Thursday, April 18, 2024

NSA Tools used by Chinese APT Hackers Before it Released Online

Check Point Research team revealed that the China-linked APT31 group known as Zirconium, used a tool dubbed Jian, which is a replica of NSA Equation Group‘s “EpMe” hacking tool, years back it was leaked online by Shadow Brokers hackers.

According to the evidence collected on the various cyberespionage campaigns over the years, Kaspersky experts hypothesize that the National Security Agency (NSA) is linked to the Equation Group.

In 2017, the Shadow Brokers hacking group released a collection of hacking tools allegedly stolen from the US NSA, most of them exploited zero-day flaws in popular software. Jian used the same Windows zero-day exploit that was stolen from the NSA Equation Group‘s arsenal for years before it was addressed by the IT giant.

Jian – CVE-2017-0005

One of the flaws tracked as CVE-2017-0005, a Windows Local-Privilege-Escalation (LPE) vulnerability that was attributed to a Chinese APT, was replicated based on an Equation Group exploit for the same vulnerability that the APT was able to access.

“EpMe”, the Equation Group exploit for CVE-2017-0005, is one of 4 different LPE exploits included in the DanderSpritz attack framework. EpMe dates back to at least 2013 – four years before APT31 was caught exploiting this vulnerability in the wild.

Timeline of the events detailing the story of EpMe / Jian / CVE-2017-0005

Experts discovered that the Jian tool was being actively utilized between 2014 and 2017, it dates its usage years before the vulnerability was addressed by Microsoft. The security firm also excluded that the tool was developed by the Chinese threat actors.

This exploit was patched in May 2017, probably as part of the follow-up fixes for the Shadow Brokers “Lost in Translation” leak of Equation Group tools.

Lockheed Martin’s Computer Incident Response Team reported CVE-2017-0005 to Microsoft, this is the only vulnerability Lockheed Martin reported in recent years.

The Patch – CVE-2017-0005

Experts pointed out that EpMe exploits CVE-2017-0005. The exploit indeed stopped working after Microsoft’s March 2017 patch, the patch that addressed the said vulnerability.

APT31 group had obtained access to Equation Group’s hacking tool, likely because it was employed in attacks against Chinese targets. The Chinese hackers gained access to both 32- and 64-bit versions of the exploit module.

An alternative hypothesis is that the Chinese APT group has stolen the tool from the Equation Group while they were spying on a target network also being monitored by APT31. We cannot exclude that APT31 has stolen the tool from Equation Group servers.


Together with additional artifacts that match Equation Group artifacts and habits shared between all exploits even as far back as 2008, can conclude the following:

  • Equation Group’s EpMe exploits, existing since at least 2013, is the original exploit for the vulnerability later labeled CVE-2017-0005.
  • Somewhere around 2014, APT31 managed to capture both the 32-bit and 64-bit samples of the EpMe Equation Group exploit.
  • They replicated them to construct “Jian” and using this new version of the exploit alongside their unique multi-staged packer.
  • Jian was caught by Lockheed Martin’s IRT and reported to Microsoft, which patched the vulnerability in March 2017 and labeled it CVE-2017-0005.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity, and hacking news updates.


Latest articles

Xiid SealedTunnel: Unfazed by Yet Another Critical Firewall Vulnerability (CVE-2024-3400)

In the wake of the recent disclosure of a critical vulnerability (CVE-2024-3400) affecting a...

Cerber Linux Ransomware Exploits Atlassian Servers to Take Full Control

Security researchers at Cado Security Labs have uncovered a new variant of the Cerber...

FGVulDet – New Vulnerability Detector to Analyze Source Code

Detecting source code vulnerabilities aims to protect software systems from attacks by identifying inherent...

North Korean Hackers Abuse DMARC To Legitimize Their Emails

DMARC is targeted by hackers as this serves to act as a preventative measure...

L00KUPRU Ransomware Attackers discovered in the wild

A new variant of the Xorist ransomware, dubbed L00KUPRU, has been discovered in the...

Oracle Releases Biggest Security Update in 2024 – 372 Vulnerabilities Are Fixed – Update Now!

Oracle has released its April 2024 Critical Patch Update (CPU), addressing 372 security vulnerabilities...

Outlook Login Panel Themed Phishing Attack Evaded All Antivirus Detections

Cybersecurity researchers have uncovered a new phishing attack that has bypassed all antivirus detections.The...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.


Mastering WAAP/WAF ROI Analysis

As the importance of compliance and safeguarding critical websites and APIs grows, Web Application and API Protection (WAAP) solutions play an integral role.
Key takeaways include:

  • Pricing models
  • Cost Estimation
  • ROI Calculation

Related Articles