The Operation SignSight VGCA Supply Chain Attack

What happened

Attackers compromised the VGCA website, ca.gov.vn, and replaced two installers with versions that held a backdoor. ESET states that a man-in-the-middle attack is unlikely, because the downloads used HTTPS. The sources do not say how the attackers entered the site.

The modified installer ran the real installer and also dropped a malicious file. ESET describes the backdoor as PhantomNet, also called SManager. It posed as eToken.exe. The dropper wrote it to C:\Program Files\VGCA\Authentication\SAC\x32\eToken.exe. When run with administrator rights, a component went to C:\Windows\apppatch\netapi32.dll. For a normal user, it went to %TEMP%\Wmedia\<number>.tmp.

PhantomNet talks to its servers over HTTPS with certificate pinning. It supports commands for system reconnaissance, plugin management, proxy detection and lateral movement with an embedded Mimikatz. A plugin named SnowballS suggests a focus on Active Directory. ESET reports that most victims were in Vietnam, with a few in the Philippines. ESET notes that the clean VGCA installers are also signed incorrectly, so a signature check alone is not enough. The Vietnamese authority told ESET that it knew about the attack and notified users.

Vigilance compares the version you trust with the new one. A vendor installer that now drops a second program is the kind of change it reports. See the scan block below.

Affected versions

• gca01-client-v2-x32-8.3.msi and gca01-client-v2-x64-8.3.msi downloaded from ca.gov.vn from 23 July to 16 August 2020.

The sources name no other installers or versions.

Indicators of compromise

• Command servers: vgca.homeunix[.]org and office365.blogdns[.]com.
• SHA-1 of the x64 installer: 5C77A18880CF58DF9FBA102DD8267C3F369DF449.
• SHA-1 of the x32 installer: B0E4E9BB6EF8AA7A9FCB9C9E571D8162B1B2443A.
• SHA-1 of the dropper: 9522F369AC109B03E6C16511D49D1C5B42E12A44.
• SHA-1 of PhantomNet.B: 989334094EC5BA8E0E8F2238CDF34D5C57C283F2.
• SHA-1 of the PhantomNet.A plugin: 5DFC07BB6034B4FDA217D96441FB86F5D43B6C62.
• Paths: C:\Windows\apppatch\netapi32.dll, %TEMP%\Wmedia\*.tmp and C:\Program Files\VGCA\Authentication\SAC\x32\eToken.exe.

How to check

Hash the installer you kept, and search for the dropped files. Run this in PowerShell.

Get-FileHash -Algorithm SHA1 .\gca01-client-v2-x64-8.3.msi; Test-Path C:\Windows\apppatch\netapi32.dll; Get-ChildItem $env:TEMP\Wmedia -ErrorAction SilentlyContinue

Replace the file name if you kept the x32 installer. Compare the hash with the list above. Also search DNS and proxy logs for the two command domains.

What to do now

1. Find out who downloaded the two installers between 23 July and 16 August 2020.
2. If a machine ran one, isolate it and reinstall it. PhantomNet includes Mimikatz, so treat the credentials on that host as stolen.
3. Reset domain and local passwords that were used on the machine. Review Active Directory for unusual activity.
4. Block the two command domains.
5. Get the VGCA client only from the authority and ask the authority for the current hash.

What Vigilance showed

Vigilance compares the version you trust with the new one and names the file that gained a new capability. The block below is rebuilt from the public reports in the words Vigilance prints. It is not a captured scan, because the malicious release is not redistributed.

files scanned: 31 (1 Added)

HEADS UP  1 file can now do things the old version could not. The rest changed and gained nothing.

NEW FILE   eToken.exe
           It downloads from the internet.

Sources

1. welivesecurity.com/2020/12/17/operation-signsight-supply-chain-attack-southeast-asia/
2. thehackernews.com/2020/12/software-supply-chain-attack-hits.html