IXESHE Campaign Actors Zero in on East Asian Governments and Industries
Download the full research paper: IXESHE: An APT Campaign
Trend Micro continues to track and analyze highly targeted attacks, also known as “advanced persistent threats (APTs).” We have, in fact, published two research papers on the Luckycat and Lurid campaigns. This research paper will delve into another prominent group of attackers referred to as “IXESHE” pronounced “i-sushi”), based on one of the more common detection names security companies use for the malware they utilize. This campaign is notable for targeting East Asian governments, electronics manufacturers, and a telecommunications company.
The IXESHE campaign makes use of targeted emails with malicious attachments to compromise victims’ systems. The emails are often tailored for specific victims and contain malicious attachments that are almost always “weaponized”. PDF files with known exploits that drop malware executables onto targeted systems. In addition, the IXESHE attackers conducted two specific attacks that leveraged zero-day exploits—one in 2009 and another in 2011.
The IXESHE attackers almost always make use of compromised servers as command-and-control (C&C) servers. In some cases, the compromised servers are hosted on target organizations’ networks after successful infiltration so the attackers can increase their control of the victims’ infrastructure. Using this approach, the attackers amassed at least 60 C&C servers over time. This technique also allows the attackers to cover their tracks, as having the C&C server in the victims’ corporate networks means very little C&C traffic leaves them. The attackers’ deliberate use of compromised machines and dynamic Domain Name System (DNS) services allows them to hide traces of their presence by confusing their activities with data belonging to legitimate individuals.
Looking at threat intelligence derived from tracking APT campaigns over time primarily based on the network traffic generated by the malware used, we were able to develop indicators of compromise for the IXESHE campaign. The malware samples used in this campaign were not very complicated by nature but do give the attackers almost complete control over their targets’ compromised systems.
IXESHE Quick Profile:
First Seen:
The IXESHE campaign has been actively staging targeted attacks since at least July of 2009.
Victims and Targets:
IXESHE has been found to target electronics manufacturers, a telecommunications company, and East Asian governments.
Operations:
IXESHE attacks used custom-fit targeted emails with PDF exploits for CVE-2009-4324, CVE-2009-0927, CVE-2011-0609, and CVE-2011-0611. These were used to drop malicious executable files that gave the attackers complete control of their targets’ systems.
The attackers used either dynamic Domain Name System (DNS) or compromised servers hosted on networks that they previously successfully infiltrated.
Possible Indicators of Compromise
Below is a list of the components of the Safe campaign.
- Enters networks via a specially crafted, targeted email with a malicious file attachment
- Uses document exploits (primarily PDF exploits) to drop malware onto target systems
- Uses malware detected as IXESHE by security companies
- Sends a GET request to the command-and-control (C&C) server with the format: http://[C&C Server]/[ACD] [EW]S[Some Numbers].jsp?[Encrypted Base64 Blob]
*The campaign codes we have seen so far are detailed in the Trend Micro research paper, “IXESHE: An APT Campaign.” The characteristics highlighted in this APT campaign quick profile reflect the results of our investigation as of May 2012.
Like it? Add this infographic to your site:
1. Click on the box below. 2. Press Ctrl+A to select all. 3. Press Ctrl+C to copy. 4. Paste the code into your page (Ctrl+V).
Image will appear the same size as you see above.
Cellular IoT Vulnerabilities: Another Door to Cellular Networks
Today’s Cloud and Container Misconfigurations Are Tomorrow’s Critical Vulnerabilities
The Artificial Future: Trend Micro Security Predictions for 2025
The Realities of Quantum Machine Learning