Red Menshen: A Look into the Chinese Cyber Espionage Threat

Indicators of Compromise

APT Groups

Notes

<div><div><b>Introduction:</b><br></div><div><br></div><div>Cybersecurity threats are becoming more and more sophisticated, and advanced persistent threat (APT) groups are a major cause for concern. One such group that has been active since is Red Menshen, a China-based APT group that has been conducting cyber espionage operations against government agencies, military organizations, corporations, and more. In this post, we'll take a closer look at the threat posed by Red Menshen and its custom backdoor, BPFDoor.</div><div><br></div><div><b>About Red Menshen:</b></div><div><br></div><div>Red Menshen is a highly effective and persistent APT group that has been targeting a variety of organizations across the globe. The group is known for its use of custom-built tools, making it a formidable threat. Some of the sectors that have been targeted by Red Menshen include telecommunications providers, government entities, education institutions, and logistics companies.</div><div><br></div><div><b>BPFDoor: A Custom Backdoor</b></div><div><br></div><div>One of the tools used by Red Menshen is BPFDoor, a custom backdoor that has been observed in attacks against organizations in the US, South Korea, Hong Kong, Turkey, India, Viet Nam, Myanmar, and more. BPFDoor is used by the group to gain unauthorized access to targeted systems and carry out post-exploitation activities, such as stealing sensitive information and moving laterally within the network.</div><div><br></div><div>BPFDoor is a highly evasive backdoor that doesn't open any inbound network ports, doesn't use an outbound command and control (C2), and renames its own process in Linux. This makes it difficult for security systems to detect.</div></div><div><br></div><div><b>Florian Roth found BPFDoor controller source code&nbsp;</b><br></div><div><span style="color: var(--q-dark);"><br></span></div><div><span style="color: var(--q-dark);">Sample</span><br></div><div><div><br></div><div><span style="color: var(--q-dark);">https[:]//virustotal[.]com[/]gui[/]file[/]8b9db0bc9152628bdacc32dab01590211bee9f27d58e0f66f6a1e26aea7552a6[/]detection</span><br></div><div><br></div><div>Source</div><div>https[:]//pastebin[.]com[/]kmmJuuQP</div></div><div><br></div>This refers to an outdated version of the implant from around 2018, which can be found on the website Pastebin.<div><br></div><div><br></div><div><img src="https://pbs.twimg.com/media/FSOWeoLX0AAA14v?format=jpg&amp;name=large" alt="Image"><br></div><div><br></div><div><img src="https://pbs.twimg.com/media/FSOWfguWQAAqZwf?format=jpg&amp;name=large" alt="Image"><br></div>

Mitigation

<div>T1036.005- Masquerading: Match Legitimate Name or Location</div><div>T1070.004- Indicator Removal on Host: File Deletion</div><div>T1070.006- Indicator Removal on Host: Time Stomp</div><div>T1059.004- Command and Scripting Interpreter: Unix Shell</div><div>T1106- Native API</div><div>T1548.001- Abuse Elevation Control Mechanism: Setuid and Setgid</div><div>T1095- Non-Application Layer Protocol</div><div><br></div><div><div>Mitigation:</div><div><ul><li>Awareness: Ensure that employees and stakeholders are aware of the threat posed by BPFDoor and the importance of following security best practices, such as avoiding suspicious emails and links and keeping software up-to-date.</li><li>Patch Management: Regularly apply security patches and updates to the operating system, applications, and firmware to close any vulnerabilities that may be exploited by attackers.</li><li>Endpoint protection: Implement robust endpoint protection solutions to detect and prevent the spread of malware, including BPFDoor.</li><li>Network Segmentation: Segment the network into smaller, secure zones to reduce the attack surface and limit the spread of malware if a breach occurs.</li><li>Backup and Recovery: Regularly back up critical data and implement a robust disaster recovery plan to ensure that business operations can continue in the event of a successful attack.</li><li>Monitoring: Monitor the network for unusual activity and implement security tools such as intrusion detection systems and log analysis tools to detect any potential threats.</li><li>Incident Response Plan: Have an incident response plan in place to quickly and effectively respond to a breach or attack, including procedures for isolating affected systems and preserving evidence for forensic analysis.</li></ul></div><div><br></div><div><br></div><div><br></div></div>