y5qa5B

ASERT Threat Intelligence Report 2016-03: The Four-Element Sword Engagement
Conclusion
Threat actors using similar exploit code are launching or continuing a variety of campaigns (termed as an
“engagement” herein, where an engagement is an offensive action within a larger campaign context) aimed at
targets such as the Tibetan community, Hong Kong and Taiwanese media, and Asian human rights workers.
Due to the easy delivery of RTF files as attachments and the observation of numerous spear phish samples
which reveal precise targeting and timelines, it is likely that spearphish was the primary vector of choice for
most or all of the targeted exploitation scenarios profiled herein. The RTF files observed herein contained up
to four unique exploits for various versions of Office. It is hypothesized that a similar builder kit – which we’ve
named the Four Element Sword Builder -­‐ is involved in the creation of these malicious documents, however
future work is required to precisely classify the Four Element Sword builder with respect to crimeware and
APT activity. In the case of the APT oriented threat scenarios profiled herein, anywhere from 2-­‐4 of the
exploits were typically observed. In the case of the cybercrime activities that will be profiled in a separate
forthcoming document, 2-­‐3 of these exploits were typically observed.
All of the exploit code observed deals with older vulnerabilities that have been patched. However, considering
the target populations at hand, it is possible that older systems may still be in use. Once APT actors gain a
toehold inside an organization, past history shows that it’s just a matter of time before lateral movement and
further exploitation scenarios will unfold to implement the actors actions on objectives. In the case of the
Tibetan community, which has been under attack for years, there have been awareness campaigns designed
to reduce risk by implementing special controls and procedures around dealing with attachments. Recently
published documents by other security research organizations have revealed that actors have evolved to
newer methods in their ongoing efforts to stay beneath the radar.
Regardless of the delivery method, the malware profiled herein are active threats likely deployed in numerous
other scenarios by this, or by other groups of actors. While older exploit code may be a threat to some
populations and not to others, the weaponization of other vulnerabilities is likely taking place and such
malware can easily become a payload in such a case, making all analytic and detective insight of the malicious
code of relevance for defenders in the global defensive sphere.
46 Proprietary and Confidential Information of Arbor Networks, Inc.