials and cybersecurity experts investigate the skilled hacking group, Salt Typhoon.
Sophos Used Custom Implants to Surveil Chinese Hackers Targeting Firewall 0-Days
British cybersecurity firm Sophos has faced ongoing attacks from Chinese government-backed hackers since 2018, targeting vulnerabilities in its products and shifting focus towards government and critical infrastructure in the Asia-Pacific region.
- Many commenters express skepticism about the NSA's operational security, noting the unusual timing of attacks during standard US working hours and holidays.
- There is a discussion about the cultural differences in cybersecurity practices, particularly contrasting Western and Eastern approaches.
- Some users highlight the technical aspects of the attack, including the use of specific tools and methodologies like SECONDDATE and traffic redirection.
- Several comments reflect on the broader implications of state-sponsored cyber activities and the challenges in attributing such attacks.
- Commenters also question the effectiveness of the NSA's tactics, suggesting that they may be too obvious or careless in their operations.
16 commentsI or anyone outside obviously cannot verify the technical details. However, the above statement struck as particularly uninformed. As any engineer in East Asia can tell you, there is nothing especially collaborative about tech in Confucian culture; if anything, the engineers in that region admire the free speech and discussion traditionally prized in the Western culture. Calling Chinese political framework, especially in the context of national security, conducive to open public discussion was quite ironic to see.
Edit: the punchline is this. If a friend who is always secretive and deceptive about his personal life is suddenly openly discussing his life, what does that say about the details he just disclosed and/or the situation he is currently in?
source: I regularly work with engineers from that culture and studied relevant geopolitics.
Simple but effective. A good non-NSA agency should also learn from this to be able to effectively false-flag as NSA, as long as they are flexible enough to allow off-hours and overtime pay and remember to respect the US federal holidays.
> Two zero-days were used to breach any company with SunOS-exposed systems in neighbouring countries to China
SunOS? Wonder if it's because it's genuinely used still quite a bit or they simply had zero-days for it since many of those are old and unpatched?
I'm guessing this is so when they do data exfiltration (and hosted MITM) it's not sending a ton of data to a single server, but spreads them out.
> SECONDDATE: This tool was allegedly used by TAO (NSA) to hack into the office intranet of the University. Attribution of SECONDDATE was discovered through collaboration with other industry partners. They found thousands of network devices running this spyware – where the communications went back to NSA servers located in Germany, Japan, South Korea and Taiwan. This tool was used to redirect user traffic to the FOXACID platform.
> SECONDDATE – Backdoor installed on network edge devices such as gateways and border routers to filter, and hijack mass amounts of data in a MiTM. This was placed on the border routers of the University to hijack traffic to redirect to NSA’s FOXACID platform.
> * One of the frameworks used by TAO that was forensically uncovered during the incident named “NOPEN” requires human operation. As such, a lot of the attack required hands-on-keyboard and data analysis of the incident timeline showed 98% of all the attacks occurred during 9am – 4pm EST (US working hours).
> * There were zero cyber-attacks on Saturdays and Sundays with all attacks centralised between Mon-Fri.
> * No attacks occurred during Memorial Day and Independence Day holidays which were unique American holidays.
> * No attacks occurred during Christmas.
It's surprising the NSA would be this sloppy and obvious, or maybe they don't care about attribution in this situation, or maybe someone else did it. But I've read attribution of Chinese attackers using work hours and thought the attackers were sloppy and obvious.
> A key observation from the Chinese case notes was the extensive use of big data analysis, particularly in tracking “hands-on keyboard” activity. This approach enabled Qihoo 360 to identify patterns, such as the alleged absence of activity on Memorial Day, and precisely documenting the operational hours of the attackers, allowing 360 to isolate activity to Monday-Friday, EST working hours.
If the blogger's claim of experience is true, they must know about the things I've read. I wonder what they are thinking of.
I think the English language aspect is much more interesting and difficult/impossible to prevent.
I assume it's a jungle out there, so teams need to protect themselves 24/7/365 and I'm surprised to find no activities in holidays.
This is probably a dumb question but doesn't that require an SSL cert? Obviously the NSA can get someone to issue a cert for a domain they don't own but wouldn't that be visible?
Couldn't you have every user device log the SSL certs it sees to detect this attack? What about CT?
What is Shadow Broker, does anyone know?
the traffic redirection is interesting in that i would be curious if they rate limited it or used on device selectors in their implant to redirect traffic. the trade off between memory caching packets to sort on selectors vs.stealthy throughput would have been a fun design meeting.
hunting these kinds of actors would be supremely fun. the main thing that protects them is few outside massive bureaucracies really care enough or find it economical, as the rewards are more in finding new zero day and not hunting state level threat actors. the exceptions who do (p0, citizenlab etc) are attached to massive orgs and dont really led themselves to privateering. amazing write up anyway.
Come on guys, if Satoshi can cover his timezones tracks, so can you.
Someone doing extensive research on Weixin might ordinarily realize that it's called "Wechat" in English.
Related
China's APT40 gang can attack new vulnerabilities within hours
China's APT40, or Kryptonite Panda, a state-sponsored cyber group, exploits vulnerabilities rapidly. It targets organizations, using end-of-life devices and malware for data theft. Mitigation strategies are advised, but APT40's persistent attacks remain a global cybersecurity concern.
CISA join ASD to release advisory on PRC State-Sponsored Group, APT 40
CISA and ASD's ACSC warn about APT 40, a Chinese state-sponsored cyber group targeting organizations globally. Urging vigilance, they advise reviewing the advisory to prevent intrusions and enhance software security.
China-linked cyber-spies infect Russian govt, IT sector
Chinese cyber-spies compromised Russian government and IT systems using malware, including GrewApacha and CloudSorcerer, through phishing emails and cloud services, indicating collaboration among state-sponsored hacking groups.
Chinese hackers access US telecom firms, worrying national security officials
Chinese government-linked hackers infiltrated U.S. telecom firms, accessing sensitive information. The Chinese Embassy denies allegations, while U.S. officials and cybersecurity experts investigate the skilled hacking group, Salt Typhoon.
Sophos Used Custom Implants to Surveil Chinese Hackers Targeting Firewall 0-Days
British cybersecurity firm Sophos has faced ongoing attacks from Chinese government-backed hackers since 2018, targeting vulnerabilities in its products and shifting focus towards government and critical infrastructure in the Asia-Pacific region.