{"id":4409,"date":"2015-08-20T11:00:06","date_gmt":"2015-08-20T11:00:06","guid":{"rendered":"https:\/\/kasperskydaily.com\/b2b\/?p=4409"},"modified":"2020-12-11T18:26:10","modified_gmt":"2020-12-11T16:26:10","slug":"bluetermite-apt","status":"publish","type":"post","link":"https:\/\/www.kaspersky.co.za\/blog\/bluetermite-apt\/4409\/","title":{"rendered":"Japanese national threat cuisine: served individually, with zero-day flavor"},"content":{"rendered":"

These days, the propagation of zero-day exploits occurs almost literally at the \u00a0speed of light. As soon as such useful exploit makes it to the public, APT authors can begin adding them into their creations right away. \u00a0During a month when we have already written about the latest forays of Darkhotel<\/a> attackers, who adopted a zero-day from the Hacking Team\u2019s stolen materials, we now find this Adobe Flash vulnerability reaching the Land of the Rising Sun. On this occasion, APT actor BlueTermite decided to embed it into their toolset.<\/p>\n

From Italy to Japan with persistence<\/strong><\/p>\n

This attack itself is \u201cpersistent\u201d in more senses than one. It has been active since at least November 2013, and has an interesting peculiarity, in that, geographically, it strongly references Japan. Its victims, of which the Japanese Pension Service and Health Insurance Services are examples, are located only in this country, as are BlueTermite\u2019s own control servers.<\/p>\n

\"2\"<\/p>\n

A burst of activity in mid-summer of 2015, as shown on the above graph, is easy to explain. This is the point at which the APT received the new infection method. While prior to July 2015 BlueTermite used only spear-phishing to spread itself, this is the point at which drive-by infection was added. It\u2019s interesting to note that amongst the infected web-sites was the network resource of a Japanese government member. Such waterholing precisely targets the country\u2019s political circles.<\/p>\n

Japanese national threat cuisine: served individually, with zero-day flavor #APT<\/p>Tweet<\/a><\/blockquote>\n

One more interesting aspect of attacks is that, in order to decrypt code in the infected \u201cemdivi t20\u201d BlueTermite uses the decrypt key generated from a unique ID based on victim\u2019s hardware. Once again, the attack is \u201cpersistent\u201d on many fronts: besides sticking to its own country, its toolset clings to the infected system, forestalling any attempts at cloning or similar research methods. A more detailed description of BlueTermite can be found here<\/a>.<\/p>\n

Also, check out our new video with\u00a0Suguru Ishimaru,\u00a0Junior Security Researcher Kaspersky Lab Japan, who has authored\u00a0the linked above Securelist article,\u00a0reports on BlueTermite discovery:<\/p>\n