PortDoor: New Chinese APT Backdoor Attack Targets Russian Defense Sector
By Cybereason Nocturnus
May 3, 2021
While analyzing newly discovered RoyalRoad samples observed in-the-wild, the Nocturnus Team detected one that not only exhibits anomalous characteristics, but also delivers PortDoor malware, a previously undocumented backdoor assessed to have been developed by a threat actor likely operating on behalf of Chinese state-sponsored interests.
According to the phishing lure content examined, the target of the attack was a general director working at the Rubin Design Bureau, a Russian-based defense contractor that designs nuclear submarines for the Russian Federation’s Navy.
Previously Undocumented Backdoor: The newly discovered RoyalRoad RTF variant examined also drops a previously undocumented and stealthy backdoor dubbed PortDoor which is designed with obfuscation and persistence in mind.
Attack: The threat actor
targeting the Rubin
Design Bureau, a part of
the Russian defense
submarines for the
Analysis of the Spear-Phishing Attack
Intro to RoyalRoad
RoyalRoad is a tool that generates weaponized RTF documents that exploit the following vulnerabilities in Microsoft’s Equation Editor: CVE-2017-11882, CVE-2018-0798 and CVE-2018-0802. RoyalRoad is used primarily by threat actors considered to be operating on behalf of Chinese state interests (e.g Tick, Tonto Team, TA428, Goblin Panda, Rancor).
RoyalRoad has rather consistent characteristics and most of the weaponized RTF documents usually drop an encoded file named “8.t”, which - once decoded - can deliver a variety of payloads for different threat actors.
In this report, we discuss a deviation from the “classic” RoyalRoad characteristics. The dropped object name was changed from the very consistent “8.t” naming convention to the new “e.o” file name.
Spear-Phishing Email Delivers RoyalRoad RTF
The initial infection vector is a spear-phishing email addressed to the “respectful general director Igor Vladimirovich” at the Rubin Design Bureau, a submarine design center from the “Gidropribor” concern in St. Petersburg, a national research center that designs underwater weapons like submarines:
Content of the spear-phishing e-mail
The email attachment is a malicious RTF document weaponized with a RoyalRoad payload, with content describing a general view of an autonomous underwater vehicle:
Content of the weaponized RTF document
The creation time of the RTF is timestomped to 2007, presumably to thwart investigation or detection efforts. Timestomping is a known technique used by threat actors to try and remain under the radar:
Historical RTF data from VirusTotal
Once the RTF document is opened and executed, a Microsoft Word add-in file is dropped to the Microsoft Word startup folder. This technique is used by various actors to bypass detection of automatic execution persistence, since Word must be relaunched in order to trigger the add-in file, making the persistence mechanism less “noisy”.
Contrary to the common “8.t” file name observed in most RoyalRoad payloads, this new RoyalRoad variant uses “e.o” naming convention for the temporary file payload, which is eventually written to MS Word startup folder as “winlog.wll”:
Weaponized RTF execution and dropped files on disk
The malicious execution of the RTF file is detected by the Cybereason Defense Platform:
Cybereason Detection of the PortDoor Backdoor
PortDoor Backdoor Analysis
The dropped payload,
named “winlog.wll”, is a
backdoor. Its main
Receiving commands and downloading additional payloads from the C2 server
Communicating with the C2 server using raw socket as well as HTTP over port 443 with proxy authentication support
Privilege escalation and process manipulation
Dynamic API resolving for static detection evasion
One byte XOR encryption of sensitive data and configuration strings
The collected information is AES-encrypted before it is sent to the C2 server
The DLL itself has multiple export functions, going from DllEntry00 to DllEntry33. Most of these exports simply return sleep loops, a likely anti-analysis measure. The main functionality resides within the DllEntry28 and DllEntry18:
DLL exports of the PortDoor backdoor
In order to get the configuration information, the backdoor first decrypts the strings using a hardcoded 0xfe XOR key:
Strings decryption routine
The decrypted data includes the following configuration information:
The decrypted strings in memory
It is worth noting that, during the analysis, the communication with the C2 was not successful and therefore some analysis information may be incomplete.
Following the debugger presence check and the string decryption, the malware then creates an additional file in %temp% with the hardcoded name “58097616.tmp”, and writes the GetTickCount value multiplied by a random number to it:
Value written to the “58097616.tmp” file
This can be used as an additional identifier for the target, and also as a placeholder for the previous presence of this malware.
The malware then proceeds to attempt to establish a connection with the C2 which supports the transfer of data using TCP over raw sockets, or HTTPS using the CONNECT method. In addition the backdoor appears to be proxy-aware, distinguishing between two HTTP response types: “200” response and “407” (Proxy Authentication Required):
Hardcoded HTTP headers with proxy support
PortDoor also has the ability to achieve privilege escalation by applying the Access Token Theft technique to steal explorer.exe tokens and run under a privileged security context:
Access token theft from explorer.exe
Eventually, the malware awaits for further instructions from the C2 to continue its execution. This is done via the following switch case:
Some of the switch case implemented methods
For example, the get_pc_info() case gathers basic PC info to be sent to the C2, and the “B-JDUN” string is most likely being used as a unique identifier for the campaign/victim:
The information gathered on the infected PC
Lastly, before sending the information to the C2 server the backdoor uses AES to encrypt the stolen PC information data:
AES encrypted information gathered on the PC
The backdoor’s main C2 command functionality is summarized in the table below:
C2 command functionality summarized
Another anti-analysis technique observed being used by the PortDoor backdoor is dynamic API resolving. The backdoor is able to hide most of its main functionality and avoid static detection of suspicious API calls by dynamically resolving its API calls instead of using static imports:
Dynamic API resolving
The malicious execution of the PortDoor backdoor DLL is detected by the Cybereason Defense Platform:
PortDoor Backdoor DLL as detected by Cybereason
At the time of this analysis, there was not enough information available to attribute the newly discovered backdoor to a known threat actor with reasonable certainty. However, there are a couple of known Chinese APT groups that share quite a few similarities with the threat actor behind the new malware samples analyzed in this blog.
Based on previous work done by nao_sec, the Nocturnus Team was able to determine that the RTF file discussed in this blog was weaponized with RoyalRoad v7, which bears the indicative “b0747746” header encoding and was previously observed being used by the Tonto Team, TA428 and Rancor threat actors, as can be seen below:
RoyalRoad attribution matrix. Credit: nao_sec
Both the Tonto Team and TA428 threat actors have been observed attacking Russian organizations in the past, and more specifically attacking research and defense related targets. For example, it was previously reported that Tonto Team is known to have attacked Russian organizations in the past using the Bisonal malware.
When comparing the spear-phishing email and malicious documents in these attacks with previously examined phishing emails and lure documents used by the Tonto Team to attack Russian organizations, there are certain similarities in the linguistic and visual style used by the attackers in the phishing emails and documents.
The newly discovered backdoor does not seem to share significant code similarities with previously known malware used by the abovementioned groups, other than anecdotal similarities that are quite common to backdoors, leading us to the conclusion that it is not a variant of a known malware, but is in fact novel malware that was developed recently.
Lastly, we are also aware that there could be other groups, known or yet unknown, that could be behind the attack and the development of the PortDoor backdoor. We hope that as time goes by, and with more evidence gathered, the attribution could be more concrete.
RoyalRoad has been one of the most used RTF weaponizers in the Chinese threat actors sphere in recent years. It is mostly observed in the initial compromise phase of targeted attacks where spear-phishing is used to lure victims into opening malicious documents which in turn exploit Microsoft Equation Editor vulnerabilities to drop different malware.
In this report, we discussed the latest changes that were made to the RoyalRoad weaponizer that deviate from some of its well-documented and predictable indicators. It is perhaps an indication that the threat actors who are operating it are attempting to avoid “low hanging fruit” detections.
In addition, we reported the discovery of the novel PortDoor backdoor, a previously undocumented and stealthy tool designed to grant the attackers access to their targets’ machines, collect information, and deploy additional payloads.
At the time of writing this report, it is still unclear which threat actor is behind the new backdoor, however we have identified two potential suspects that fit the profile. Currently there is not enough information available to prove the stated hypothesis with a high level of certainty.