Mr. Wang trail deepens

More breadcrumbs..........

In summary, Zeng Xiaoyong, a well-known Chinese hacker using the handles ‘envymask’ and ‘EMM’ worked for RealSOI. RealSOI was closely associated with the MSS front companies identified in previous articles and Zeng knew Wang Qingwei, having worked as an InfoSec trainer with him. 

#youknowwherethisleads

Will the real Mr. Wang please stand up

I have started looking at this blog in the past few months, and am really enjoying it more and more these days.

In summary, Wang Qingwei, an IT security expert, advertised jobs at Jinan Fanglang using two online profiles and was also listed as the company’s official representative. He is directly linked to likely MSS Officer Guo Lin, travelling with him on multiple occasions.

#theyknowwherethisleads

https://www.nytimes.com/2019/05/06/us/politics/china-hacking-cyber.html
https://www.symantec.com/blogs/threat-intelligence/buckeye-windows-zero-day-exploit

Windows zero day was exploited by Buckeye alongside Equation Group tools during 2016 attacks. Exploit and tools continued to be used after Buckeye's apparent disappearance in 2017.

Key Findings

• The Buckeye attack group was using Equation Group tools to gain persistent access to target organizations at least a year prior to the Shadow Brokers leak.
• Variants of Equation Group tools used by Buckeye appear to be different from those
  released by Shadow Brokers, potentially indicating that they didn't originate from that leak.
• Buckeye's use of Equation Group tools also involved the exploit of a previously unknown Windows zero-day vulnerability. This zero day was reported by Symantec to Microsoft in September 2018 and patched in March 2019.
• While Buckeye appeared to cease operations in mid-2017, the Equation Group tools it used continued to be used in attacks until late 2018. It is unknown who continued to use the tools. They may have been passed to another group or Buckeye may have continued operating longer than supposed.