APT Chimera - Operation targets Semiconductor Vendors | AGENDA

This presentation provides an analysis of the advanced persistent threat (APT) attacks that have occurred during the past two years on the semiconductor industry. Our research shows that the majority of these attacks were concentrated on the Taiwan semiconductor sector. This is worthy of concern, as Taiwan's semiconductor industry plays a very crucial role in the world. Even a small disruption in the supply chain could have a serious ripple effect throughout the entire industry. Surprisingly, up until now, there has been less coverage on these attacks. In this presentation, we seek to shed light on the threat actors and campaigns of these attacks, where they are collectively referred to as Operation Chimera (a.k.a. Skeleton). Additionally, we provide a brief overview of the current information security status of Taiwan's semiconductor industry.

Between 2018 and 2019, we discovered several attacks on various semiconductor vendors located at the Hsinchu Science-based Industrial Park in Taiwan. As these attacks employed similar attack techniques and tactics, a pattern could be discerned from the malicious activities. From this pattern, we deduced that these attacks, which we dubbed Operation Chimera, were actually conducted by the same threat actor. The main objective of these attacks appeared to be stealing intelligence, specifically documents about IC chips, software development kits (SDKs), IC designs, the source code, etc. If such documents are successfully stolen, the impact can be devastating. The motive behind these attacks likely stems from competitors or even countries seeking to gain a competitive advantage over rivals. Since the similar techniques and tactics to previous attack activities, we suspect the attacker is China-based hacker group. We thus hope that this presentation will help semiconductor companies gain a better understanding of the dangers from such attacks. Additionally, as we have worked with several of the semiconductor vendors to improve their cyber security, we wish to share this valuable experience, and highlight the current challenges facing the entire industry.

In this presentation, we conduct a comprehensive analysis on the employed technologies, tactics, and customized malware of Operation Chimera. As this operation has not yet been documented, the techniques and tactics disclosed in this presentation can help blue teams design better defenses, and develop better detection and hunting methods. Below summarizes our findings of Operation Chimera.

A unique account manipulation malware - SkeletonKeyInjector – was used. SkeletonKeyInjector contained code extracted from Dumpert and Mimikatz. This malware implanted a skeleton key into domain controller (DC) servers to continuously conduct lateral movement (LM). Additionally, by making direct syscalls, the malware could bypass security products based on API hooking. This malware was discovered in the two cases mentioned in this presentation.
The threat actor utilized Cobalt Strike as their main remote-access Trojan (RAT). The mutated Cobalt Strike backdoor replaced and masqueraded as Google Update to confuse users. Additionally, as most corresponding (command and control) C2s were located in the Google Cloud Platform, it made it difficult to attribute the actor. Aside from the two cases mentioned in this presentation, we also detected the presence of this malware in other semiconductor vendors.
Chimera used an old and patched version of RAR for data exfiltration. The same binary was found in the two cases mentioned in this presentation.

Slido

陳仲寬

Bletchley 現為奧義智慧的資深研究員，負責協調資安研究團隊。他於國立交通大學網路安全實驗室取得博士學位。研究方向專注於網路攻防、惡意程式分析、漏洞分析與挖掘與自動化攻防。並利用機器學習等技術協助自動攻防系統之設計。他發表了多篇學術會議與期刊論文，並參與了許多大型資安研究計畫，主題包含：數位鑑識、事件處理及程式分析。在許多非學術技術會議，如：CodeBlue OpenTalk、HITB、FIRST(2020), HITCON 及 VXCON，亦積極參與並發表其研究。此外，他致力於資安教育，在交大創立交大網路安全策進會，鼓勵並培訓學生參與國際型 CTF 比賽。他為台灣資安社群相當活躍的成員，現為 Chroot 成員之一，並擔任 HITCON／荷蘭 HITB 資安會議的審查委員。

Inndy Lin

Inndy 是任職於奧義智慧科技的資訊安全研究員，專注於研究惡意程式、APT 攻擊以及 Windows 攻防。他喜愛鑽研逆向工程、Python以及分析惡意程式。曾經於 BlackHat、ROOTCON、SITCON 發表研究以及演講。

JohnThunder

姜尚德（John Jiang）奧義智慧研究員，他專注研究在 Incident Response 和 Endpoint Security 領域。