An exploration into the potential power of collaborative, mission-focused APT research groups

This post will be one of several that will reveal the origins of the investigation, research, and analysis group effort behind what has been .


The formation, vision, and strategy behind Starlight was a direct result of the and Intellectual Property data theft of vital technical information from RSA that forms the underpinnings of Authentication Frameworks used in thousands of companies and Government organizations worldwide.

(something you have , something you know PIN/PASSWORD) attempts to increase the attackers work effort when they want to in order to compromise protected data.  This data can be in the form of content portals, or even access to entire Internal sensitive networks.

When the was in the press, it shell-shocked the industry.  There was very little information in the public about the event.  Many industry experts simply fed off the news cycle, made predictions, or speculated.  The incredible thing however is the silence from the experts who should have had the most intelligence and data to share, research and discuss.  The lack of knowledge behind what malware was used, what IP/DNS infrastructure was leveraged, who else was attacked, who was doing the attacking, what where they targeting, and what tactics, techniques, and procedures were used to facilitate the attack were all lacking.  Many companies and individuals wanted the information to better protect their own networks, however where found to be lacking useful information to detect the same threat.

It was later revealed that the attack was a success, and the key intellectual property was obtained to engineer a technical circumvention / spoofing of a users authentication session when using a 2-factor method with the RSA Token.  A wave of attacks against in the Defense Industrial Base followed shortly after the RSA compromise confirming the mission of the Threat Groups.

Meet the other guy, across the pond, using his Shell, all up in your BASE, nomming on your data.

Antivirus and other security companies have incredible resources and sensor networks at their disposal providing a wealth of threat intelligence for those that seek to do the research, connect the dots and tell a story.   Sadly however many times that data goes undiscovered or unused, buried under a ton of other data, devoid of operational context which is so important these days when researching threats.

It is critical that you know what you are dealing with when handling a threat in your organization.  Is Nation-State espionage?  Is it CyberCrime?  Is it Hackivism, or simply a curious teenager.  If companies have not yet realized, the most potent threat to their long term survival is an estimated 15-30 voracious Chinese based Threat Groups that have been systematically and successfully pillaging America and its Allies systems and Intellectual Property since at least 2003.

Some of these groups are direct components of . Others are Chinese contractors or affiliates.  For those not familiar with the Chinese Government, it is tightly and intimately interwoven within the entire society.  In many cases it is hard to discern were Government influence ends and “Private” control begins.  However there is no doubt when it comes to the operational unit of a military branch where the orders come from.  The is to use its technical capabilities in Computer Network Exploitation, to , infiltrate, and steal any and all data that meets its intelligence tasking requirements for obtaining information related to is Military Modernization and Economic Growth objectives.

Over the past year, Government officials active and retired, congressmen, and security researchers have come out explicitly this to be the case.  They should know.  There is YEARS of  linking this activity to exact groups and individuals behind these activities.  The old tired adages of how ATTRIBUTION is too hard of a problem, and how its impossible to track the source of an attack are a RED HERRING in this industry.  Do not believe it for a second.  If your told that you are being lied to.  The abilities of Nation States to conduct Multi-INT intelligence analysis on threats is unparalleled.  This intelligence supports the missions of Counter-Intelligence, Law Enforcement, and provides data for Strategy and National Leadership Decision Making.

Future postings here will reveal many of the lessons learned through this experience.

It is my hope that it inspires the community of security experts, investigators, forensic professionals, incident responders, and malware analysts to recognize clearly that there is a dire need to come together as one to share their threat data, become educated on the specific technical threats and the groups behind them, and operate as a single unified entity in confronting the single most damaging threat to our future,  as “the greatest transfer of wealth through theft and piracy in the history of the world and we are on the losing end of it.”

I will conclude this post with the original email that I posted to a private research list, in which I issued a community call for action, a Paul Revere’s ride if you will.

Many highly intelligent and dedicated people across many industries and sectors heeded the call, and signed up for the effort.  They all did not seek glory or recognition for their efforts.  They recognized the vital need for a deeply collaborative effort that was mission focused with the goal of centralizing the collective APT knowledge each group member could muster for the aggregate benefit of all.  The process by which members where invited into the organization was based on a that many other groups use as a basis for membership.

The group formed a pact of anonymity with regards to their identities and affiliations.   They produced excellent work, in-depth technical research, and collaborated continuously and richly to the effort and mission.  This privacy will be honored in this and future postings.  Their contributions and dedication to the group made Operation Starlight a successful model for future collaborative efforts challenged with APT research.

Future postings will cover:

  • The dynamics of group formation
  • The challenges of cyber intelligence sharing
  • Targeting the right expertise for inclusion
  • Contribution of resources to the effort
  • Communication and content sharing mechanisms
  • The data that kicked the RSA investigation into high gear
  • The 3 Groups that attacked RSA and their malware / methods
  • Dealing with Press Inquiries
  • The challenges of dealing with Attribution Research
  • APT Malware Analysis and forensic artifacts
  • Timelining Zero Day Exploit Research in Embedded Attacks tied to China
  • Spearfish attack research and Shellcode Analysis
  • Network intelligence, DNS monitoring
  • Scaling and analysis issues with regard to information overload
  • Information organization
  • Threat Group enumeration and categorization
  • CyberWeapon attribution and naming challenges
  • Historical Threat Group campaigns
  • Victim Identification and Intelligence
  • Decoder development
  • Operational Monitoring
  • Disruption Operations
  • Novel and GroundBreaking Game Changing Strategies
  • Lessons in Crisis Management
  • Victim Notification and LE interactions
  • CyberThreat Overclassification
  • The Profit/Patriotism Conundrum and Ambulance Chasing
  • Big Data Mining
  • Smear Campaigns and Information Operations
  • and many other interesting topics

I hope you will enjoy my sharing of experiences and wish that it may inspire you to think differently about things with regard to APT research and how you can make a difference.  There is now a ton of open intelligence that any enterprising researcher can leverage to peel back the onion, connect the dots, and the come the definitive conclusion that our networks our undefendable, there is a desperate need for gamechanging strategies, and our Government is to constrained by policy and political will to do anything about the issue with regards to China until it is too late.

The communication and application of punitive severe consequences in the form of Economic, Trade, Financial pain combined with a massive tactical offensive cyber counter-attack on all CN APT CNE infrastructure, actors, and resources is partially what is needed to show that we mean business. Developing cadres of patrotic operation under letters of combined with the of a also .  This should be preferably done in close collaboration with our Allied friends that recognize that they too are under the same threats and have the will to do something about it.  If not, we might as well concede, and step back from our positions as the leaders of the free world.  I hope the Communist Party of China treats you kindly.

in the sand and denying it will not make the data leaving your networks slow down anytime soon.  We are a , however the and of  speaks volumes about our efforts to roll back the threat or even demonstrate an effective deterrence.

The email that started it all. (Click image to view entire email)

We had better collectively get in gear on this.  Someday lives will be  and we will be looking down the barrel of our own innovation and weapons…

Typically from a cyberdefense standpoint 2 – factor authentication is the way to go.  Well  in its that our adversaries have effectively developed, operationalized and used successful attacks against our Governments Smart Cards, commonly known as the for DOD and PIV for Federal agencies.    I would have to imagine this is highly damaging, embarrassing considering millions and millions of dollars and years of development has been put into the effort for over the last decade.

The irony is that the Federal Government hasnt even rolled completely out these capabilities for agencies, leaving these safeguards as optional for implementation until recently.  Really??

Either way, their are pwned now.  Users are attacked at home while they use their cards, and attackers are alerted and ride the session in to steal the data from Smartcard protected portals.   A Significant effort must have been initiated to circumvent these controls.    This is known as a Smart-Card Proxy attack.  In order to work with the card reader the attacker would have required reversing knowledge or and then wrote code to hook and issue call functions to the vendor software.  They would have also had to to undermine the chain of trust.

BTW soft certificate stealing is par for the course in APT malware so if you think about using them or extracting them to disk with the private key installed then your doubly screwed.  Either that or they will hook all the certificate processes in Windows and dump the private keys/passphrases from there, or get the PINs from normal keystroke logging.

The only vendor that truly makes this software is   So much for their Tagline “Establishing Trust in Online Identities”,,,,

I will reprint the article here since its just so dam scandalous.

The US government has been stepping up its use of smart cards to help lock down its computer networks, but hackers have found ways around them.

Over the past 18 months, security consultancy has come across several cases where determined attackers were able to get onto computers or networks that required both smart cards and passwords. In a report set to be released Thursday, Mandiant calls this technique a “smart card proxy.”

The attack works in several steps. First, the criminals hack their way onto a PC. Often they’ll do this by sending a specially crafted email message to someone at the network they’re trying to break into. The message will include an malicious attachment that, when opened, gives the hacker a foothold in the network.

After identifying the computers that have card readers, the bad guys install keystroke logging software on those computers to steal the password that is typically used in concert with the smart card.

Then they wait.

When the victim inserts the smart card into the hacked PC, the criminals then try to log into the server or network that requires the smart card for authentication. When the server asks for a digital token from the smart card, the bad guys simply redirect that request to the hacked system, and return it with the token and the previously stolen password.

This is similar to the techniques criminals have been using for several years now to get around the extra authentication technologies used in online banking.

Mandiant is the kind of company that businesses and government agencies call to clean up the mess after they’ve been hacked. It has done investigations at about 120 organisations overt the past year and a half. Most of them get hacked via a targeted email. But in many cases, they were actually hacked years earlier, but never managed to remove the malicious software from their network, according to the report.

Companies or government agencies that assume that they are secure just because they use smart cards to authenticate, could be in for a nasty surprise some day, said Rob Lee, a director with Mandiant. “Everything is circumventable in the end,” he said.

As if that were not enough, they are also using Social Networking for C2 including MSN and Google Chat and MSN. 

Funny how AV companies are really quiet about all this novel capabilities.  My dime is that they are sitting untouched in those massive Malware repositories they have.  Maybe if the drop all their Allapple/Virut/Sality samples they could see the forest for the trees.

Forget about it.  Events like this and other zero days will forever put data at Risk.  Of course Im talking about the new 0-day vulnerability that promises to pwn systems the world over, unless you use another browser such as the excellent and wind up getting pwned by some other exploit.  These are called drive-bys but don’t leave your physical body red and bloody, just your bank account and identity and you sense of personal well being and place in this world.  At least there are some that can rapidly respond with intelligence and sympathy.  Im speaking about the excellent analysis that is available from the researchers at and other organizations who consistently provide the detail for enlightened understanding. 


Here is what they have … on …DruUUUm roll please…  The !  It exploits a library function in IE to exploit XML functionality with a ofuscated Javascript delivered by still more SQL injection attacks.  The actual shell code is pretty awesome and can pwn Vista as well due to the evolution of exploits utilizing techniques instead of typical and rapidly becoming exinct buffer overflows via the stack.  From this point it can deliver to a host system any manner of malware as seen and .

Heh,  I just confirmed that one of our clients got exploited on the 11th/12th which means that its pretty prevalent.  That was like 4 days ago!

already has posted the so its only a matter of time till mass chaos.  At this point Microsoft doesnt have a patch yet.  And has already added a for it in the excellent engine of mass destruction. 

On another note, peeps should be using the as it removes a ton of malware from their systems monthly.  You can it removes here which gives pretty good descriptions of the nastiness out there today.

So a primary attack vector these days is seeding legitimate websites with links to malicous websites that exploit browsers and drop malware to users.  This attack vector is called which is a take off of the ages old technique of exploiting systems that do not sanitize and validate user input.. Sound Familar?  It basically inserts SQL language code into websites with database backends and makes modifications to the website content.  Think modification of every single page on the site to host an invisible obfuscated Javascript with an Iframe in it. 

In a YA(for fun and profit paper) the guys at present a on these issues and what you can do with them. NGSsoftware also has for these problems.


Get every new post delivered to your Inbox.