In 2013, cybersecurity firm Mandiant published a blockbuster report[1] on a state-sponsored hacking team known as APT1, or Comment Crew. The Chinese group achieved instant infamy, tied to the successful hacks of more than 100 US companies and the exfiltration of hundreds of terabytes of data. They also vanished in the wake of being exposed. Now, years later, researchers from security firm McAfee say they’ve found code based on APT1–associated malware cropping up in a new set of attacks.
Specifically, McAfee has found malware that reuses a portion of the code found in an implant called Seasalt, which APT1 introduced sometime around 2010. Lifting and repurposing pieces of malware is not an unusual practice, especially when those tools are widely available or open source. Look no further than the rash of attacks based on EternalBlue[2], the leaked NSA tool[3]. But source code used by APT1, McAfee says, never became public, nor did it wind up on the black market. Which makes its reappearance something of a mystery.
“When we picked up the samples and we found code reuse for Comment Crew,” says McAfee chief scientist Raj Samani, “all of a sudden it was like an ‘oh shit’ moment.”
Attack Zones
McAfee says it has seen five waves of attacks using the remixed malware, which it calls Oceansalt, dating back to May of this year. The attackers crafted spearphishing emails, with infected Korean-language Excel spreadsheet attachments, and sent them to targets who were involved in South Korean public infrastructure projects and related financial fields.
“They knew the people to target,” Samani says. “They had identified the targets that they needed to manipulate into opening these malicious documents.”
"All of a sudden it was like an ‘oh shit’ moment."
Raj Samani, McAfee