Thursday, November 30, 2023

NSA Tools used by Chinese APT Hackers Before it Released Online

Check Point Research team revealed that the China-linked APT31 group known as Zirconium, used a tool dubbed Jian, which is a replica of NSA Equation Group‘s “EpMe” hacking tool, years back it was leaked online by Shadow Brokers hackers.

According to the evidence collected on the various cyberespionage campaigns over the years, Kaspersky experts hypothesize that the National Security Agency (NSA) is linked to the Equation Group.

In 2017, the Shadow Brokers hacking group released a collection of hacking tools allegedly stolen from the US NSA, most of them exploited zero-day flaws in popular software. Jian used the same Windows zero-day exploit that was stolen from the NSA Equation Group‘s arsenal for years before it was addressed by the IT giant.

Jian – CVE-2017-0005

One of the flaws tracked as CVE-2017-0005, a Windows Local-Privilege-Escalation (LPE) vulnerability that was attributed to a Chinese APT, was replicated based on an Equation Group exploit for the same vulnerability that the APT was able to access.

“EpMe”, the Equation Group exploit for CVE-2017-0005, is one of 4 different LPE exploits included in the DanderSpritz attack framework. EpMe dates back to at least 2013 – four years before APT31 was caught exploiting this vulnerability in the wild.

Timeline of the events detailing the story of EpMe / Jian / CVE-2017-0005

Experts discovered that the Jian tool was being actively utilized between 2014 and 2017, it dates its usage years before the vulnerability was addressed by Microsoft. The security firm also excluded that the tool was developed by the Chinese threat actors.

This exploit was patched in May 2017, probably as part of the follow-up fixes for the Shadow Brokers “Lost in Translation” leak of Equation Group tools.

Lockheed Martin’s Computer Incident Response Team reported CVE-2017-0005 to Microsoft, this is the only vulnerability Lockheed Martin reported in recent years.

The Patch – CVE-2017-0005

Experts pointed out that EpMe exploits CVE-2017-0005. The exploit indeed stopped working after Microsoft’s March 2017 patch, the patch that addressed the said vulnerability.

APT31 group had obtained access to Equation Group’s hacking tool, likely because it was employed in attacks against Chinese targets. The Chinese hackers gained access to both 32- and 64-bit versions of the exploit module.

An alternative hypothesis is that the Chinese APT group has stolen the tool from the Equation Group while they were spying on a target network also being monitored by APT31. We cannot exclude that APT31 has stolen the tool from Equation Group servers.


Together with additional artifacts that match Equation Group artifacts and habits shared between all exploits even as far back as 2008, can conclude the following:

  • Equation Group’s EpMe exploits, existing since at least 2013, is the original exploit for the vulnerability later labeled CVE-2017-0005.
  • Somewhere around 2014, APT31 managed to capture both the 32-bit and 64-bit samples of the EpMe Equation Group exploit.
  • They replicated them to construct “Jian” and using this new version of the exploit alongside their unique multi-staged packer.
  • Jian was caught by Lockheed Martin’s IRT and reported to Microsoft, which patched the vulnerability in March 2017 and labeled it CVE-2017-0005.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity, and hacking news updates.


Latest articles

Chrome Zero-Day Vulnerability That Exploited In The Wild

Google has fixed the sixth Chrome zero-day bug that was exploited in the wild this...

Iranian Mobile Banking Malware Steal Login Credentials & Steal OTP Codes

An Android malware campaign was previously discovered that distributed banking trojans targeting four major...

BLUFFS: Six New Attacks that Break Secrecy of Bluetooth Sessions

Six novel Bluetooth attack methods have been discovered, which were named BLUFFS (Bluetooth Forward...

Google Workspace’s Design Flaw Allows Attacker Unauthorized Access

Recent years saw a surge in cloud tech adoption, highlighting the efficiency through tools...

Serial ‘SIM Swapper’ Sentenced to Eight Years in Prison

In a digital age marred by deceit, 25-year-old Amir Hossein Golshan stands as a...

Design Flaw in Domain-Wide Delegation Could Leave Google Workspace Vulnerable to Takeover – Hunters

BOSTON, MASS. and TEL AVIV, ISRAEL, November 28, 2023 - A severe design flaw...

Hackers Behind High-Profile Ransomware Attacks on 71 Countries Arrested

Hackers launched ransomware attacks to extort money from the following two entities by encrypting...

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles