Chinese Hackers Used NSA Hacking Tools Before Shadow Brokers Leaked Them

According to a new report^[3] published by
cybersecurity firm Symantec, a Chinese-linked group, which it calls
Buckeye, was using the NSA-linked hacking tools as far back
as March 2016, while the Shadow Brokers dumped some of the tools on
the Internet in April 2017.

Active since at least 2009, Buckeye—also known as APT3, Gothic
Panda, UPS Team, and TG-0110—is responsible for a large number of
espionage attacks, mainly against defence and critical
organizations in the United States.

Although Symantec did not explicitly name China in its report,
researchers with a high degree of confidence have previously
attributed [1,2] Buckeye hacking group to an information security
company, called Boyusec, who is working on behalf of the Chinese
Ministry of State Security.

Symantec’s latest discovery provides the first evidence that
Chinese state-sponsored hackers managed to acquire some of the
hacking tools, including EternalRomance^[4], EternalSynergy^[5], and DoublePulsar^[6], a year before being
dumped by the Shadow Brokers, a mysterious group that’s still
unidentified.

According to the researchers, the Buckeye group used its custom
exploit tool, dubbed Bemstour, to deliver a variant of
DoublePulsar backdoor implant to stealthily collect information and
run malicious code on the targeted computers.

Benstour tool was designed to exploit two then-zero-day
vulnerabilities (CVE-2019-0703 and CVE-2017-0143) in Windows to
achieve remote kernel code execution on targeted computers.

The previously unknown Windows SMB Server flaw (CVE-2019-0703)
was discovered and reported by Symantec to Microsoft in September
2018 and patched by the tech giant just last month.

Researchers detected BuckEye’s hackers using the combination of the
SMB exploit and the DoublePulsar backdoor to target
telecommunications companies, as well as scientific research and
education institutions in Hong Kong, Luxembourg, Belgium, the
Philippines, and Vietnam from March 2016 to August 2017.

How Chinese Hackers Grabbed NSA Hacking Tools?

While Symantec doesn’t know how the Chinese hackers got the
Equation Group tools before the Shadow Brokers leak, the security
firm does state there’s a possibility that Buckeye may have
captured the code from an NSA attack on their own computers and
then reverse-engineered the malware to develop its own version of
the tools.

Although it is unknown who continued to use the tools, the
researchers believe that the Buckeye group may have passed some of
its tools to another group or “continued operating longer than
supposed.”

After the Shadow Brokers leak, the NSA-linked exploit tools were
then used by North
Korean hackers^[8] and Russian
intelligence^[9], although the Symantec
report suggests no apparent connection between the Buckeye
acquisition of tools and the Shadow Brokers leak.

^[1][2][7]