Cyritex Security Labs | The network weapon "Supper" used by the NSA to attack NWPU has been integrated into the simulated attack library!

Recently, Northwestern Polytechnical University (NWPU) suffered a cyberattack from abroad. During the investigation by the National Computer Virus Emergency Response Center, a cyber weapon dedicated to the US National Security Agency (NSA) named "Suctionchar" (named "Yincha" in Chinese) was discovered on the network server equipment of NWPU. The National Computer Virus Emergency Response Center conducted a technical analysis of the cyber weapon and released an analysis report. The results of the analysis indicate that the cyber weapon is a "sniffing and stealing weapon", mainly targeting Unix/Linux platforms, and its primary function is to steal remote access account credentials and passwords on target hosts.

According to the investigation, during the public cyberattacks against China's Northwestern Polytechnical University, the Tailored Access Operations (TAO) office, which belongs to the NSA, used 41 types of cyber weapons to steal core technical data such as configuration of critical network devices, network management data, and operation and maintenance data of the university. Through forensic analysis, the technical team has discovered more than 1,100 attack links penetrated by attackers within NWPU and over 90 command sequences operated, locating multiple stolen network device configuration files, sniffed network communication data and passwords, other types of logs and key files, and other major details related to the attack activities from the compromised network devices.

The investigation also revealed that the US National Security Agency has carried out tens of thousands of cyberattacks against China in recent years, controlling tens of thousands of network devices (network servers, internet terminals, network switches, telephone switches, routers, firewalls, etc.) and is suspected of stealing 140GB of valuable data.

Furthermore, according to previous reports, traces of "Suctionchar" have also been found in the networks of other institutions besides Northwestern Polytechnical University, implying that the NSA may have conducted large-scale cyberattacks against China.

Attack Scenario Flow Diagram

In TAO's cyberattacks on Chinese universities, "Suctionchar" was found to work in concert with other components of the Bvp47 Trojan. Bvp47 is a top-tier backdoor used by APT-C-40 (the US NSA Equation Group) for "Operation Telescreen". This backdoor is a highly sophisticated, encrypted backdoor for Linux platforms that uses advanced hidden channel behaviors based on SYN packets and requires an asymmetric encryption private key to activate its remote control functions. The backdoor also features its own code obfuscation, system hiding, self-destruction, and other designs.

▌Simulated Attack Library Update

You can now directly search for "suctionchar" / "Yincha" in our platform to get all related attack simulation experiments. This includes the execution of this ransomware and the network download of its variants to test the capability of your cybersecurity detection and defense measures, as well as endpoint/host defense measures, against this ransomware, its variants, and their behaviors. Currently, our attack library has collected up to 115 variants along with US NSA cyber weapons such as Bvp47 and extemeparr.