Chinese Group Built Advanced Trojan by Reverse Engineering NSA Attack Tool

APT3 quietly monitored an NSA attack on its systems and used the information to build a weapon of its own.

Chinese threat actor APT3 quietly monitored the US National Security Agencys use of a highly sophisticated cyber attack tool and then reverse engineered the code to build an advanced Trojan of its own called Bemstour.
That conclusion, by Check Point Software, is based on the security vendors analysis of Bemstour after Symantec in May reported on APT3 using it in attacks on targets in multiple countries, including Belgium, Hong Kong and the Philippines.
Symantec had described APT3 as using Bemstour to deliver a variant of a backdoor called DoublePulsar on target systems. Symantec said its analysis showed both tools appeared to be variants of attack software built by Equation Group, an operation affiliated with the NSAs Tailored Access Operations unit.
Symantec said it was unclear how APT3 had obtained the NSA tools. But it ruled out the possibility that the Chinese threat actor had obtained the weapons from the large trove of NSA cyber weapons that hacking outfit Shadow Brokers publicly leaked in 2017.
According to
Symantec,
its analysis showed that APT3 was using Bemstour and DoublePulsar well before the Shadow Brokers data dump. The two variants also had differences in code that made it very clear they did not originate from the leak, Symantec had noted.
Check Points analysis of Bemstour shows that the exploit is in fact APT3s own implementation of EternalRomance, a tool that the NSA developed to break into Windows 7, Windows 8, and some Windows NT systems, the security vendor said.
APT3 developed the exploit by reverse-engineering EternalRomance, but then tweaked it so it could be used to target more systems. APT3s Bemstour leveraged the same Windows zero-day as the one used in EternalRomance (
CVE-2017-0143
). In addition the group also created an exploit for another Windows zero-day (
CVE-2019-0703
). Both flaws have been patched.
What we found out is that in terms of the software vulnerabilities targeted by the underlying exploit they were identical to those leveraged by EternalRomance, says Mark Lechtik, lead security researcher at Check Point.
This is no coincidence - finding the exact same set of bugs in order to create an exploit that provides remote code execution capabilities is very unlikely, he says. At the same time, there are enough differences in Bemstour to indicate the exploit was re-engineered and built from scratch, rather than copied wholesale. That is what led Check Point to conclude that an NSA exploit was used in some way as a reference, he notes.
Close Monitoring
During the
analysis
of Bemstour, Check Point researchers found evidence suggesting the Chinese group had closely monitored systems under its control that the NSA had managed to compromise. APT3 members then captured traffic related to those attacks—including information on how the NSA was moving laterally on the compromised networks—and then used that as a reference to reverse-engineer the NSAs exploit.
This allowed them to build an exploit tool that looked and worked remarkably similar to the NSAs exploit, but with less effort and cost. Instead of purchasing from a third party or investing in its own in-house team, APT3 built its malware by collecting and using the NSAs own attack data.
The main takeaway is that we see evidence for the first time of a nation-state collecting and reusing foreign attack tools to recreate their own, Lechtik says. We heard of that happening in theory; now we [have] facts that support it.
Lechtik says its unclear if other Chinese APT groups and state actors have adopted a similar approach. But from their point of view, the approach would make sense. If they can catch a tool and repurpose it, they cut the costs on finding it themselves, he notes. If we see they did it once, it would be likely they have done it on other instances and keep doing it today.
The question of whether other countries are doing the same thing is harder to answer, he says. Pulling off something like what APT3 did requires the ability to deliberately monitor domestic systems, collect and analyze a lot of information all with the hope of finding one usable tool.
Not all nation-states would go down this road in the first place, and indeed a lot dont use exploits, not to mention zero-days, almost at all, he says. Instead, they try to abuse human weaknesses through phishing, for example—an opportunistic but very cheap alternative. Iran and North Korea are examples for exactly that.
Related Content:
APT3 Threat Group a Contractor for Chinese Intelligence Agency
Shadow Brokers Offers Database Of Windows Exploits For Sale
The Shadow Brokers: How They Changed Cyber Fear
8 Head-Turning Ransomware Attacks to Hit City Governments

Check out
The Edge
, Dark Readings new section for features, threat data, and in-depth perspectives. Todays top story:
8 Ways To Spot an Insider Threat
.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Chinese Group Built Advanced Trojan by Reverse Engineering NSA Attack Tool