NSA Tools used by Chinese APT Hackers Before it Released Online

Check Point Research team revealed that the China-linked APT31 group known as Zirconium, used a tool dubbed Jian, which is a replica of NSA Equation Group‘s “EpMe” hacking tool, years back it was leaked online by Shadow Brokers hackers.

According to the evidence collected on the various cyberespionage campaigns over the years, Kaspersky experts hypothesize that the National Security Agency (NSA) is linked to the Equation Group.

In 2017, the Shadow Brokers hacking group released a collection of hacking tools allegedly stolen from the US NSA, most of them exploited zero-day flaws in popular software. Jian used the same Windows zero-day exploit that was stolen from the NSA Equation Group‘s arsenal for years before it was addressed by the IT giant.

Jian – CVE-2017-0005

One of the flaws tracked as CVE-2017-0005, a Windows Local-Privilege-Escalation (LPE) vulnerability that was attributed to a Chinese APT, was replicated based on an Equation Group exploit for the same vulnerability that the APT was able to access.

“EpMe”, the Equation Group exploit for CVE-2017-0005, is one of 4 different LPE exploits included in the DanderSpritz attack framework. EpMe dates back to at least 2013 – four years before APT31 was caught exploiting this vulnerability in the wild.

Experts discovered that the Jian tool was being actively utilized between 2014 and 2017, it dates its usage years before the vulnerability was addressed by Microsoft. The security firm also excluded that the tool was developed by the Chinese threat actors.

This exploit was patched in May 2017, probably as part of the follow-up fixes for the Shadow Brokers “Lost in Translation” leak of Equation Group tools.

Lockheed Martin’s Computer Incident Response Team reported CVE-2017-0005 to Microsoft, this is the only vulnerability Lockheed Martin reported in recent years.

The Patch – CVE-2017-0005

Experts pointed out that EpMe exploits CVE-2017-0005. The exploit indeed stopped working after Microsoft’s March 2017 patch, the patch that addressed the said vulnerability.

APT31 group had obtained access to Equation Group’s hacking tool, likely because it was employed in attacks against Chinese targets. The Chinese hackers gained access to both 32- and 64-bit versions of the exploit module.

An alternative hypothesis is that the Chinese APT group has stolen the tool from the Equation Group while they were spying on a target network also being monitored by APT31. We cannot exclude that APT31 has stolen the tool from Equation Group servers.

Conclusion

Together with additional artifacts that match Equation Group artifacts and habits shared between all exploits even as far back as 2008, can conclude the following:

• Equation Group’s EpMe exploits, existing since at least 2013, is the original exploit for the vulnerability later labeled CVE-2017-0005.
• Somewhere around 2014, APT31 managed to capture both the 32-bit and 64-bit samples of the EpMe Equation Group exploit.
• They replicated them to construct “Jian” and using this new version of the exploit alongside their unique multi-staged packer.
• Jian was caught by Lockheed Martin’s IRT and reported to Microsoft, which patched the vulnerability in March 2017 and labeled it CVE-2017-0005.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity, and hacking news updates.