APT15サイバー諜報活動：キャンペーンとTTP分析

Ruslan Mikhalov Chief of Threat Research at SOC Prime

Detection stack

AIDR
Alert
ETL
Query

脅威レポート
攻撃フロー
検出
シミュレーション

概要

APT15は、2010年から活動している中国の国家支援によるサイバー諜報グループで、主に政府機関や外交施設、軍事組織をターゲットとしています。このアクターは、標的型フィッシング、公開アプリケーションの悪用、カスタムバックドアに依存して初期アクセスを取得し、長期的な足場を維持しています。彼らのツールキットには、ステガノグラフィ、偽装、レジストリ操作、HTTPヘッダーやDNSトラフィックに埋め込まれた暗号化されたC2チャンネルが含まれています。このキャンペーンは、GraphicanやORB3リレーネットワークのような新しいツールとともに進化し続けています。

調査

調査では、BS2005、TidePool、MirageFox、Graphicanなどの複数のマルウェアファミリーと、初期アクセス、実行、持続性、特権昇格、防御回避、資格情報アクセス、発見、収集、データ流出、コマンド・アンド・コントロールにおよぶ包括的なATT&CK技術セットをマッピングしました。アナリストはケースデータからドメイン、ファイルパス、レジストリキー、コマンドラインなどの具体的な指標を抽出しました。グループのインフラは、 goback.stranged.net and finance.globaleducat.com のようなドメインをC2操作に活用しています。

緩和策

推奨される防御策には、メール添付ファイルの厳密なスキャン、Microsoft Exchange、SharePoint、VPNアプライアンスの迅速なパッチ適用、疑わしいレジストリの変更や異常なスケジュールタスク、rundll32やCOMベースのペイロード実行の監視が含まれます。ネットワーク監視は、既知のC2パターンに一致する非定型のHTTPクッキー活動とDNS TXTクエリに焦点を当てる必要があります。アプリケーションのホワイトリスト化と行動分析は、名前を変更した圧縮プログラムやステガノグラフィーに基づくPNGペイロードの使用をブロックするのに役立ちます。

対応

APT15の活動が検出された場合、影響を受けたホストを隔離し、揮発性データと関連するIOCアーティファクトをすべてキャプチャし、特定されたC2ドメインとIPアドレスをブロックします。持続性のあるショートカット、スケジュールされたタスク、レジストリの変更を特定するために完全なフォレンジック分析を行い、悪意のあるコンポーネントを排除し、侵害された資格情報をリセットします。影響を受けたユーザーに通知し、観察されたコマンドライン、ファイルパス、インフラ指標をカバーするように検出ルールを更新します。

“graph TB %% Class definitions classDef technique fill:#99ccff classDef operator fill:#ff9900 %% Node definitions node_initial[“技術 – T1566.001 スピアフィッシングメールの添付ファイル 説明: 初期アクセスを得るために、悪意のある添付ファイルを含む標的型メールを送信します。”] class node_initial technique node_valid[“技術 – T1078 有効なアカウント 説明: 攻撃された正当な資格情報を使用してシステムにアクセスします。”] class node_valid technique node_exploit[“技術 – T1190 公開されているアプリケーションの脆弱性の悪用 説明: インターネットに接続されたサービスの脆弱性を悪用してアクセスを得ます。”] class node_exploit technique node_cmd[“技術 – T1059.003 Windows コマンドシェル 説明: cmd.exe を介してコマンドを実行して悪意のあるコードを実行します。”] class node_cmd technique node_shortcut[“技術 – T1547.009 ショートカットの変更 説明: 持続性のために LNK ショートカットを作成または変更します。”] class node_shortcut technique node_task[“技術 – T1053 スケジュールされたタスク 説明: 定義された時間にペイロードを実行するためにスケジュールされたタスクを使用します。”] class node_task technique node_active[“技術 – T1547.014 アクティブセットアップ 説明: 持続性のためにアクティブセットアップのレジストリキーを利用します。”] class node_active technique node_token[“技術 – T1134.003 アクセストークンの操作 説明: アクセストークンを変更して高い権限を取得します。”] class node_token technique node_steg[“技術 – T1027.003 ステガノグラフィー 説明: 検出を回避するために他のファイル内にデータを隠します。”] class node_steg technique node_masq[“技術 – T1036 偽装 説明: 検出を回避するためにファイルの名前を変更したり、正当なものとして偽装します。”] class node_masq technique node_icon[“技術 – T1027.012 LNK アイコン密輸 説明: LNK アイコンリソースに悪意のあるコードを埋め込みます。”] class node_icon technique node_proxy[“技術 – T1218 システムバイナリプロキシ実行 説明: 信頼されたシステムバイナリを悪用して悪意のあるコードを実行します。”] class node_proxy technique node_guard[“技術 – T1480.001 実行ガードレール 説明: 実行前に環境条件を検証します。”] class node_guard technique node_sandbox[“技術 – T1497 サンドボックス回避 説明: 解析サンドボックス環境を検出して回避します。”] class node_sandbox technique node_keylog[“技術 – T1056.001 キーロガー 説明: 資格情報を取得するためにキーストロークをキャプチャします。”] class node_keylog technique node_dump[“技術 – T1003 OS 資格情報のダンプ 説明: オペレーティングシステムからパスワードハッシュを抽出します。”] class node_dump technique node_sysinfo[“技術 – T1082 システム情報の発見 説明: OS、ハードウェア、およびソフトウェアの詳細を収集します。”] class node_sysinfo technique node_inet[“技術 – T1016.001 インターネット接続の発見 説明: アクティブなネットワーク接続と IP アドレスを識別します。”] class node_inet technique node_stage[“技術 – T1074.001 データの準備 説明: 流出前にローカルでデータを蓄積します。”] class node_stage technique node_archive[“技術 – T1560.001 ユーティリティによるアーカイブ 説明: zip などのユーティリティを使用してデータを圧縮します。”] class node_archive technique node_email[“技術 – T1114.002 リモートメール収集 説明: メールアカウントにアクセスしてメッセージを収集します。”] class node_email technique node_http[“技術 – T1071.001 Web プロトコル HTTP 説明: コマンドとコントロールの通信に HTTP を使用します。”] class node_http technique node_obfusc[“技術 – T1001 データ隠蔽 説明: データの内容を隠すためにエンコードまたは暗号化します。”] class node_obfusc technique node_dead[“技術 – T1102.001 デッドドロップリゾルバー 説明: 隠された場所からコマンドまたはデータを取得します。”] class node_dead technique node_encrypt[“技術 – T1573.001 暗号化されたチャンネル 説明: 通信を隠蔽するために C2 トラフィックを暗号化します。”] class node_encrypt technique node_exfil[“技術 – T1048.003 暗号化されていない非 C2 プロトコルによるデータ流出 説明: 暗号化せず、C2 とは関係のないプロトコルを使用してデータを転送します。”] class node_exfil technique %% Connections node_initial u002du002d>|leads_to| node_valid node_initial u002du002d>|leads_to| node_exploit node_valid u002du002d>|leads_to| node_cmd node_cmd u002du002d>|enables| node_shortcut node_cmd u002du002d>|enables| node_task node_cmd u002du002d>|enables| node_active node_cmd u002du002d>|enables| node_token node_cmd u002du002d>|enables| node_steg node_cmd u002du002d>|enables| node_masq node_cmd u002du002d>|enables| node_icon node_cmd u002du002d>|enables| node_proxy node_cmd u002du002d>|enables| node_guard node_cmd u002du002d>|enables| node_sandbox node_cmd u002du002d>|enables| node_keylog node_cmd u002du002d>|enables| node_dump node_cmd u002du002d>|enables| node_sysinfo node_cmd u002du002d>|enables| node_inet node_sysinfo u002du002d>|feeds| node_stage node_inet u002du002d>|feeds| node_stage node_stage u002du002d>|includes| node_archive node_stage u002du002d>|includes| node_email node_archive u002du002d>|used_by| node_http node_email u002du002d>|used_by| node_http node_http u002du002d>|uses| node_obfusc node_http u002du002d>|uses| node_dead node_http u002du002d>|uses| node_encrypt node_http u002du002d>|exfiltrates_via| node_exfil “

攻撃フロー

準備: 攻撃者はすでにユーザーアカウントを侵害し、エンドポイントにアクセスしています。
データステージング (T1059.003): パターンと正確な xcopy に従い、攻撃者は犠牲者のデスクトップファイルを隠れたWMI一時フォルダにコピーし、合法的なシステム活動と統合するためにタイムスタンプを維持します（/D:09-29-2021）。
ペイロードの実行 (T1218.002): その後、攻撃者は rundll32.exe を短い名前のパスで呼び出し（C:DOCUME~1ALLUSE~1IEHelpermshtml.dll）、持続性を確立する悪質なJavaScriptを実行します。
結果: 両方のコマンドは、Sigmaルールの 選択1 and 選択2 にそれぞれ一致する独自のプロセス作成イベントを生成し、警告をトリガーします。

回帰テストスクリプト:

# -------------------------------------------------
# APT15シミュレーションスクリプト – Sigmaルールをトリガー
# -------------------------------------------------

# 1. ステージングディレクトリとダミーファイルを作成
$src = "C:usersREDACTEDDesktop"
$dst = "C:windowstempwmi"
New-Item -Path $src -ItemType Directory -Force | Out-Null
New-Item -Path $dst -ItemType Directory -Force | Out-Null
Set-Content -Path "$srcsecret.txt" -Value "敏感なデータ" -Encoding UTF8

# 2. APT15によって使用される正確なxcopyコマンドを実行
$xcopyCmd = "xcopy /D:09-29-2021 /S/Y/C c:usersREDACTEDDesktop c:windowstempwmi"
Invoke-Expression $xcopyCmd

# 3. 悪意のあるDLLをデプロイ（合法的なDLLをコピーしてシミュレート）
$malDllSrc = "$env:SystemRootSystem32mshtml.dll"
$malDllDst = "C:DOCUME~1ALLUSE~1IEHelpermshtml.dll"
New-Item -Path (Split-Path $malDllDst) -ItemType Directory -Force | Out-Null
Copy-Item -Path $malDllSrc -Destination $malDllDst -Force

# 4. 正確なAPT15引数パターンでrundll32を実行
$rundllCmd = "rundll32.exe C:DOCUME~1ALLUSE~1IEHelpermshtml.dll, IEHelper"
Invoke-Expression $rundllCmd

# -------------------------------------------------
# シミュレーションの終了
# -------------------------------------------------

クリーンアップコマンド:

# ステージングファイルとディレクトリを削除
Remove-Item -Path "C:usersREDACTEDDesktopsecret.txt" -Force -ErrorAction SilentlyContinue
Remove-Item -Path "C:windowstempwmi" -Recurse -Force -ErrorAction SilentlyContinue

# 偽のIEHelperフォルダーとDLLを削除
Remove-Item -Path "C:DOCUME~1ALLUSE~1IEHelper" -Recurse -Force -ErrorAction SilentlyContinue

# オプション: Sysmonを停止（テスト専用の場合）
# & "$env:ProgramFilesSysinternalsSysmon.exe" -u

SOCプライムのDetection as Codeプラットフォームに参加してください ビジネスに最も関連する脅威の可視性を向上させるために。開始をお手伝いし、即時の価値を提供するために、今すぐSOCプライムの専門家とミーティングを予約してください。

無料で参加

Name	Descripiton
PHPSESSID	Preserves user session state across page requests. Cookie generated by applications based on the PHP language. This is a general purpose identifier used to maintain user session variables. It is normally a random generated number, how it is used can be specific to the site, but a good example is maintaining a logged-in status for a user between pages.
sp_i	Used to store information about authenticated User.
sp_r	Used to store information about authenticated User.
sp_a	Used to store information about authenticated User.

Name	Descripiton
tuuid	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
tuuid_last_update	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
um	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
umeh	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
na_sc_x	Used by the social sharing platform AddThis to keep a record of parts of the site that has been visited in order to recommend other parts of the site.
APID	Collects anonymous data related to the user's visits to the website.
IDSYNC	Collects anonymous data related to the user's visits to the website.
_cc_aud	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
_cc_cc	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
_cc_dc	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
_cc_id	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
dpm	Via a unique ID that is used for semantic content analysis, the user's navigation on the website is registered and linked to offline data from surveys and similar registrations to display targeted ads.
acs	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded, with the purpose of displaying targeted ads.
clid	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded, with the purpose of displaying targeted ads.
KRTBCOOKIE_#	Registers a unique ID that identifies the user's device during return visits across websites that use the same ad network. The ID is used to allow targeted ads.
PUBMDCID	Registers a unique ID that identifies the user's device during return visits across websites that use the same ad network. The ID is used to allow targeted ads.
PugT	Registers a unique ID that identifies the user's device during return visits across websites that use the same ad network. The ID is used to allow targeted ads.
ssi	Registers a unique ID that identifies a returning user's device. The ID is used for targeted ads.
_tmid	Registers a unique ID that identifies the user's device upon return visits. The ID is used to target ads in video clips.
wam-sync	Used by the advertising platform Weborama to determine the visitor's interests based on pages visits, content clicked and other actions on the website.
wui	Used by the advertising platform Weborama to determine the visitor's interests based on pages visits, content clicked and other actions on the website.
AFFICHE_W	Used by the advertising platform Weborama to determine the visitor's interests based on pages visits, content clicked and other actions on the website.
B	Collects anonymous data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The registered data is used to categorise the users' interest and demographical profiles with the purpose of customising the website content depending on the visitor.
1P_JAR	These cookies are used to gather website statistics, and track conversion rates.
APISID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
HSID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
NID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
SAPISID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
SID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
SIDCC	Security cookie to protect users data from unauthorised access.
SSID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
__utmx	This cookie is associated with Google Website Optimizer, a tool designed to help site owners improve their wbesites. It is used to distinguish between two varaitions a webpage that might be shown to a visitor as part of an A/B split test. This helps site owners to detemine which version of a page performs better, and therefore helps to improve the website.
__utmxx	This cookie is associated with Google Website Optimizer, a tool designed to help site owners improve their wbesites. It is used to distinguish between two varaitions a webpage that might be shown to a visitor as part of an A/B split test. This helps site owners to detemine which version of a page performs better, and therefore helps to improve the website.

Name	Descripiton
_hjid	Hotjar cookie. This cookie is set when the customer first lands on a page with the Hotjar script. It is used to persist the random user ID, unique to that site on the browser. This ensures that behavior in subsequent visits to the same site will be attributed to the same user ID.
_hjIncludedInSample	This cookie is associated with web analytics functionality and services from Hot Jar, a Malta based company. It uniquely identifies a visitor during a single browser session and indicates they are included in an audience sample.
intercom-id-[xxx]	This cookie is used by Intercom as a session so that users can continue a chat as they move through the site.
intercom-session-[xxx]	Used to keeping track of sessions and remember logins and conversations.
demdex	Via a unique ID that is used for semantic content analysis, the user's navigation on the website is registered and linked to offline data from surveys and similar registrations to display targeted ads.
CookieConsent	Stores the user's cookie consent state for the current domain.
__cfduid	Used by the content network, Cloudflare, to identify trusted web traffic.
ss	These cookies enable the website to provide enhanced functionality and personalisation . They may be set by us or by third party providers whose services we have added to our pages. These services may include the Live Chat facility, Contact Us form(s), the Product Quotation forms and submission process, and the Email Newsletter sign up functionality .

Name	Descripiton
_ga	This cookie name is asssociated with Google Universal Analytics - which is a significant update to Google's more commonly used analytics service. This cookie is used to distinguish unique users by assigning a randomly generated number as a client identifier. It is included in each page. Registers a unique ID that is used to generate statistical data on how the visitor uses the website. request in a site and used to calculate visitor, session and campaign data for the sites analytics reports. By default it is set to expire after 2 years, although this is customisable by website owners.
_gat	Used by Google Analytics to throttle request rate. This cookie name is associated with Google Universal Analytics, according to documentation it is used to throttle the request rate - limiting the collection of data on high traffic sites. It expires after 10 minutes.
_gid	This cookie name is asssociated with Google Universal Analytics. This appears to be a new cookie and as of Spring 2017 no information is available from Google. It appears to store and update a unique value for each page visited. Registers a unique ID that is used to generate statistical data on how the visitor uses the website.
IDE	Used by Google DoubleClick to register and report the website user's actions after viewing or clicking one of the advertiser's ads with the purpose of measuring the efficacy of an ad and to present targeted ads to the user.
r/collect	Used by Google DoubleClick to register and report the website user's actions after viewing or clicking one of the advertiser's ads with the purpose of measuring the efficacy of an ad and to present targeted ads to the user.
test_cookie	Used to check if the user's browser supports cookies.
collect	Used to send data to Google Analytics about the visitor's device and behaviour. Tracks the visitor across devices and marketing channels.
ads/user-lists/#	These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites.
c	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
khaos	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
put_#	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
rpb	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
rpx	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
tap.php	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.