USB flows in the Great River: classic tradecraft is still alive

Thursday 5 October 15:00 - 15:30, Red room

Hiroshi Takeuchi (MACNICA)

Often, security countermeasures at overseas offices and affiliates are not as mature as those at the headquarters, due to cultural differences and lack of governance, and internet-facing devices deployed at overseas offices are the main attack surface now. While vulnerabilities of internet-facing devices, including zero-day attacks, are major attack vectors, there is another major attack vector in the APAC region. It's USB.

The USB device is a classic initial access technique, but it has been observed a lot recently in the APAC region, and is effective. There are several attack groups that use USB devices as an initial intrusion; in this presentation we will focus on the activities of TA410. One of the toolsets TA410 uses is FlowCloud. Since 2022, we have observed USB devices used to infect several Japanese organizations overseas branch offices with FlowCloud. We track the campaign as "Operation USBFlowing". We will first briefly review the attack activity using FlowCloud from 2019 and then discuss in detail the infection flow observed in "Operation USBFlowing". Existing research has detailed FlowCloud v4.1.3, v5.0.1 – v5.0.8. We will discuss v6.0.0, observed in March 2023, in detail.

The FlowCloud RAT component (fcClientDll) is statically linked with open-source libraries: boost C++, Protocol Buffers, ZThread, and has a large code size, making it challenging for analysts to identify malicious and benign code. We will share our approach using the IDA Pro FLIRT signature and BinDiff and its results. Based on the compiler used and the open-source version, we believe that FlowCloud is an older tool than we thought. We will profile the FlowCloud developer(s) and share our findings.

In this presentation, we will share new findings about TA410's evolving TTPs and discuss why old tradecraft remains effective, in addition to proposing countermeasures.

• Download slides for this talk

Hiroshi Takeuchi Hiroshi Takeuchi is an analyst and member of the Security Research Center at MACNICA. He has been working in the security domain for over 10 years. His main responsibilities are analysing malware, in particular that used in targeted attacks, and collecting threat intelligence. He has developed internal tools such as an intelligence platform, honey network, and python scripts to support analysis. He writes blog posts, publishes reports, and has spoken at a number of security conferences including Virus Bulletin, CONFidence, HITCON and JSAC to share his research. @8th_grey_owl

Back to VB2023 Programme page

Back to VB2023 conference page

Register for VB2023

Other VB2023 papers