Operation Chimera - APT Operation Targets Semiconductor Vendors

The presentation discusses the KIMERA APT group and their targeting of semiconductor vendors in Taiwan. The speaker emphasizes the importance of threat hunting and resilience in IT systems.

• Taiwan's semiconductor industry is a critical part of the global supply chain and is frequently targeted by cyber attacks
• The KIMERA APT group has been active in targeting semiconductor vendors in Taiwan
• Threat hunting and resilience in IT systems are crucial for protecting against cyber attacks
• The speaker provides technical details on the KIMERA APT group's use of open source and general tools, as well as their use of a powerful skeleton key
• The speaker also mentions other incidents in Taiwan that may be related to KIMERA APT group's activities

In 2018, TSMC, one of the largest semiconductor enterprises in Taiwan and the world, was hit by a ransomware attack that cost them 170 million dollars and held down their production line for two days. This illustrates the serious impact that cyber attacks can have on the semiconductor industry and the economy as a whole.

This presentation provides an analysis of the advanced persistent threat (APT) attacks that have occurred during the past two years on the semiconductor industry. Our research shows that the majority of these attacks were concentrated on the Taiwan semiconductor sector. This is worthy of concern, as Taiwan's semiconductor industry plays a very crucial role in the world. Even a small disruption in the supply chain could have a serious ripple effect throughout the entire industry. Surprisingly, up until now, there has been less coverage on these attacks. In this presentation, we seek to shed light on the threat actors and campaigns of these attacks, where they are collectively referred to as Operation Chimera (a.k.a. Skeleton). Additionally, we provide a brief overview of the current information security status of Taiwan's semiconductor industry.Between 2018 and 2019, we discovered several attacks on various semiconductor vendors located at the Hsinchu Science-based Industrial Park in Taiwan. As these attacks employed similar attack techniques and tactics, a pattern could be discerned from the malicious activities. From this pattern, we deduced that these attacks, which we dubbed Operation Chimera, were actually conducted by the same threat actor. The main objective of these attacks appeared to be stealing intelligence, specifically documents about IC chips, software development kits (SDKs), IC designs, the source code, etc. If such documents are successfully stolen, the impact can be devastating. The motive behind these attacks likely stems from competitors or even countries seeking to gain a competitive advantage over rivals. Since the similar techniques and tactics to previous attack activities, we suspect the attacker is China-based hacker group. We thus hope that this presentation will help semiconductor companies gain a better understanding of the dangers from such attacks. Additionally, as we have worked with several of the semiconductor vendors to improve their cyber security, we wish to share this valuable experience, and highlight the current challenges facing the entire industry.In this presentation, we conduct a comprehensive analysis on the employed technologies, tactics, and customized malware of Operation Chimera. As this operation has not yet been documented, the techniques and tactics disclosed in this presentation can help blue teams design better defenses, and develop better detection and hunting methods. Below summarizes our findings of Operation Chimera.A unique account manipulation malware - SkeletonKeyInjector – was used. SkeletonKeyInjector contained code extracted from Dumpert and Mimikatz. This malware implanted a skeleton key into domain controller (DC) servers to continuously conduct lateral movement (LM). Additionally, by making direct syscalls, the malware could bypass security products based on API hooking. This malware was discovered in the two cases mentioned in this presentation.The threat actor utilized Cobalt Strike as their main remote-access Trojan (RAT). The mutated Cobalt Strike backdoor replaced and masqueraded as Google Update to confuse users. Additionally, as most corresponding (command and control) C2s were located in the Google Cloud Platform, it made it difficult to attribute the actor. Aside from the two cases mentioned in this presentation, we also detected the presence of this malware in other semiconductor vendors.Chimera used an old and patched version of RAR for data exfiltration. The same binary was found in the two cases mentioned in this presentation.