PortDoor: New Chinese APT Backdoor Attack Targets Russian Defense Sector

The Cybereason Nocturnus Team has been tracking recent developments in the RoyalRoad weaponizer, also known as the 8.t Dropper/RTF exploit builder. Over the years, this tool has become a part of the arsenal of several Chinese-related threat actors such as Tick, Tonto Team and TA428, all of which  employ RoyalRoad regularly for spear-phishing in targeted attacks against high-value targets. 

While analyzing newly discovered RoyalRoad samples observed in-the-wild, the Nocturnus Team detected one that not only exhibits anomalous characteristics, but also delivers PortDoor malware, a previously undocumented backdoor assessed to have been developed by a threat actor likely operating on behalf of Chinese state-sponsored interests.

According to the phishing lure content examined, the target of the attack was a general director working at the Rubin Design Bureau, a Russian-based defense contractor that designs nuclear submarines for the Russian Federation’s Navy. 

Key Findings

• RoyalRoad Variants are Under Development: The variant of the RoyalRoad weaponizer examined altered its encoded payload from the known “8.t” file to a new filename: “e.o”. More new variants are likely to be under development as well.
• Previously Undocumented Backdoor: The newly discovered RoyalRoad RTF variant examined also drops a previously undocumented and stealthy backdoor dubbed PortDoor which is designed with obfuscation and persistence in mind. 
• Highly Targeted Attack: The threat actor is specifically targeting the Rubin Design Bureau, a part of the Russian defense sector designing submarines for the Russian Federation’s Navy.
• Extensive Malware Capabilities: Portdoor has multiple functionalities, including the ability to do reconnaissance, target profiling, delivery of additional payloads, privilege escalation, process manipulation static detection antivirus evasion, one-byte XOR encryption, AES-encrypted data exfiltration and more.
• APT Group Operating on Behalf of Chinese State Interests: The accumulated evidence such as the infection vector, social engineering style, use of RoyalRoad against similar targets, and other similarities between the newly discovered backdoor sample and other known Chinese APT malware all bear the hallmarks of a threat actor operating on behalf of Chinese state-sponsored interests.

Analysis of the Spear-Phishing Attack: Intro to RoyalRoad

RoyalRoad is a tool that generates weaponized RTF documents that exploit the following vulnerabilities in Microsoft’s Equation Editor: CVE-2017-11882, CVE-2018-0798 and CVE-2018-0802. RoyalRoad is used primarily by threat actors considered to be operating on behalf of Chinese state interests (e.g Tick, Tonto Team, TA428, Goblin Panda, Rancor). 

RoyalRoad has rather consistent characteristics and most of the weaponized RTF documents usually drop an encoded file named “8.t”, which - once decoded - can deliver a variety of payloads for different threat actors. 

In this report, we discuss a deviation from the “classic” RoyalRoad characteristics. The dropped object name was changed from the very consistent “8.t” naming convention to the new “e.o” file name.

Spear-Phishing Email Delivers RoyalRoad RTF

The initial infection vector is a spear-phishing email addressed to the “respectful general director Igor Vladimirovich” at the Rubin Design Bureau, a submarine design center from the “Gidropribor” concern in St. Petersburg, a national research center that designs underwater weapons like submarines:

Content of the spear-phishing e-mail

The email attachment is a malicious RTF document weaponized with a RoyalRoad payload, with content describing a general view of an autonomous underwater vehicle:

Content of the weaponized RTF document

The creation time of the RTF is timestomped to 2007, presumably to thwart investigation or detection efforts. Timestomping is a known technique used by threat actors to try and remain under the radar:

Historical RTF data from VirusTotal

Once the RTF document is opened and executed, a Microsoft Word add-in file is dropped to the Microsoft Word startup folder. This technique is used by various actors to bypass detection of automatic execution persistence, since Word must be relaunched in order to trigger the add-in file, making the persistence mechanism less “noisy”. 

Contrary to the common “8.t” file name observed in most RoyalRoad payloads, this new RoyalRoad variant uses “e.o” naming convention for the temporary file payload, which is eventually written to MS Word startup folder as “winlog.wll”:

Weaponized RTF execution and dropped files on disk

The malicious execution of the RTF file is detected by the Cybereason Defense Platform: 

Cybereason Detection of the PortDoor Backdoor

PortDoor Backdoor Analysis

The dropped payload, named “winlog.wll”, is a previously undocumented backdoor. Its main capabilities include:

• Gathering reconnaissance and profiling of the victim’s machine
• Receiving commands and downloading additional payloads from the C2 server
• Communicating with the C2 server using raw socket as well as HTTP over port 443 with proxy authentication support
• Privilege escalation and process manipulation
• Dynamic API resolving for static detection evasion 
• One byte XOR encryption of sensitive data and configuration strings 
• The collected information is AES-encrypted before it is sent to the C2 server

Detailed Analysis

The DLL itself has multiple export functions, going from DllEntry00 to DllEntry33. Most of these exports simply return sleep loops, a likely anti-analysis measure. The main functionality resides within the DllEntry28 and DllEntry18:

DLL exports of the PortDoor backdoor

In order to get the configuration information, the backdoor first decrypts the strings using a hardcoded 0xfe XOR key:

Strings decryption routine

The decrypted data includes the following configuration information:

The decrypted strings in memory

It is worth noting that, during the analysis, the communication with the C2 was not successful and therefore some analysis information may be incomplete.

Following the debugger presence check and the string decryption, the malware then creates an additional file in %temp% with the hardcoded name “58097616.tmp”, and writes the GetTickCount value multiplied by a random number to it:

Value written to the “58097616.tmp” file

This can be used as an additional identifier for the target, and also as a placeholder for the previous presence of this malware.

The malware then proceeds to attempt to establish a connection with the C2 which supports the transfer of data using TCP over raw sockets, or HTTPS using the CONNECT method. In addition the backdoor appears to be proxy-aware, distinguishing between two HTTP response types: “200” response and “407” (Proxy Authentication Required):

Hardcoded HTTP headers with proxy support

PortDoor also has the ability to achieve privilege escalation by applying the Access Token Theft technique to steal explorer.exe tokens and run under a privileged security context:

Access token theft from explorer.exe

Eventually, the malware awaits for further instructions from the C2 to continue its execution. This is done via the following switch case:

Some of the switch case implemented methods

For example, the get_pc_info() case gathers basic PC info to be sent to the C2, and the “B-JDUN” string is most likely being used as a unique identifier for the campaign/victim:

The information gathered on the infected PC

Lastly, before sending the information to the C2 server the backdoor uses AES to encrypt the stolen PC information data:

AES encrypted information gathered on the PC

The backdoor’s main C2 command functionality is summarized in the table below:

C2 command functionality summarized

Another anti-analysis technique observed being used by the PortDoor backdoor is dynamic API resolving. The backdoor is able to hide most of its main functionality and avoid static detection of suspicious API calls by dynamically resolving its API calls instead of using static imports: 

Dynamic API resolving

The malicious execution of the PortDoor backdoor DLL is detected by the Cybereason Defense Platform: 

PortDoor Backdoor DLL as detected by Cybereason

Attribution

At the time of this analysis, there was not enough information available to attribute the newly discovered backdoor to a known threat actor with reasonable certainty. However, there are a couple of known Chinese APT groups that share quite a few similarities with the threat actor behind the new malware samples analyzed in this blog. 

Based on previous work done by nao_sec, the Nocturnus Team was able to determine that the RTF file discussed in this blog was weaponized with RoyalRoad v7, which bears the indicative “b0747746” header encoding and was previously observed being used by the Tonto Team, TA428 and Rancor threat actors, as can be seen below: 

RoyalRoad attribution matrix. Credit: nao_sec

Both the Tonto Team and TA428 threat actors have been observed attacking Russian organizations in the past, and more specifically attacking research and defense related targets. For example, it was previously reported that Tonto Team is known to have attacked Russian organizations in the past using the Bisonal malware.

When comparing the spear-phishing email and malicious documents in these attacks with previously examined phishing emails and lure documents used by the Tonto Team to attack Russian organizations, there are certain similarities in the linguistic and visual style used by the attackers in the phishing emails and documents. 

The newly discovered backdoor does not seem to share significant code similarities with previously known malware used by the abovementioned groups, other than anecdotal similarities that are quite common to backdoors, leading us to the conclusion that it is not a variant of a known malware, but is in fact novel malware that was developed recently. 

Lastly, we are also aware that there could be other groups, known or yet unknown, that could be behind the attack and the development of the PortDoor backdoor. We hope that as time goes by, and with more evidence gathered, the attribution could be more concrete. 

Conclusion

RoyalRoad has been one of the most used RTF weaponizers in the Chinese threat actors sphere in recent years. It is mostly observed in the initial compromise phase of targeted attacks where spear-phishing is used to lure victims into opening malicious documents which in turn exploit Microsoft Equation Editor vulnerabilities to drop different malware. 

In this report, we discussed the latest changes that were made to the RoyalRoad weaponizer that deviate from some of its well-documented and predictable indicators. It is perhaps an indication that the threat actors who are operating it are attempting to avoid “low hanging fruit” detections.

In addition, we reported the discovery of the novel PortDoor backdoor, a previously undocumented and stealthy tool designed to grant the attackers access to their targets’ machines, collect information, and deploy additional payloads. 

At the time of writing this report, it is still unclear which threat actor is behind the new backdoor, however we have identified two potential suspects that fit the profile. Currently there is not enough information available to prove the stated hypothesis with a high level of certainty.

LOOKING FOR THE IOCs? CLICK ON THE CHATBOT DISPLAYED IN LOWER-RIGHT OF YOUR SCREEN.

MITRE ATT&CK Matrix

About the Researchers:

DANIEL FRANK

Daniel Frank is a senior Malware Researcher at Cybereason. Prior to Cybereason, Frank was a Malware Researcher in F5 Networks and RSA Security. 

His core roles as a Malware Researcher include researching emerging threats, reverse-engineering malware and developing security-driven code. Frank has a BSc degree in information systems.

ASSAF DAHAN

Assaf Dahan is the Senior Director and Head of Threat Research at Cybereason. He has over 15 years in the InfoSec industry. 

He started his career in the Military forces where he developed extensive experience in offensive security. Later in his career he led Red Teams, developed penetration testing methodologies, and specialized in malware analysis and reverse engineering.