Down the GRAYRABBIT hole – exposing UNC3569 and its modus operandi
No ratings
Presented at Virus Bulletin 2024 by
This presentation will offer insights and developmental history of the evolution of UNC3569, arguably one of the unconventional but most prolific and sophisticated PRC-nexus threat actors in the MSS ecosystem. Additional insight into similar threat actors that operate in the MSS ecosystem as front, or shell, companies serves to further expose the tools and techniques used, as well as potential connections to additional ongoing threat clusters that similarly operate as front companies, and effectively obfuscate networks that the threat actor operators likely use in various campaigns. The expanded yet centralized PRC cyber ecosystem is increasingly complex. In recent years, one of the most active threat actors in this ecosystem has been UNC3569. UNC3569 stands out as a significant element in China's cyber espionage operations. Current data evidences that UNC3569 has interest in a wide range of industries, and has targeted at least government agencies, education institutions, high-tech companies and the financial industry since 2021. Nevertheless, the actor also has an interest in the gaming industry, as evidenced by the language used on the fake warning pages hosted on its squatting websites. UNC3569 has a strong ability to take advantage of significant vulnerabilities to blend into its target servers. Historically, UNC3569 has leveraged a variety of vulnerability scanners to abuse exploits, including CVE-2021-34523, CVE-2021-34473, CVE-2021-31207, and CVE-2022-21587. To expand its operation, UNC3569 also has a mighty arsenal with a variety of customized malware, together with powerful legitimate tools, public hacking tools and a commercial hacking tool purchased from the dark market. The GRAYRABBIT backdoor is one of the most favoured tools of this actor. It is a lightweight and simple backdoor that supports simple file operation, system information collection, running modularized plugins and executing a remote command shell. UNC3569 also quickly developed customized components, such as RABBITCAVE, RABBITMOUND, RABBITWING and RABBITFUR, to deploy GRAYRABBIT in different environments. We also found a customized DLL loader, AtomLdr, abused as a GRAYRABBIT loader on a DRAFTGRAPH C2 Cloud server. At the start of 2024, UNC3569 set up a new fake FBI-looking domain with its new weapon KEYPLUG.LINUX backdoor – which has been observed frequently being used by APT41 in the past. UNC3569 maintains its operational efficiency primarily by optimizing its work efficiency. The actor has managed similar server configurations and abused serial IP addresses with squatting domains to build an expandable and convenient infrastructure to for its operations.