Let's go door with KCP

Wednesday 4 October 14:00 - 14:30, Green room

Yoshihiro Ishikawa (LAC)
Takuma Matsumoto (LAC)

We observed the use of new APT malware by an unknown China-based APT actor during several incidents in Japan in 2022. We named the new malware "gokcpdoor" as it uses KCP protocol for backdoor communication and was coded in Golang on multiple platform operating systems. This backdoor has 20 commands and connects with C2 servers via KCP over UDP. During communication, the KCP message is encrypted in AES CFB mode.

KCP is a communication protocol that maximizes bandwidth for reliable, low-latency communication. The protocol was designed by “skywind3000”, and its source code is publicly available. It is commonly implemented in proxy software, streaming services and online games, and is used primarily in China.

Recently, it has been reported that China-based APT actors are using KCP protocol in malware such as Keyplug, Crosswalk, FunnySwitch, PseudoManuscrypt and Pangolin8RAT. However, there are few reports of this protocol being used in actual attack activity, and it is not in common use.

Therefore, we think that gokcpdoor is interesting in that it uses KCP protocol for C2 communication.

In this presentation, we will analyse gokcpdoor (PE and ELF) and then propose a method to detect and respond to its activity for future prevention.

Further, we will demonstrate gokcpdoor’s operation to the audience. We have created an emulation of the gokcpdoor malware controller, which was created from the reversed engineering of the malware's communication KCP protocol. Additionally, we have attributed the APT actor from some incident response cases, and we will introduce our findings.

• Download slides for this talk
• Download paper for this talk

Yoshihiro Ishikawa Yoshihiro Ishikawa is a member of the Cyber Emergency Center of LAC. He is engaged in malware analysis and cyber threat intelligence, in particular focusing on advanced persistent threat (APT) attacks. Based on the results of research, he has delivered presentations at several security conferences such as AVAR, Botconf, HITCON, VB and FIRST Annual Conference.

Takuma Matsumoto Takuma Matsumoto is an analyst at LAC, analysing malware and collecting threat intelligence. He has more than seven years of experience in the security domain. Prior to working as a malware analyst, he was involved in monitoring SIEM, creating detection rules, and developing log analysis support systems. He enjoys analysing malware and writing tools for research, which let him to his current job. He has been a speaker at Japan Security Analyst Conference 2021 and VB2022.

Back to VB2023 Programme page

Back to VB2023 conference page

Register for VB2023

Other VB2023 papers