![](\"https:\/\/media.wired.com\/photos\/5bc7cbce4bb3fa2ced830b1d\/master\/pass\/chinese_malware_v2.jpg\"\/)
<\/p>\n<\/p>\n
Credit to Author: Brian Barrett| Date: Thu, 18 Oct 2018 04:01:00 +0000<\/strong><\/p>\n In 2013, cybersecurity <\/span>firm Mandiant published a blockbuster report<\/a> on a state-sponsored hacking team known as APT1, or Comment Crew. The Chinese group achieved instant infamy, tied to the successful hacks of more than 100 US companies and the exfiltration of hundreds of terabytes of data. They also vanished in the wake of being exposed. Now, years later, researchers from security firm McAfee say they\u2019ve found code based on APT1\u2013associated malware cropping up in a new set of attacks.<\/p>\n Specifically, McAfee has found malware that reuses a portion of the code found in an implant called Seasalt, which APT1 introduced sometime around 2010. Lifting and repurposing pieces of malware is not an unusual practice, especially when those tools are widely available or open source. Look no further than the rash of attacks based on EternalBlue<\/a>, the leaked NSA tool<\/a>. But source code used by APT1, McAfee says, never became public, nor did it wind up on the black market. Which makes its reappearance something of a mystery.<\/p>\n \u201cWhen we picked up the samples and we found code reuse for Comment Crew,\u201d says McAfee chief scientist Raj Samani, \u201call of a sudden it was like an \u2018oh shit\u2019 moment.\u201d<\/p>\n McAfee says it has seen five waves of attacks using the remixed malware, which it calls Oceansalt, dating back to May of this year. The attackers crafted spearphishing emails, with infected Korean-language Excel spreadsheet attachments, and sent them to targets who were involved in South Korean public infrastructure projects and related financial fields.<\/p>\n \u201cThey knew the people to target,\u201d Samani says. \u201cThey had identified the targets that they needed to manipulate into opening these malicious documents.\u201d<\/p>\n "All of a sudden it was like an \u2018oh shit\u2019 moment."<\/p>\n Raj Samani, McAfee<\/p>\n Victims who opened those documents unwittingly installed Oceansalt. McAfee believes the malware was used for initial reconnaissance, but had the ability to take control both of the system it infected and any network that device connected to. \u201cThe access that they had was quite significant,\u201d says Samani. \u201cEverything from getting full insight into the file structure, being able to create files, delete files, being about to list processes, terminate processes.\u201d<\/p>\n While the initial attacks focused on South Korea\u2014and appear to have been instigated by people fluent in Korean\u2014they at some point spread to targets in the United States and Canada, focusing especially on the financial, health care, and agricultural industries. McAfee says it\u2019s not aware of any obvious ties between the impacted companies and South Korea, and that the move West may have been a separate campaign.<\/p>\n McAfee does note some differences between Oceansalt and its precursor. Seasalt, for instance, had a persistence method that let it remain on an infected device even after a reboot. Oceansalt does not. And where Seasalt sent data to the control server unencrypted, Oceansalt employs an encoding and decoding process.<\/p>\n Still, the two share enough code that McAfee is confident in the connection. It\u2019s far less certain, though, about who\u2019s behind it.<\/p>\n It\u2019s hard to overstate just how capable APT1 was, and how unprecedented Mandiant\u2019s insights were at the time. \u201cAPT1 were extraordinarily prolific,\u201d says Benjamin Read, senior manager for cyberespionage analysis at FireEye, which acquired Mandiant<\/a> in 2014. \u201cThey were one of the highest in terms of volume. But volume can also allow you to build a pattern of life. When you\u2019re doing that much stuff, you\u2019re going to have slip-ups that expose some of the backend.\u201d<\/p>\n It\u2019s probably not accurate to say that APT1 disappeared after the Mandiant report. It\u2019s just as likely that the unit\u2019s hackers continued to work for China under a different guise. But it is true, Read says, that the tactics, the infrastructure, and specific malware associated with the group haven\u2019t seen the light of day in those five years.<\/p>\n It\u2019s tempting to think, perhaps, that McAfee\u2019s find means that APT1 is back. But attribution is hard under any circumstances, and Oceansalt is no smoking gun. In fact, McAfee sees a few distinct possibilities as to its provenance.<\/p>\n \u201cEither it\u2019s the re-emergence of this group, or potentially you\u2019re looking at state-to-state collaboration with regards to a major espionage campaign, or somebody\u2019s trying to point the finger at the Chinese,\u201d says Samani. \u201cEither one of those three scenarios is quite significant.\u201d<\/p>\n