{"id":839,"date":"2020-05-14T19:00:02","date_gmt":"2020-05-14T17:00:02","guid":{"rendered":"https:\/\/lab52.io\/blog\/?p=839"},"modified":"2020-05-14T19:00:04","modified_gmt":"2020-05-14T17:00:04","slug":"the-energy-reserves-in-the-eastern-mediterranean-sea-and-a-malicious-campaign-of-apt10-against-turkey","status":"publish","type":"post","link":"https:\/\/lab52.io\/blog\/the-energy-reserves-in-the-eastern-mediterranean-sea-and-a-malicious-campaign-of-apt10-against-turkey\/","title":{"rendered":"The energy reserves in the Eastern Mediterranean Sea and a malicious campaign of APT10 against Turkey"},"content":{"rendered":"\n

Energy reserves in the\nEastern Mediterranean Sea and the \u201cMEDEAST\u201d gas pipeline:<\/p>\n\n\n\n

The Mediterranean Sea\nhas become an increasingly relevant geostrategic topic for the Ministries of\nForeign Affairs of Turkey, Greece, Cyprus, Israel and even China due to the\ncontroversies generated during the last decade for the discoveries of natural\ngas resources located in the Eastern Mediterranean seas of States such Israel,\nCyprus and Egypt ([1]).<\/p>\n\n\n\n

The presence of\nTurkish troops in Libya and Syria, and the Franco-Greek alliance to avoid\nTurkish intrusions in the maritime territory of Greece show the relevance and\nglobal interest in energy resources in the area.<\/p>\n\n\n\n

As it could be seen in\nthe following map, part of the geostrategic conflict is focused on the Turkish\nEEZ. Turkey carried out an agreement with Libya which tries to carry out an\nexpansion of its exclusive maritime economic zones ([2]).<\/p>\n\n\n\n

It is relevant to clarify that an EEZ is a maritime zone prescribed by the United Nations Convention on the law of the sea over which a state has special rights regarding the exploration and exploitation of sea resources, including the production of energy through the water and wind ([3]) ([17]):<\/p>\n\n\n\n

\"\"
Illustration 1. Expansion of Turkish EEZ<\/em>
<\/figcaption><\/figure><\/div>\n\n\n\n

The expansion that the Turkish government tries to carry out could increase the geopolitical risk among Cypriots, Greeks and even Israeli governments. The military presence in the area by those States could be seen in the map shown above. The strategy of increasing Turkey’s EEZ would leave without an important part of the continental shelf Athens ([4]). In addition, Cyprus is significantly affected by this EEZ\u2019s expansion as there is an occupation of the Cyprus\u2019 EEZ area. Furthermore, the President Erdogan has publicly declared that his oil exploration projects in the coast of Cyprus will not cease. Turkey tries to stablish a zone of EEZ controlled by the Turkish influence which would be represented as in the following map ([5]): <\/p>\n\n\n\n

\"\"
Illustration 2. Expansion of the Turkish EEZ and location of energy resources<\/em>
<\/figcaption><\/figure><\/div>\n\n\n\n

In the previous map,\nyou can see which energy exploration areas are located in Israel, Cyprus and\nEgypt. Moreover, these States give diplomatic support to Cyprus and Greece regarding\nthe expansion\u2019s conflict of the Turkish EEZ.<\/p>\n\n\n\n

Furthermore, the 27th<\/sup> of February of 2020, Greece, Cyprus and Israel signed an agreement to build up a gas pipeline to transport gas to Europe from the Leviathan gas reserves located in Israel. Moreover, in the near future there is the intention of joining to the pipeline the extractions from the Cypriot gas reserves, Aphrodite and Calypso ([6]).<\/p>\n\n\n\n

\"\"
Illustration 3. Mediterranean Gas Pipeline<\/em>
<\/figcaption><\/figure><\/div>\n\n\n\n

Turkey has displaced\nseveral warships to the coast of Cyprus in order to carry out gas exploration\nprojects. The Eastern European gas pipeline reduces the geopolitical power of\nTurkey as it tries to exclude Turkey from any participation in it. This\n“pipeline” has been called “EastMed” ([6]). However, during March, Turkey will put an\noffshore drilling vessel in order to continue with its oil exploration projects\nin the EEZ waters of Greece, Cyprus and the EU in order to try to acquire in\nthe future the role of gas supplier for the EU ([8]).<\/p>\n\n\n\n

Interests and\ninfluence of China in the Mediterranean area:<\/p>\n\n\n\n

China, unlike the US\ndiplomatic-military expansionism, has focused its expansionist strategy on the\ndiplomatic-commercial strategy. For China, one of its geo-strategically key\nregions, has been the Port of Piraeus of Greece. The Greek government tendered\nfor the next 35 years the 67% of the Port’s operations to COSCO (China Ocean\nShipping Company) for 368.5 million and 350\nmillion of euros to be invested in the Piraeus\u2019 port infrastructure ([9]).<\/p>\n\n\n\n

The Port of Piraeus\nrepresents a potential gate of all the commercial flow that comes from the OBOR\nsea route. In addition, during November of 2019, China and Greece signed up 16\ncooperation agreements of different matters, including trade and energy\ninvestments ([10]).<\/p>\n\n\n\n

On the other hand,\nCyprus signed an agreement with a consortium led by China to build up the first\nnatural gas import terminal in Cyprus. The terminal is designed to convert\nimported liquefied gas into a gaseous form to be used in energy plants ([11]). The construction is being developed by China\nPetroleum Pipeline Engineering, Metron, Hudong-Zhngua Shipbuilding and\nWilhelmsen Ship Management. Construction is expected to be done in 2022.<\/p>\n\n\n\n

Regarding the\ninternational security, China investigates Turkey’s relation with the Uighur\ncommunity. The Uyghurs are Turkish-speaking people from the interior of Asia\nand mostly of them have Muslim religious confession. The Uyghurs live in\nnorthwestern China, in the Uyghur autonomous region of Xinjiang and are\nconsidered a threat to the People’s Republic of China as they are considered\nlargely jihadist terrorists ([12]).<\/p>\n\n\n\n

Turkey is the country\nthat has given the most international support to the Uyghur community. Currently,\nup to 45,000 Uyghur refugees live in Turkey on a temporary visa or even with a\npermanent residence permit ([13]). <\/p>\n\n\n\n

Turkey’s foreign\naffairs policies are misaligned from those of China.  The possible obstruction of the OBOR route to\nthe Port of Piraeus and the collaborative policies with the Uyghur community in\nthe Xinjiang region of China could damage their diplomatic relations.<\/p>\n\n\n\n

Due to the diplomatic confrontations and conflicting interests of the two countries, China could carry out cyber espionage operations against Turkish organizations and institutions linked to diplomacy, defense, energy, telecommunications and foreign trade. Its main objective could be to collect confidential information in order to gain advantages within the future geostrategic movements of Turkey and the rest of the actors involved in the conflicts over the energy resources located in the Mediterranean Sea.<\/p>\n\n\n\n

Malicious campaign against Turkish organizations:<\/p>\n\n\n\n

A malicious campaign allegedly attributed to APT10 against Turkish organizations from various sectors such as telecommunications and finance has been identified by Adeo in January of 2020 ([14]). APT10 is a group presumably attributed to the Ministry of State Security of China ([15]). In addition, it is a group that usually targets organizations from various sectors such as defense, energy, health, telecommunications, governments, military, shipping and IT ([16]).<\/p>\n\n\n\n

It has been identified that APT10 usually carries out malicious campaigns\nagainst organizations that could damage the China’s State interests into the global\nmarket. On the other hand, it has also been detected that APT10 usually carries\nout malicious campaigns against organizations that support foundations which carry\nout aid projects with ethnic groups that may be a potential threat against the\nChinese national security, as the case of the Uyghur community.<\/p>\n\n\n\n

Moreover, in this campaign has been identified several similarities with\nthe TTP published in other APT10 reports in 2019 ([14]). In this case, it was identified that this campaign began in 2016 and\nthe initial access was carried out with the exploitation of a public web application.<\/p>\n\n\n\n

Summary of the\nexecuted Kill Chain ([14]):<\/p>\n\n\n\n

\u2022 Initial access:<\/p>\n\n\n\n

The attackers deployed the following China Chopper4, JspSpy5 webshells\nto obtain a foothold on the victim’s network that they used to execute commands\nto upload files to the target machines.<\/p>\n\n\n\n

\u2022 Reconnaissance, execution and theft of credentials:<\/p>\n\n\n\n

In the reconnaissance phase, a series of commands were launched to\ncollect information from users, domains and shared folders. The hostile actor\nused legitimate tools of the Windows operating systems for the reconnaissance stage,\nsuch as “ipconfig.exe”, “whoami.exe”, “net.exe”,\n“ping.exe”, “powershell.exe” and ” BloodHound\n\u201d(bloodHound is not a legitimate binary from Microsoft). The attacker used an\nadvanced tool called “dns.exe” to list all the machines that were\nregistered in a particular domain.<\/p>\n\n\n\n

Regarding the execution, the hostile actor implemented \u201chTran\u201d backdoor to\nbe able to exfiltrate information. In previous malicious APT10 campaigns against\nTurkey, this executable file was seen with the name “java.exe” on\ncompromised hosts.<\/p>\n\n\n\n

Hostile actors loaded a malicious DLL into the memory of a legitimate\nbinary. The final payload is injected into the legitimate process “svchost.exe”.\nIt was identified that this payload was a PlugX variant or a CobaltStrike\nBeacon as a post-exploitation framework.<\/p>\n\n\n\n

To carry out the theft of credentials the hostile actor used the\nfollowing tools: “QuarksPWdump” and “Mimikatz”.<\/p>\n\n\n\n

\u2022 Lateral movements<\/p>\n\n\n\n

Through the lateral movements they were able to compromise critical\nservers and gain access as a domain administrator. The group used NTLM hashes\nto move laterally. They used the tools “net.exe”,\n“wmic.exe”, “psexec.exe”, “smbexec”, and \u201cwmiexec”.<\/p>\n\n\n\n

\u2022 Persistence<\/p>\n\n\n\n

The advanced group established persistence in certain servers that were\nof their interest and deployed a remote access Trojans such as\n“QuasarRAT” and “PlugX”, moreover penetration or\n“pentesting” tools such as “Cobalt Strike” and “kerberos”.<\/p>\n\n\n\n

\u2022 C&C connections<\/p>\n\n\n\n

Hostile actors used two different ways to keep connections with C&C servers. Once the vulnerability was exploited to establish itself on the public server, the group moved to the “terminal server”. To establish communications with the other hosts in the internal network, they installed an SMB beacon on the \u201cterminal server\u201d, using it as a bridge between the internal network and the C&C server.<\/p>\n\n\n\n

\"\"
Illustration 4. First C&C communication method<\/em> <\/figcaption><\/figure><\/div>\n\n\n\n

However, the group established a different method for hosts that had direct access or had a proxy. In this case they used the http protocol to establish the communications with the C&C.<\/p>\n\n\n\n

\"\"
Illustration 5. Second C&C communication method<\/em> <\/figcaption><\/figure><\/div>\n\n\n\n

In the following chart, there are the TTPs developed by APT10 during this malicious campaign against the Turkish organizations ([16]) ([14]):<\/p>\n\n\n\n

\"\"
Illustration 6. TTP used in the APT10 campaign<\/em> <\/figcaption><\/figure><\/div>\n\n\n\n

Recommendations:<\/p>\n\n\n\n

It is recommendable that the organizations from the defense sector,\ngovernments, energy, telecommunications and finance linked to projects that may\naffect the interests of China apply the maximum prevention to this increase of\nmalicious campaigns from APT groups presumably linked to China.<\/p>\n\n\n\n

It is recommended to apply the IOC of the APT identified as a threat by\ntheir intelligence provider LAB52 as soon as possible.<\/p>\n\n\n\n

It is recommended to keep the operating systems, services and tools used\nin the organization updated with the latest security patches.<\/p>\n\n\n\n

It is recommended to establish security policies (GPOs) to control accesses and actions carried out in those systems and \/ or services that are exposed to the internet.<\/p>\n\n\n\n

<\/p>\n\n\n\n

Conclusions:<\/p>\n\n\n\n

Since the last decade, Turkey has acquired an important influence in the energy geopolitics of the Eastern Mediterranean Sea. The Turkish foreign policies has hindered the China’s international trade strategies. Furthermore, the diplomatic Turkish support to certain Chinese ethnic groups that are considerate as a threat against the Chinese national security, could provoke that Turkey becomes a target of groups like APT10 which presumably are linked to the Ministry of State Security of China. APT10 is a group that has a wide range of targets. The organizations from sectors of interest for the government of China and the organizations that have some kind of link with the commercial development of the OBOR route could be susceptible to being targeted by groups such as APT10. <\/p>\n\n\n\n

References:<\/p>\n\n\n\n

[1] https:\/\/www.mei.edu\/publications\/turkeys-eastern-mediterranean-quagmire<\/a><\/p>\n\n\n\n

[2] https:\/\/www.petroleum-economist.com\/<\/a><\/p>\n\n\n\n

[3] https:\/\/greece.greekreporter.com\/2018\/10\/12\/greece-egypt-aim-to-strangulate-turkey-in-east-med-turkish-daily-claims\/<\/a><\/p>\n\n\n\n

[4] https:\/\/moderndiplomacy.eu\/2019\/12\/20\/the-exclusive-economic-zone-between-libya-and-turkey\/<\/a><\/p>\n\n\n\n

[5] https:\/\/www.ozelburoistihbarat.com\/kitalar-bolgeler-akdeniz-karadeniz-ege-marmara\/dogu-akdenizde-tartisma-harita-uydu-goruntuleri-eren-talha-altun-12708<\/a><\/p>\n\n\n\n

[6] Kontakos P. (2018) Blue economy\nenterpreneurship in Offshore Energy in Cyprus and Greece. Journal of\nInternational Scientific Publications<\/p>\n\n\n\n

[7] https:\/\/www.welt.de\/wirtschaft\/article204725766\/EastMed-Das-ist-Europas-neue-Problem-Pipeline.html<\/a><\/p>\n\n\n\n

[8] https:\/\/www.turkishminute.com\/2020\/02\/19\/turkey-buys-third-drilling-ship-for-mediterranean-gas-exploration-erdogan\/<\/a><\/p>\n\n\n\n

[9]https:\/\/www.cidob.org\/en\/publications\/publication_series\/notes_internacionals\/n1_156\/china_moors_in_the_mediterranean_a_sea_of_opportunities_for_europe<\/a><\/p>\n\n\n\n

[10] https:\/\/www.aljazeera.com\/news\/2019\/11\/greece-china-hail-strategic-partnership-eu-191111170150762.html<\/a><\/p>\n\n\n\n

[11] http:\/\/www.ekathimerini.com\/247559\/article\/ekathimerini\/news\/chinese-led-consortium-to-build-cyprus-gas-import-terminal<\/a><\/p>\n\n\n\n

[12] https:\/\/www.icij.org\/investigations\/china-cables\/china-cables-who-are-the-uighurs-and-why-mass-detention\/<\/a><\/p>\n\n\n\n

[13] https:\/\/www.voanews.com\/extremism-watch\/uighurs-concerned-china-luring-turkey-silence-xinjiang<\/a><\/p>\n\n\n\n

[14] Adeo IT Consulting\nServices. January 2020. APT10 Threat Analysis Report. https:\/\/adeo.com.tr\/en\/adeo_annual_threat_report\/<\/a> <\/p>\n\n\n\n

[15] https:\/\/www.justice.gov\/opa\/pr\/two-chinese-hackers-associated-ministry-state-security-charged-global-computer-intrusion<\/a><\/p>\n\n\n\n

[16] https:\/\/attack.mitre.org\/<\/a>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 <\/p>\n\n\n\n

[17] https:\/\/www.un.org\/depts\/los\/convention_agreements\/texts\/unclos\/part5.htm<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Energy reserves in the Eastern Mediterranean Sea and the \u201cMEDEAST\u201d gas pipeline: The Mediterranean Sea has become an increasingly relevant geostrategic topic for the Ministries of Foreign Affairs of Turkey, Greece, Cyprus, Israel and even China due to the controversies generated during the last decade for the discoveries of natural gas resources located in the […]<\/p>\n","protected":false},"author":6,"featured_media":847,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[1],"tags":[4,23,6,24],"class_list":{"0":"post-839","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-uncategorised","8":"tag-apt","9":"tag-apt10","10":"tag-cyberthreat","11":"tag-energy","12":"entry"},"featured_image_src":"https:\/\/lab52.io\/blog\/wp-content\/uploads\/2020\/05\/Post-de-turquia-600x400.jpg","featured_image_src_square":"https:\/\/lab52.io\/blog\/wp-content\/uploads\/2020\/05\/Post-de-turquia-600x600.jpg","author_info":{"display_name":"Dex","author_link":"https:\/\/lab52.io\/blog\/author\/dex\/"},"_links":{"self":[{"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/posts\/839"}],"collection":[{"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/comments?post=839"}],"version-history":[{"count":5,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/posts\/839\/revisions"}],"predecessor-version":[{"id":851,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/posts\/839\/revisions\/851"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/media\/847"}],"wp:attachment":[{"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/media?parent=839"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/categories?post=839"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lab52.io\/blog\/wp-json\/wp\/v2\/tags?post=839"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}