The big surprise came from the Check Point Research team who discovered that the China-linked APT31 group (aka Zirconium) used a clone of NSA Equation Group’s “EpMe” hacking tool for years.
The APT31’s tool, called Jian, was used by the Chinese hackers to make trouble before it was made available publicly by Shadow Brokers hackers. Back in 2017, the EpMe hacking tool was revealed in Shadow Brokers’ “Lost in Translation” leak.
First detected by Kaspersky in 2015, the NSA Equation Group’s tool was in the wild since at least 2001 and targeted victims with sophisticated zero-day malware.
The Chinese clone Jian appeared sometime around in 2014, Check Point argues in their report published on Monday. The researchers say Jian used the same Windows zero-day exploit that was stolen from the NSA Equation Group or cloned from it. The security firm doesn’t think the Chinese threat actors developed the hacking tool themselves. Check Point Research team states they have strong evidence that “Jian” was cloned from the actual Equation Group exploit.
“To our surprise, we found out that this APT31 exploit was, in fact, a reconstructed version of an Equation Group exploit, dubbed “EpMe”. This means that a Chinese-affiliated group used an Equation Group exploit possibly against American targets.”
Check Point discovered that the Jian tool was used during 2014-2017, that is before the vulnerability was addressed by Microsoft.
The experts speculate that APT31 group had obtained access to Equation Group’s hacking tool when it was deployed against the Chinese, and they got both 32- and 64-bit versions of the exploit.
An alternative version says that APT31 may have stolen the tool from Equation Group servers.
Check Point researchers concluded the following chain of events likely took place:
- Equation Group’s EpMe exploit existed since 2013 and attributed for the vulnerability CVE-2017-0005.
- In 2014, APT31 stole both 32- and 64-bit versions of the EpMe exploit
- The Chinese constructed “Jian”
- Lockheed Martin’s IRT discovered Jian and reported to Microsoft, the vulnerability was labeled CVE-2017-0005 in March 2017.
