The document discusses the Sednit group, also known as APT28 or Fancy Bear, which has been conducting targeted cyber-espionage operations since 2006, focusing on geopolitics and key individuals in Eastern Europe. It provides a detailed analysis of the group's toolkit, including various exploits, custom software, and the methodologies used to carry out phishing attacks and infiltrate sensitive networks. A case study involving a fictional target named Serge illustrates how such attacks are executed and the tools used throughout the process.

1. Visiting The Bear Den
A Journey in the Land of (Cyber-)Espionage
Joan Calvet
Jessy Campos
Thomas Dupuy
1

2. Sednit Group
• Also know as APT28, Fancy Bear, Sofacy,
STRONTIUM, Tsar Team
• Group of attackers doing targeted attacks
since 2006
• Mainly interested into geopolitics
2

3. 3
Plan
• Context
• The Week Serge Met The Bear
• The Mysterious DOWNDELPH
• Speculative Mumblings

4. CONTEXT
What kind of group is Sednit?
4

5. Who Is The Bear After? (1)
• We found a list of targets for Sednit
phishing campaigns:
– Operators used Bitly and “forgot” to set the
profile private
(feature now removed from Bitly)
– Around 4,000 shortened URLs during 6
months in 2015
5

6. 6
http://login.accoounts-google.com/url/?continue=
cGFyZXBreWl2QGdtYWlsLmNvbQ==&df=UGFraXN0
YW4rRW1iYXNzeStLeWl2&tel=1
Who Is The Bear After? (2)

7. 6
http://login.accoounts-google.com/url/?continue=
cGFyZXBreWl2QGdtYWlsLmNvbQ==&df=UGFraXN0
YW4rRW1iYXNzeStLeWl2&tel=1
Who Is The Bear After? (2)
parepkyiv@gmail.com

8. 6
http://login.accoounts-google.com/url/?continue=
cGFyZXBreWl2QGdtYWlsLmNvbQ==&df=UGFraXN0
YW4rRW1iYXNzeStLeWl2&tel=1
Who Is The Bear After? (2)
parepkyiv@gmail.com
Pakistan+Embassy+Kyiv

9. 6
http://login.accoounts-google.com/url/?continue=
cGFyZXBreWl2QGdtYWlsLmNvbQ==&df=UGFraXN0
YW4rRW1iYXNzeStLeWl2&tel=1
Who Is The Bear After? (2)
parepkyiv@gmail.com
Pakistan+Embassy+Kyiv

10. Who Is The Bear After? (3)
• Embassies and ministries of more than 40 countries
• NATO and EU institutions
• “Who’s who” of individuals involved in Eastern Europe
politics:
– Politicians
– Activists
– Journalists
– Academics
– Militaries
– …
7

11. The Bear Has Money
• A bag full of 0-day exploits:
8
2015
Apr May Jun Jul Aug Sep Oct
CVE-2015-3043 (Flash)
CVE-2015-1701 (Windows LPE)
CVE-2015-2590 (Java)
CVE-2015-4902 (Java click-to-play bypass)
CVE-2015-7645
(Flash)
CVE-2015-2424 (Office RCE)

12. The Bear Can Code
• Tens of custom-made software used since 2006:
– Droppers
– Downloaders
– Reconnaissance tools
– Long-term spying backdoors
– Encryption proxy tool
– USB C&C channel
– Many helper tools
– …
9

13. Disclaimers
• Over the last two years we tracked Sednit closely,
but of course our visibility is not exhaustive
• How do we know it is ONE group?
– We don’t
– Our Sednit “definition” is based on their toolkit and the
related infrastructure
• We do not do attribution (but we point out hints that may
be used for that)
10

14. THE WEEK SERGE MET THE BEAR
11

15. Who Is Serge?
• Code name for an imaginary Sednit target
• Serge is a government employee with access to
sensitive information
• The chain of events in Serge’s attack matches
several real cases we investigated
• We use it as a textbook case to present (a part of)
the Sednit toolkit
12

16. 13
Monday, 9:30AM

17. Serge Opens an Email
14

18. Legitimate URL Mimicking
15

19. Legitimate URL Mimicking
15

20. Legitimate URL Mimicking
15

21. Legitimate URL Mimicking
15

22. 16
Serge clicks on the URL, and…

23. …Serge Meets SEDKIT
• Exploit-kit for targeted attacks
• Entry-point URLs mimic legitimate URLs
• Usually propagated by targeted phishing emails
(also seen with hacked website + iframe)
• Period of activity: September 2014 - Now
17

24. Landing Page (1)
Reconnaissance Report Building
18

25. Landing Page (1)
Reconnaissance Report Building
18

26. Landing Page (1)
Reconnaissance Report Building
18

27. 19

28. Crawling Sedkit
20

29. 21
Serge is selected to be
exploited…

30. … and Visits Sednit Exploits Factory
Vulnerability Targeted Application Note
CVE-2013-1347 Internet Explorer 8
CVE-2013-3897 Internet Explorer 8
CVE-2014-1510 +
CVE-2014-1511
Firefox
CVE-2014-1776 Internet Explorer 11
CVE-2014-6332 Internet Explorer Several versions
N/A MacKeeper
CVE-2015-2590 +
CVE-2015-4902
Java 0-day*
CVE-2015-3043 Adobe Flash 0-day*
CVE-2015-5119 Adobe Flash Hacking Team gift
CVE-2015-7645 Adobe Flash 0-day*
22
* : At the time SEDKIT dropped them

31. … and Visits Sednit Exploits Factory
Vulnerability Targeted Application Note
CVE-2013-1347 Internet Explorer 8
CVE-2013-3897 Internet Explorer 8
CVE-2014-1510 +
CVE-2014-1511
Firefox
CVE-2014-1776 Internet Explorer 11
CVE-2014-6332 Internet Explorer Several versions
N/A MacKeeper
CVE-2015-2590 +
CVE-2015-4902
Java 0-day*
CVE-2015-3043 Adobe Flash 0-day*
CVE-2015-5119 Adobe Flash Hacking Team gift
CVE-2015-7645 Adobe Flash 0-day*
23
* : At the time SEDKIT dropped them

32. … and Visits Sednit Exploits Factory
Vulnerability Targeted Application Note
CVE-2013-1347 Internet Explorer 8
CVE-2013-3897 Internet Explorer 8
CVE-2014-1510 +
CVE-2014-1511
Firefox
CVE-2014-1776 Internet Explorer 11
CVE-2014-6332 Internet Explorer Several versions
N/A MacKeeper
CVE-2015-2590 +
CVE-2015-4902
Java 0-day*
CVE-2015-3043 Adobe Flash 0-day*
CVE-2015-5119 Adobe Flash Hacking Team gift
CVE-2015-7645 Adobe Flash 0-day*
24
* : At the time SEDKIT dropped them

33. … and Visits Sednit Exploits Factory
Vulnerability Targeted Application Note
CVE-2013-1347 Internet Explorer 8
CVE-2013-3897 Internet Explorer 8
CVE-2014-1510 +
CVE-2014-1511
Firefox
CVE-2014-1776 Internet Explorer 11
CVE-2014-6332 Internet Explorer Several versions
N/A MacKeeper
CVE-2015-2590 +
CVE-2015-4902
Java 0-day*
CVE-2015-3043 Adobe Flash 0-day*
CVE-2015-5119 Adobe Flash Hacking Team gift
CVE-2015-7645 Adobe Flash 0-day*
25
* : At the time SEDKIT dropped them

34. Revamping CVE-2014-6332
(a.k.a. IE “Unicorn bug”)
• October 2015:
– Re-use of public PoC to disable VBScript “SafeMode”
– Next stage binary downloaded by PowerShell
26

35. Revamping CVE-2014-6332
(a.k.a. IE “Unicorn bug”)
• October 2015:
– Re-use of public PoC to disable VBScript “SafeMode”
– Next stage binary downloaded by PowerShell
• February 2016:
– No more “SafeMode” disabling, direct ROP-based
shellcode execution
– Around 400 lines of VBScript, mostly custom
27

36. 28

37. 29

38. VBScript Framework
• Functions:
– addToROP()
– getROPstringAddress ()
– Code_section_explorer_7 ()
– Code_section_explorer_XP()
– getNeddedAddresses ()
– addrToHex ()
– …
30

39. VBScript Framework
• Functions:
– addToROP()
– getROPstringAddress ()
– Code_section_explorer_7 ()
– Code_section_explorer_XP()
– getNeddedAddresses ()
– addrToHex ()
– …
Have you ever seen this somewhere?
(cuz we don’t)
30

40. 31
Exploit downloads a payload
and…

41. Serge Meets SEDUPLOADER
(a.k.a. JHUHUGIT, JKEYSKW)
• Downloaded by SEDKIT
• Two binaries: the dropper and its embedded
payload
• Deployed as a first-stage component
• Period of activity: March 2015 - Now

42. SEDUPLOADER DROPPER
Workflow
Anti-
Analysis
Payload
Dropping
Escalating
Privileges
Payload
Persistence

43. SEDUPLOADER DROPPER
Workflow
Anti-
Analysis
Payload
Dropping
Escalating
Privileges
Payload
Persistence

50. SEDUPLOADER DROPPER
Workflow
Anti-
Analysis
Payload
Dropping
Escalating
Privileges
Payload
Persistence

51. SEDUPLOADER DROPPER
Workflow
Anti-
Analysis
Payload
Dropping
Escalating
Privileges
Payload
Persistence
• CVE-2015-1701 (0-day)
• CVE-2015-2387 ( )

52. SEDUPLOADER DROPPER
Workflow
Anti-
Analysis
Payload
Dropping
Escalating
Privileges
Payload
Persistence
• Windows COM object hijacking
• Shell Icon Overlay COM object
• Registry key UserInitMprLogonScript
• JavaScript code executed within rundll32.exe
• Scheduled tasks, Windows service,…

53. SEDUPLOADER DROPPER
Workflow
Anti-
Analysis
Payload
Dropping
Escalating
Privileges
Payload
Persistence
• Windows COM object hijacking
• Shell Icon Overlay COM object
• Registry key UserInitMprLogonScript
• JavaScript code executed within rundll32.exe
• Scheduled tasks, Windows service,…

54. SEDUPLOADER DROPPER
Workflow
Anti-
Analysis
Payload
Dropping
Escalating
Privileges
Payload
Persistence
• Windows COM object hijacking Win32/COMpfun
• Shell Icon Overlay COM object
• Registry key UserInitMprLogonScript
• JavaScript code executed within rundll32.exe Win32/Poweliks
• Scheduled tasks, Windows service,…

55. SEDUPLOADER PAYLOAD
Workflow
Network Link
Establishment
First Stage
Report
Parsing C&C
Orders

56. SEDUPLOADER PAYLOAD
Workflow
Network Link
Establishment
First Stage
Report
Parsing C&C
Orders

57. SEDUPLOADER PAYLOAD
Workflow
Network Link
Establishment
First Stage
Report
Parsing C&C
Orders
Direct
Connection

58. SEDUPLOADER PAYLOAD
Workflow
Network Link
Establishment
First Stage
Report
Parsing C&C
Orders
Direct
Connection
C&C
Successfully
Contacted
SUCCESS

59. SEDUPLOADER PAYLOAD
Workflow
Network Link
Establishment
First Stage
Report
Parsing C&C
Orders
Direct
Connection
Via Proxy
C&C
Successfully
Contacted
FAIL
SUCCESS

60. SEDUPLOADER PAYLOAD
Workflow
Network Link
Establishment
First Stage
Report
Parsing C&C
Orders
Direct
Connection
Via Proxy
C&C
Successfully
Contacted
FAIL
SUCCESS

61. SEDUPLOADER PAYLOAD
Workflow
Network Link
Establishment
First Stage
Report
Parsing C&C
Orders
Direct
Connection
Via Proxy
Inject Into
Browsers
C&C
Successfully
Contacted
FAIL
SUCCESS

62. SEDUPLOADER PAYLOAD
Workflow
Network Link
Establishment
First Stage
Report
Parsing C&C
Orders
Direct
Connection
Via Proxy
Inject Into
Browsers
C&C
Successfully
Contacted
FAIL
SUCCESS

63. SEDUPLOADER PAYLOAD
Workflow
Network Link
Establishment
First Stage
Report
Parsing C&C
Orders

64. SEDUPLOADER PAYLOAD
Workflow
Network Link
Establishment
First Stage
Report
Parsing C&C
Orders

65. East Side Story
printf debugging

66. 46
Serge opens an email
leading to SEDKIT, and then
SEDUPLOADER
9:30AM
Chain of Events
Mon Tue Wed Thu Fri

67. 47
Monday, 10:00AM

68. …Serge meets SEDRECO
• Downloaded by SEDUPLOADER
• Backdoor with the ability to load external
plugins
• Usually deployed as a second stage backdoor
to spy on the infected computer
• Period of activity : 2012 - Now
48

69. Dropper
• Drops encrypted configuration
– In a file (“msd”)
– In the Windows Registry
• No configuration linked to the payload

70. Configuration Overview

71. Configuration Overview
XOR KEY

72. Configuration Overview
XOR KEY FIELD SIZES

73. Configuration Overview (Decrypted)

74. Configuration Overview (Decrypted)
('600000', '600000', ‘SERGE-PC…', 'kenlynton.com',
'softwaresupportsv.com', 'mtcf', '10000', '600000', '1',
'updmanager.com', '', '', '', '', '', '', '', '', '', '')

75. Configuration Overview (Decrypted)
('600000', '600000', ‘SERGE-PC…', 'kenlynton.com',
'softwaresupportsv.com', 'mtcf', '10000', '600000', '1',
'updmanager.com', '', '', '', '', '', '', '', '', '', '')
Various timeouts

76. Configuration Overview (Decrypted)
('600000', '600000', ‘SERGE-PC…', 'kenlynton.com',
'softwaresupportsv.com', 'mtcf', '10000', '600000', '1',
'updmanager.com', '', '', '', '', '', '', '', '', '', '')
Computer name

77. Configuration Overview (Decrypted)
('600000', '600000', ‘SERGE-PC…', 'kenlynton.com',
'softwaresupportsv.com', 'mtcf', '10000', '600000', '1',
'updmanager.com', '', '', '', '', '', '', '', '', '', '')
Keylogger enabled

78. Configuration Overview (Decrypted)
('600000', '600000', ‘SERGE-PC…', 'kenlynton.com',
'softwaresupportsv.com', 'mtcf', '10000', '600000', '1',
'updmanager.com', '', '', '', '', '', '', '', '', '', '')
C&C servers

79. Configuration Overview (Decrypted)
('600000', '600000', ‘SERGE-PC…', 'kenlynton.com',
'softwaresupportsv.com', 'mtcf', '10000', '600000', '1',
'updmanager.com', '', '', '', '', '', '', '', '', '', '')
Operation name
(rhst, rhbp, mctf, mtqs)

80. Configuration Overview (Decrypted)
('600000', '600000', ‘SERGE-PC…', 'kenlynton.com',
'softwaresupportsv.com', 'mtcf', '10000', '600000', '1',
'updmanager.com', '', '', '', '', '', '', '', '', '', '')
Plugins list

81. Payload

82. Payload

83. Payload

84. Payload

85. Payload

86. Payload

87. Payload

88. Payload

89. Payload

90. Extending The Core (1)
• Plugins are DLLs loaded in the same address
space
• Plugins receive arguments from the core:

91. Extending The Core (1)
• Plugins are DLLs loaded in the same address
space
• Plugins receive arguments from the core:

92. Extending The Core (1)
• Plugins are DLLs loaded in the same address
space
• Plugins receive arguments from the core:

93. Extending The Core (2)

94. Extending The Core (2)
New command

95. 55
Serge opens an email
leading to SEDKIT, and then
SEDUPLOADER
9:30AM
SEDRECO deployment
10:00AM
Chain of Events
Mon Tue Wed Thu Fri

96. 56
Monday, 2:00PM

97. Serge Meets XAGENT
(a.k.a SPLM, CHOPSTICK)
• Downloaded by SEDUPLOADER
• Modular backdoor developed in C++ with Windows,
Linux and iOS versions
• Deployed in most Sednit operations, usually after the
reconnaissance phase
• Period of activity: November 2012 - Now
57

98. 58

99. 59

100. • Linux XAGENT, compiled in July 2015
59

101. • Linux XAGENT, compiled in July 2015
• ~ 18,000 lines of code in 59 classes
59

102. • Linux XAGENT, compiled in July 2015
• ~ 18,000 lines of code in 59 classes
• Derives from Windows version:
59

103. • Linux XAGENT, compiled in July 2015
• ~ 18,000 lines of code in 59 classes
• Derives from Windows version:
• XAGENT major version 2, but matches the
logic of currently distributed binaries
(version 3)
59

104. Such Comments
60
<- That’s a lot

105. 61
main.cpp

106. 61
main.cpp

107. 61
main.cpp

108. 61
main.cpp

109. 61
main.cpp

110. 61
main.cpp

111. 62
Translates messages
from modules for
the C&C server
Translates messages
from the C&C
server for modules
AgentKernel::run()
AgentKernel
RemoteShell
FSModule
Keylogger
Channel
Controller
Modules
C&C
SERVER
Unencrypted messages
Encrypted messages
Communication Workflow
XAGENT INFECTED COMPUTER

112. 62
Translates messages
from modules for
the C&C server
Translates messages
from the C&C
server for modules
AgentKernel::run()
AgentKernel
RemoteShell
FSModule
Keylogger
Channel
Controller
Modules
C&C
SERVER
Unencrypted messages
Encrypted messages
Communication Workflow
XAGENT INFECTED COMPUTER

113. 62
Translates messages
from modules for
the C&C server
Translates messages
from the C&C
server for modules
AgentKernel::run()
AgentKernel
RemoteShell
FSModule
Keylogger
Channel
Controller
Modules
C&C
SERVER
Unencrypted messages
Encrypted messages
Communication Workflow
XAGENT INFECTED COMPUTER

114. 62
Translates messages
from modules for
the C&C server
Translates messages
from the C&C
server for modules
AgentKernel::run()
AgentKernel
RemoteShell
FSModule
Keylogger
Channel
Controller
Modules
C&C
SERVER
Unencrypted messages
Encrypted messages
Communication Workflow
XAGENT INFECTED COMPUTER

115. 62
Translates messages
from modules for
the C&C server
Translates messages
from the C&C
server for modules
AgentKernel::run()
AgentKernel
RemoteShell
FSModule
Keylogger
Channel
Controller
Modules
C&C
SERVER
Unencrypted messages
Encrypted messages
Communication Workflow
XAGENT INFECTED COMPUTER

116. 62
Translates messages
from modules for
the C&C server
Translates messages
from the C&C
server for modules
AgentKernel::run()
AgentKernel
RemoteShell
FSModule
Keylogger
Channel
Controller
Modules
C&C
SERVER
Unencrypted messages
Encrypted messages
Communication Workflow
XAGENT INFECTED COMPUTER

117. 62
Translates messages
from modules for
the C&C server
Translates messages
from the C&C
server for modules
AgentKernel::run()
AgentKernel
RemoteShell
FSModule
Keylogger
Channel
Controller
Modules
C&C
SERVER
Unencrypted messages
Encrypted messages
Communication Workflow
XAGENT INFECTED COMPUTER

118. 62
Translates messages
from modules for
the C&C server
Translates messages
from the C&C
server for modules
AgentKernel::run()
AgentKernel
RemoteShell
FSModule
Keylogger
Channel
Controller
Modules
C&C
SERVER
Unencrypted messages
Encrypted messages
Channel
(HTTP or emails)
Communication Workflow
XAGENT INFECTED COMPUTER

119. Emails Channel (1)
Workflow
63
exfil@gmail.com
orders@gmail.comXAGENT INFECTED
COMPUTER
USING MailChannel
C&C SERVER

120. Emails Channel (1)
Workflow
63
exfil@gmail.com
orders@gmail.comXAGENT INFECTED
COMPUTER
USING MailChannel
SMTPS
C&C SERVER

121. Emails Channel (1)
Workflow
63
exfil@gmail.com
orders@gmail.comXAGENT INFECTED
COMPUTER
USING MailChannel
SMTPS POP3S
C&C SERVER

122. Emails Channel (1)
Workflow
63
exfil@gmail.com
orders@gmail.comXAGENT INFECTED
COMPUTER
USING MailChannel
SMTPS POP3S
SMTPS
C&C SERVER

123. Emails Channel (1)
Workflow
63
exfil@gmail.com
orders@gmail.comXAGENT INFECTED
COMPUTER
USING MailChannel
SMTPS
POP3S
POP3S
SMTPS
C&C SERVER

124. Emails Channel (1)
Workflow
63
exfil@gmail.com
orders@gmail.comXAGENT INFECTED
COMPUTER
USING MailChannel
SMTPS
POP3S
POP3S
SMTPS
C&C SERVER
An email-based C&C protocol needs to provide:
1. A way to distinguish C&C emails from unrelated emails
2. A way to bypass spam filters

125. Email Channel (2)
P2Scheme, a.k.a “Level 2 Protocol”
64

126. Email Channel (2)
P2Scheme, a.k.a “Level 2 Protocol”
64
KEY SUBJ_TOKEN ^ KEY XAGENT_ID ^ KEY
base64
0 5 12 16

127. Email Channel (2)
P2Scheme, a.k.a “Level 2 Protocol”
64
KEY SUBJ_TOKEN ^ KEY XAGENT_ID ^ KEY
base64
0 5 12 16

128. Email Channel (3)
Georgian Protocol
65

129. Email Channel (3)
Georgian Protocol
65
Georgian national ID number

130. Email Channel (3)
Georgian Protocol
65
Georgian national ID number
“Hello”

131. Email Channel (3)
Georgian Protocol
65
Georgian national ID number
“Hello”
“detailed” + timestamp

132. Bonus: XAGENT C&C Infrastructure
66

133. Bonus: XAGENT C&C Infrastructure
66
Thank you, Google search engine

134. XAGENT Proxy Server
• Python code used between April and June
2015

135. XAGENT Proxy Server
• Python code used between April and June
2015
• ~ 12,200 lines of code

136. XAGENT Proxy Server
• Python code used between April and June
2015
• ~ 12,200 lines of code
• Translates email protocol from XAGENT
into a HTTP protocol for the C&C server:
(over HTTP)
P3Protocol
XAGENT PROXY BACKEND
C&C SERVER
INBOX
P2Protocol

137. 68
Serge opens an email
leading to SEDKIT, and then
SEDUPLOADER
9:30AM
SEDRECO deployment
10:00AM
XAGENT deployment
02:00PM
Chain of Events
Mon Tue Wed Thu Fri

138. 69
Next three days…

139. Serge Meets
Passwords Extractors
• SecurityXploded tools (grand classic of Sednit)
– Cons: usually detected by AV software
• Custom tools, in particular a Windows Live
Mail passwords extractor compiled for Serge:
70

140. Serge Meets
Windows Passwords Extractors
• From registry hives
– Deployed with LPE for CVE-2014-4076
• Good ol’ Mimikatz (“pi.log”)
– Deployed with LPE for CVE-2015-1701
71

141. Serge Meets Screenshoter
• Custom tool to take screenshots each time the
mouse moves
72

142. And… Serge Meets XTUNNEL
• Network proxy tool to contact machines
normally unreachable from Internet
• Period of activity: May 2013 - Now
73

143. 74
SERGE’S
COMPUTER
(XTUNNEL
INFECTED)COMPUTER A
(CLEAN)
COMPUTER B
(CLEAN)
INTERNET
INTERNAL
NETWORK
C&C SERVER
Initial
Situation

144. 75
SERGE’S
COMPUTER
(XTUNNEL
INFECTED)
INTERNET
INTERNAL
NETWORK
Encryption
Handshake
C&C SERVER
COMPUTER A
(CLEAN)
COMPUTER B
(CLEAN)

145. 75
SERGE’S
COMPUTER
(XTUNNEL
INFECTED)
INTERNET
INTERNAL
NETWORK
D5 47 A4 A4.3F 60 6A 0F
3B 36 04 1C.44 4A C8 BD
80 BE 7B 25.8E E6 FC F2
CD 5D 7F 3A.73 1D 59 A5
2D 35 77 F3.B2 1B DF 7D
EE 1D 1C F1.AB 91 87 87
…
Encryption
Handshake
D5 47 A4 A4.3F 60 6A 0F
3B 36 04 1C.44 4A C8 BD
80 BE 7B 25.8E E6 FC F2
CD 5D 7F 3A.73 1D 59 A5
2D 35 77 F3.B2 1B DF 7D
EE 1D 1C F1.AB 91 87 87
…
T
T
C&C SERVER
COMPUTER A
(CLEAN)
COMPUTER B
(CLEAN)

146. 75
SERGE’S
COMPUTER
(XTUNNEL
INFECTED)
INTERNET
INTERNAL
NETWORK
D5 47 A4 A4.3F 60 6A 0F
3B 36 04 1C.44 4A C8 BD
80 BE 7B 25.8E E6 FC F2
CD 5D 7F 3A.73 1D 59 A5
2D 35 77 F3.B2 1B DF 7D
EE 1D 1C F1.AB 91 87 87
…
Encryption
Handshake
D5 47 A4 A4.3F 60 6A 0F
3B 36 04 1C.44 4A C8 BD
80 BE 7B 25.8E E6 FC F2
CD 5D 7F 3A.73 1D 59 A5
2D 35 77 F3.B2 1B DF 7D
EE 1D 1C F1.AB 91 87 87
…
T
T
RC4 key
O
C&C SERVER
COMPUTER A
(CLEAN)
COMPUTER B
(CLEAN)

147. 75
SERGE’S
COMPUTER
(XTUNNEL
INFECTED)
INTERNET
INTERNAL
NETWORK
D5 47 A4 A4.3F 60 6A 0F
3B 36 04 1C.44 4A C8 BD
80 BE 7B 25.8E E6 FC F2
CD 5D 7F 3A.73 1D 59 A5
2D 35 77 F3.B2 1B DF 7D
EE 1D 1C F1.AB 91 87 87
…
Encryption
Handshake
D5 47 A4 A4.3F 60 6A 0F
3B 36 04 1C.44 4A C8 BD
80 BE 7B 25.8E E6 FC F2
CD 5D 7F 3A.73 1D 59 A5
2D 35 77 F3.B2 1B DF 7D
EE 1D 1C F1.AB 91 87 87
…
T
T
 Offset O in T
 Proof of knowledge of T
RC4 key
O
C&C SERVER
COMPUTER A
(CLEAN)
COMPUTER B
(CLEAN)

148. 76
SERGE’S
COMPUTER
(XTUNNEL
INFECTED)
INTERNET
INTERNAL
NETWORK
D5 47 A4 A4.3F 60 6A 0F
3B 36 04 1C.44 4A C8 BD
80 BE 7B 25.8E E6 FC F2
CD 5D 7F 3A.73 1D 59 A5
2D 35 77 F3.B2 1B DF 7D
EE 1D 1C F1.AB 91 87 87
…
Encryption
Handshake
D5 47 A4 A4.3F 60 6A 0F
3B 36 04 1C.44 4A C8 BD
80 BE 7B 25.8E E6 FC F2
CD 5D 7F 3A.73 1D 59 A5
2D 35 77 F3.B2 1B DF 7D
EE 1D 1C F1.AB 91 87 87
…
T
T
“OK”
RC4 key
RC4 Key
O
O
C&C SERVER
COMPUTER A
(CLEAN)
COMPUTER B
(CLEAN)

149. 77
C&C SERVER
SERGE’S
COMPUTER
(XTUNNEL
INFECTED)
INTERNET
INTERNAL
NETWORK
Encryption
Handshake
RC4-encrypted link
COMPUTER A
(CLEAN)
COMPUTER B
(CLEAN)

150. 78
C&C SERVER
SERGE’S
COMPUTER
(XTUNNEL
INFECTED)
INTERNET
INTERNAL
NETWORK
Encryption
Handshake
TLS encapsulation
(added in 2014)
COMPUTER A
(CLEAN)
COMPUTER B
(CLEAN)

151. 79
C&C SERVER
SERGE’S
COMPUTER
(XTUNNEL
INFECTED)
INTERNET
INTERNAL
NETWORK
Tunnels
Opening
COMPUTER A
(CLEAN)
COMPUTER B
(CLEAN)

152. 79
C&C SERVER
SERGE’S
COMPUTER
(XTUNNEL
INFECTED)
INTERNET
INTERNAL
NETWORK
Tunnels
Opening
COMPUTER A
(CLEAN)
COMPUTER B
(CLEAN)

153. 79
C&C SERVER
SERGE’S
COMPUTER
(XTUNNEL
INFECTED)
INTERNET
INTERNAL
NETWORK
Tunnels
Opening
COMPUTER A
(CLEAN)
COMPUTER B
(CLEAN)
Any kind of TCP-based
traffic can be tunneled!
(PsExec)

154. 79
C&C SERVER
SERGE’S
COMPUTER
(XTUNNEL
INFECTED)
INTERNET
INTERNAL
NETWORK
Tunnels
Opening
COMPUTER A
(CLEAN)
COMPUTER B
(CLEAN)
Any kind of TCP-based
traffic can be tunneled!
(PsExec)

155. Code Obfuscation (1)
• Starting in July 2015 XTUNNEL code was
obfuscated
(which is two months after the Sednit attack against
the German parliament, where XTUNNEL was used)
80

156. Code Obfuscation (1)
• Starting in July 2015 XTUNNEL code was
obfuscated
(which is two months after the Sednit attack against
the German parliament, where XTUNNEL was used)
• The obfuscation is a mix of classic syntactic
techniques, like insertion of junk code and
opaque predicates
80

157. Code Obfuscation (2)
BEFORE AFTER
81

158. Code Obfuscation (2)
BEFORE AFTER
81
Good toy example for automatic
desobfuscation magic?

159. 82
Serge opens an email
leading to SEDKIT, and then
SEDUPLOADER
9:30AM
SEDRECO deployment
10:00AM
XAGENT deployment
02:00PM
Information
exfiltration and
lateral movements
Chain of Events
Mon Tue Wed Thu Fri

160. 83
Friday, 11:00AM

161. Long Term Persistence (1)
• Special XAGENT copied in Office folder under
the name “msi.dll”
84

162. Long Term Persistence (2)
• system32msi.dll is a legitimate Windows
DLL needed by Office applications
85

163. Long Term Persistence (2)
• system32msi.dll is a legitimate Windows
DLL needed by Office applications
• XAGENT msi.dll exports the same function
names as the legitimate msi.dll:
85

164. Long Term Persistence (3)
• Each time Serge starts Office, XAGENT
msi.dll is loaded (search-order hijacking):
– Loads real msi.dll from system32
– Fills its export table with the addresses of the real
msi.dll functions
– Starts XAGENT malicious logic
86

165. Long Term Persistence (3)
• Each time Serge starts Office, XAGENT
msi.dll is loaded (search-order hijacking):
– Loads real msi.dll from system32
– Fills its export table with the addresses of the real
msi.dll functions
– Starts XAGENT malicious logic
• Same technique also seen with
LINKINFO.dll dropped in C:WINDOWS
86

166. 87
Serge opens an email
leading to SEDKIT, and then
SEDUPLOADER
9:30AM
SEDRECO deployment
10:00AM
XAGENT deployment
02:00PM
Long-term
persistence
method
deployment
11:00AM
Chain of Events
Mon Tue Wed Thu Fri
Information
exfiltration and
lateral movements

167. THE MYSTERIOUS DOWNDELPH
What the hell is going on here ?!
88

168. Discovery
September 2015
• Classic Sednit dropper
• Shows a decoy document

169. What Is In This Dropper?

170. The Ultimate Boring Component
• Delphi downloader, we named it DOWNDELPH
(slow clap)
• Simple workflow:
– Downloads a config (.INI file)
– Based on the config, downloads a payload
– Executes payload
• Persistence method: Run registry key

171. The Ultimate Boring Component
• Delphi downloader, we named it DOWNDELPH
(slow clap)
• Simple workflow:
– Downloads a config (.INI file)
– Based on the config, downloads a payload
– Executes payload
• Persistence method: Run registry key

172. Let The Hunt Begins
2013 DOWNDELPH Sample
Dropper
Helper Bootkit Installer DOWNDELPH

173. Let The Hunt Begins
2013 DOWNDELPH Sample
Dropper
Helper Bootkit Installer DOWNDELPH
• Infects BIOS-based systems
• Tested on Windows XP/7, 32bit/64bit
• Never been documented

174. Not So Boring Component

175. Bootkit Installation
MBR Legitimate data
First sectors before infection
1ST sector

176. Malicious
MBR
Original MBR
(1-byte XOR)
Hooks
(1-byte XOR)
Driver
(1-byte XOR + RC4)
Legitimate Data
First sectors before infection First sectors after infection
Bootkit Installation
1ST sector 2ND sector

177. Normal Boot Process
Windows 7 x64
BOOTMGR Winload.exe
…
Real Mode
Protected Mode
Original MBR
Kernel Init

178. Infected Boot Process
Windows 7 x64
Infected MBR BOOTMGR Winload.exe
Real Mode
Protected Mode
Original MBR
… Kernel Init

179. Infected Boot Process
Windows 7 x64
Infected MBR BOOTMGR Winload.exe
Real Mode
Protected Mode
Original MBR
… Kernel Init

180. Malicious MBR
• Hooks INT 13h handler (low-level read/write
operations)

181. Malicious MBR
• Hooks INT 13h handler (low-level read/write
operations)
• Patches BOOTMGR in memory

182. Bootkit Workflow
Infected MBR BOOTMGR Winload.exe
Real Mode
Protected Mode
Original MBR
… Kernel Init

183. Bootkit Workflow
Infected MBR BOOTMGR Winload.exe
Real Mode
Protected Mode
Original MBR
Hook
… Kernel Init

184. BOOTMGR Hook
• Searches OslArchTransferToKernel() in
winload.exe to patch it
kd> u winload!OslArchTransferToKernel
winload!OslArchTransferToKernel:
00000000`003381f0 e961fdd5ff jmp 00000000`00097f56
Before:
After:

185. Bootkit Workflow
Infected MBR BOOTMGR Winload.exe
Real Mode
Protected Mode
Original MBR
Hook
… Kernel Init

186. Bootkit Workflow
Infected MBR BOOTMGR Winload.exe
Real Mode
Protected Mode
Original MBR
Hook Hook
… Kernel Init

187. Winload.exe Hook
• Locates MmMapIoSpace
• Saves some code in ACPI.sys resources section
(and makes the section executable)
• Hooks ACPI!GsDriverEntry

188. Saving Important Information
ACPI!GsDriverEntry original
opcodes
0: kd> db rbx $$ kernel header address
4d 5a 90 00 03 00 00 00-04 00 00 00 ff ff 00 00 MZ..............
b8 00 00 00 00 00 00 00-40 00 00 00 00 00 00 00 ........@.......
00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00-00 00 00 00 f8 00 00 00 ................
00 74 09 00 00 b4 09 cd-21 b8 01 4c cd 21 54 68 .t......!..L.!Th
69 73 20 70 72 6f 67 72-61 6d 20 63 61 6e 6e 6f is program canno
74 20 62 65 20 72 75 6e-20 69 6e 20 44 4f 53 20 t be run in DOS
6d 6f 64 65 2e 0d 0d 0a-24 00 00 00 00 00 00 00 mode....$.......
8a 4a 9e 90 ce 2b f0 c3-ce 2b f0 c3 ce 2b f0 c3 .J...+...+...+..
c7 53 73 c3 aa 2b f0 c3-c7 53 63 c3 c5 2b f0 c3 .Ss..+...Sc..+..
ce 2b f1 c3 a2 2b c0 97-8f 00 00 f8 ff ff 30 fc .+...+........0.
04 00 f2 0f 00 00 48 83-ec 28 4c c3 d4 2b f0 c3 ......H..(L..+..
c7 53 62 c3 cf 2b f0 c3-c7 53 64 c3 cf 2b f0 c3 .Sb..+...Sd..+..
c7 53 61 c3 20 cd a2 02-00 f8 ff ff ce 2b f0 c3 .Sa. ........+..
00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00-50 45 00 00 64 86 18 00 ........PE..d...
Bootkit physical address
MmMapIoSpace address

189. Bootkit Workflow
Infected MBR BOOTMGR Winload.exe
ACPI.sys
Real Mode
Protected Mode
Original MBR
Kernel Init
Hook Hook
…

190. Bootkit Workflow
Infected MBR BOOTMGR Winload.exe
ACPI.sys
Real Mode
Protected Mode
Original MBR
Kernel Init
Hook Hook
Hook
…

191. ACPI.sys Hook
• Restores ACPI!GsDriverEntry
• Maps the bootkit physical address into virtual
address space by calling MmMapIoSpace
• Decrypts hidden driver

192. Bootkit Workflow
Infected MBR BOOTMGR Winload.exe
ACPI.sys
Bootkit Driver
“Bootkit
user-mode
component”
DOWNDELPH
Real Mode
Protected Mode
Original MBR
Kernel Init
Hook Hook
Hook

193. Bootkit Workflow
Infected MBR BOOTMGR Winload.exe
ACPI.sys
Bootkit Driver
“Bootkit
user-mode
component”
DOWNDELPH
Real Mode
Protected Mode
Original MBR
Kernel Init
Hook Hook
Hook

194. Bootkit Workflow
Infected MBR BOOTMGR Winload.exe
ACPI.sys
Bootkit Driver
“Bootkit
user-mode
component”
DOWNDELPH
Real Mode
Protected Mode
Original MBR
Kernel Init
Hook Hook
Hook

195. Bootkit Workflow
Infected MBR BOOTMGR Winload.exe
ACPI.sys
Bootkit Driver
“Bootkit
user-mode
component”
DOWNDELPH
Real Mode
Protected Mode
Original MBR
Kernel Init
Hook Hook
Hook
Why a DLL to load another DLL ?

196. Who Are You Bootkit?
• Missing exported variable in DOWNDELPH

197. Who Are You Bootkit?
• Missing exported variable in DOWNDELPH
• Code sharing with BlackEnergy
– Relocations fixing
– DLL injection calling three exports (“Entry”,
“ep_data” and “Dummy”)
– …

198. But It’s Not The End of The Story
2014 DOWNDELPH Samples
Dropper
Helper
Kernel Mode
Rootkit
DOWNDELPH

199. Not So Boring Component++

200. Kernel Mode Rootkit (1)
• Registered as a Windows service
• Injects DOWNDELPH into explorer.exe (APC)
• Hides files, folders and registry keys
• Relies on a set of rules:
HIDEDRV: >>>>>>>>Hide rules>>>>>>>> rules
HIDEDRV: File rules: Device[…]dnscli1.dll
HIDEDRV: File rules: Device[…]FsFlt.sys
HIDEDRV: Registry rules: REGISTRY[…]FsFlt
HIDEDRV: Registry rules: REGISTRY[…]FsFlt
HIDEDRV: Registry rules: REGISTRY[…]FsFlt
HIDEDRV: Inject dll: C:Windowssystem32mypathcomdnscli1.dll
HIDEDRV: Folder rules: DeviceHarddiskVolume1Windowssystem32mypathcom
HIDEDRV: <<<<<<<<XXXXX<<<<<<<< rules
HIDEDRV: <<<<<<<<Hide rules<<<<<<<< rules

201. Kernel Mode Rootkit (2)
How It Works
• Two implementations of the hiding ability:
– SSDT hooking
– Minifilter driver

202. Implementation Minifilter

203. Implementation Minifilter

204. Implementation Minifilter

205. Implementation Minifilter

206. Who Are You Rootkit?
• Never documented (to the best of our
knowledge)
• PDB paths:
d:!worketchiBinDebugwin7x86fsflt.pdb
d:!worketchideinstaller_kis2013BinDebugwin7x64fsflt.pdb
d:newhideinstallerBinDebugwxpx86fsflt.pdb

207. Who Are You Rootkit?
• Never documented (to the best of our
knowledge)
• PDB paths:
d:!worketchiBinDebugwin7x86fsflt.pdb
d:!worketchideinstaller_kis2013BinDebugwin7x64fsflt.pdb
d:newhideinstallerBinDebugwxpx86fsflt.pdb

208. Who Are You Rootkit?
• Never documented (to the best of our
knowledge)
• PDB paths:
d:!worketchiBinDebugwin7x86fsflt.pdb
d:!worketchideinstaller_kis2013BinDebugwin7x64fsflt.pdb
d:newhideinstallerBinDebugwxpx86fsflt.pdb

209. To Summarize
• Seven different samples (!) of DOWNDELPH over
the past three years
• One C&C server was up for two years
• Persistence methods:
– Bootkit able to infect from Windows XP to Windows 7
– Rootkit
• So, WHY such advanced persistence methods for
such a simple component?
• DOWNDELPH downloaded SEDRECO + XAGENT in
a few cases, so SEDNIT related for sure

210. SPECULATIVE MUMBLINGS
116

211. Call For Speculation
• The diversity of Sednit software is impressive
(DOWNDELPH, bootkit, XAGENT, SEDKIT…)
• Diversity is good for their operations, as it
makes detection and tracking harder
• How did they created this software
ecosystem?
117

212. Sednit Development Process (1)
Developers Role
• Binaries are often compiled specifically for a
target, after it has been infected
118
XAGENT SMTP logins/passwords

213. Sednit Development Process (1)
Developers Role
• Binaries are often compiled specifically for a
target, after it has been infected
• Main software evolve regularly (XTUNNEL,
SEDUPLOADER, XAGENT…)
118
XAGENT SMTP logins/passwords

214. Sednit Development Process (1)
Developers Role
• Binaries are often compiled specifically for a
target, after it has been infected
• Main software evolve regularly (XTUNNEL,
SEDUPLOADER, XAGENT…)
118
Developers are part of the team,
not outsiders paid for a one-time job
XAGENT SMTP logins/passwords

215. Sednit Development Process (2)
Software Design
• Different Sednit software share some
techniques:
– RC4 keys built as concatenation of a hardcoded
value and a randomly generated value
(XAGENT, DOWNDELPH, SEDUPLOADER)
– Hardcoded “tokens” in network messages
(XAGENT, SEDUPLOADER, SEDRECO)
119

216. Sednit Development Process (2)
Software Design
• Different Sednit software share some
techniques:
– RC4 keys built as concatenation of a hardcoded
value and a randomly generated value
(XAGENT, DOWNDELPH, SEDUPLOADER)
– Hardcoded “tokens” in network messages
(XAGENT, SEDUPLOADER, SEDRECO)
119
The same developers may be
behind this variety of software

217. Sednit Development Process (3)
Programming Errors
120
Linux XAGENT
Communications termination

218. Sednit Development Process (3)
Programming Errors
120
Linux XAGENT
Communications termination

219. Sednit Development Process (3)
Programming Errors
120
Linux XAGENT
Communications termination

220. Sednit Development Process (3)
Programming Errors
120
Linux XAGENT
Communications termination

221. Sednit Development Process (3)
Programming Errors
121
XTUNNEL report message

222. Sednit Development Process (3)
Programming Errors
121
XTUNNEL report message
Developers do not have a code
review process (“hackish” feeling)

223. Sednit Development Process (4)
Seeking Inspiration
• SEDUPLOADER employed novel persistence
methods also found in crimeware, and shares
code with Carberp
• DOWNDELPH bootkit code bears some
similarities with BlackEnergy code
122

224. Sednit Development Process (4)
Seeking Inspiration
• SEDUPLOADER employed novel persistence
methods also found in crimeware, and shares
code with Carberp
• DOWNDELPH bootkit code bears some
similarities with BlackEnergy code
122
Developers have ties with the
crimeware underground

225. Sednit Development Process (5)
Having Fun
123

226. Sednit Development Process (5)
Having Fun
123
Developers are not working in a
formal environment…

227. Mumblings Summary
Sednit has some in-house skilled developers,
working with little supervision, and those guys
have ties with crimeware underground
124

228. Conclusion
• Sednit activity increased a lot during the last
two years (targeted attacks with a LOT of
targets)
– Heard about the DNC hack last week?
• Sednit toolkit in constant evolution, moar fun
to come!
125

229. That’s All Folks!
• Feel free to poke us:
{calvet,campos,dupuy} .at. esetlabs.com
• Whitepaper coming soon!...
(“dans deux mois”)
126