A cyber espionage group linked to China has been spotted targeting government organisations in Taiwan using an Internet Explorer vulnerability patched by Microsoft earlier this year.
Researchers have been monitoring a campaign they’ve dubbed “CNACOM,” in which attackers have used compromised websites to deliver a piece of malware. One of the compromised sites, known as a watering hole, belonged to a major public service organisation in Taiwan.
When users accessed this website’s registration page, an iframe injected into the footer loaded an exploit landing page. The Internet Explorer vulnerability leveraged by this exploit, tracked as CVE-2016-0189, was fixed by Microsoft in May, but it had been seen in targeted attacks against users in South Korea before a patch was made available.
A few weeks after Microsoft resolved the flaw, researchers published a proof-of-concept (PoC) exploit. The PoC code was used by cybercriminals to integrate the security hole into several exploit kits.
The same PoC code has been used in the CNACOM campaign, but the payload has been invoked through an Internet Explorer sandbox escape flaw tracked as CVE-2015-0016.
In the CNACOM attacks, the exploit code collects information from the device, including its IP address. If the victim uses Internet Explorer and the IP address is known to belong to the Taiwanese government, the exploit delivers a variant of the malware dubbed Ixeshe.
Ixeshe has been around since at least 2009 and it has been observed in attacks aimed at East Asian governments and electronics manufacturers, including in Taiwan. The malware was also linked to the attacks launched in 2012 against The New York Times.
The group behind Ixeshe, also known as APT12, Numbered Panda and DynCalc, is believed to be operating out of China.
According to Zscaler, the Ixeshe variant spotted in the recent Taiwan attacks is different from older versions as the campaign codes it uses are embedded into the malware, which could indicate that the threat relies on a more centralised tracking system.
Zscaler is not the only security firm to monitor China-linked attacks aimed at Taiwan’s government. Palo Alto Networks and FireEye also reported seeing such attacks in the past few months.
