Mysterious group of hackers spy on corporate email and FTP traffic

Since at least early December 2019, a mysterious group of hackers have taken over DrayTek corporate routers to listen to FTP and e-mail traffic inside corporate networks, the Chinese security company Qihoo announced today 360.

In one report Posted on the blog of its network security division Netlab, Qihoo said that its researchers had detected two different threat actors, each exploiting a different zero-day vulnerability in DrayTek Vigor – load balancing routers and VPN gateways generally deployed on corporate networks.

Attack Group A – Theft of FTP and Mail Traffic

Of the two hacker groups, the first – identified only as “Attack Group A” – appears to be by far the more sophisticated of the two.

According to Qihoo, the group appeared on their radar on December 4 of last year, when they detected a fairly complex attack on DrayTek devices.

Qihoo says that attack group A has abused a vulnerability in the RSA encrypted connection mechanism of DrayTek devices to hide malicious code in the login field of the router’s username.

When a DrayTek router received and then decrypted the RSA boobytrapped encrypted connection data, it executed malicious code and granted hackers control of the router.

But that’s where things got weird. Instead of abusing the device to launch DDoS attacks or redirect traffic through a proxy network, the hackers turned into a spy box.

Researchers say hackers deployed a script that recorded traffic from port 21 (FTP – file transfer), port 25 (SMTP – email), port 110 (POP3 – email) and port 143 (IMAP – email).

Then, every Monday, Wednesday and Friday at 0:00 a.m., the script would download all the traffic recorded on a remote server.

Qihoo researchers did not speculate as to why the hackers were collecting FTP and email traffic. But speaking to ZDNet by phone, a security researcher pointed out that it looked like a conventional reconnaissance operation.

“The four protocols are in clear text. Obviously they log traffic to collect connection information for FTP and email accounts,” the researcher told ZDNet. “These cases fly unencrypted on the network. These are easy choices.”

*** The researcher did not want his name to be shared for this article because he was not allowed to speak to the press without the approval of his employer’s public relations department.

In addition, ZDNet also understands from another industry source that the group’s hacking campaign has not gone unnoticed and has been kept under observation by other cybersecurity companies. However, attack group A does not share any server infrastructure or malware samples with any other known hacking group – so this is a new group at this time.

Attack Group B – creation of backdoor accounts

But the DrayTek devices were also abused by a second group, which Qihoo called “Attack Group B”.

This group used a different zero day, but the hackers did not discover it themselves. Instead, day zero was first described in a January 26 article on the Skull Army blog, and hackers started exploiting it two days later.

According to Qihoo, hackers used this second zero day to run code on vulnerable DrayTek devices by exploiting a bug in the “rtick” process to create backdoor accounts on hacked routers. What they did with these accounts remains unknown.

Patches released in February

Qihoo said its researchers informed DrayTek of the two zero days once they detected attacks; however, their first alert was sent via an incorrect channel and was never seen by DrayTek staff.

The seller finally learned the two zero days after the attacks on Group B in January and firmware fixes released February 10. DrayTek even went out of its way to release a firmware fix for a now discontinued router model.

Qihoo says attacks have been seen against DrayTek Vigor 2960, 3900, and 300B.

Using the BinaryEdge search engine, ZDNet was able to find more than 978,000 DrayTek Vigor devices on the Internet, although Qihoo reports that only about 100,000 of them are running a firmware version vulnerable to attack.