{"id":20534,"date":"2022-11-03T05:20:52","date_gmt":"2022-11-03T13:20:52","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2022\/11\/03\/news-14267\/"},"modified":"2022-11-03T05:20:52","modified_gmt":"2022-11-03T13:20:52","slug":"news-14267","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2022\/11\/03\/news-14267\/","title":{"rendered":"Family Tree: Related DLL-Sideloading Cases Bear Strange Fruit"},"content":{"rendered":"

Credit to Author: Gabor Szappanos| Date: Thu, 03 Nov 2022 12:03:13 +0000<\/strong><\/p>\n

\n

We have observed multiple attacks targeting government organizations in Asia, all involving DLL sideloading \u2013 historically a favorite technique of China-based APT groups — as far back as 2013<\/a> and as recently as 2020<\/a>. In this article, we look at the evidence that connects five of them, showing how threat actors base their attacks on well-known, effective techniques, adding complexity and variation over time. Understanding how cases are related helps defenders (and customers) think about not just who\u2019s doing the attacking, but about what kind of threats may be afoot \u2013 and, naturally, how to prioritize analysis and defense for best results.<\/p>\n

In the most interesting of the five cases, a USB worm infected organizations in Southeast Asia. This worm copies everything it finds in specific directories when replicating itself, including components of other APT attacks by Mustang Panda<\/a> and LuminousMoth<\/a>. We don\u2019t have any evidence that the three APTs are linked, and we also know that multiple USB worms, when infecting systems simultaneously, may inadvertently combine their files. \u00a0(This is similar to macro virus mating<\/a>, a phenomenon identified over twenty-five years ago<\/a>.)<\/p>\n

The case involving the USB worm has significant overlap with the other four cases we observed, including loader DLLs using the same kind of code flow obfuscation and identical loader shellcode. We can\u2019t be sure that it\u2019s the same threat actor behind both the USB worm case and the other attacks \u2013 it may be different threat actors with access to the same tooling \u2013 but the similarities are compelling.<\/p>\n

We\u2019ll take a deep dive into all five cases, further detailing the infection timeline of the USB-worm attack in an appendix. We\u2019ll spotlight a piece of shell code that seems to be the common thread in all five cases, and then dig into extended step-by-step breakdowns of seven scenarios we associate with these cases. We\u2019ll close with indicators of compromise associated with these cases, which we will also make available on our GitHub.<\/p>\n

Before all that, though, it\u2019s worth briefly defining what DLL sideloading is, as it\u2019s often confused with a similar attack called DLL preloading.<\/p>\n

About DLL sideloading and preloading<\/h2>\n

DLL sideloading and preloading (sometimes known as search-order hijacking) are both attacks that hijack execution flow, although there is a subtle distinction between them.<\/p>\n

DLL preloading (AKA search order hijacking) \u2013 <\/strong>T1574\/001<\/strong><\/a><\/p>\n