In 2013, cybersecurity firm Mandiant published a blockbuster report on a state-sponsored hacking team known as APT1, or Comment Crew. The Chinese group achieved instant infamy, tied to the successful hacks of more than 100 US companies and the exfiltration of hundreds of terabytes of data. They also vanished in the wake of being exposed. Now, years later, researchers from security firm McAfee say they’ve found code based on APT1–associated malware cropping up in a new set of attacks.

Specifically, McAfee has found malware that reuses a portion of the code found in an implant called Seasalt, which APT1 introduced sometime around 2010. Lifting and repurposing pieces of malware is not an unusual practice, especially when those tools are widely available or open source. Look no further than the rash of attacks based on EternalBlue, the leaked NSA tool. But source code used by APT1, McAfee says, never became public, nor did it wind up on the black market. Which makes its reappearance something of a mystery.

“When we picked up the samples and we found code reuse for Comment Crew,” says McAfee chief scientist Raj Samani, “all of a sudden it was like an ‘oh shit’ moment.”

Attack Zones

McAfee says it has seen five waves of attacks using the remixed malware, which it calls Oceansalt, dating back to May of this year. The attackers crafted spearphishing emails, with infected Korean-language Excel spreadsheet attachments, and sent them to targets who were involved in South Korean public infrastructure projects and related financial fields.

“They knew the people to target,” Samani says. “They had identified the targets that they needed to manipulate into opening these malicious documents.”

"All of a sudden it was like an ‘oh shit’ moment." Raj Samani, McAfee

Victims who opened those documents unwittingly installed Oceansalt. McAfee believes the malware was used for initial reconnaissance, but had the ability to take control both of the system it infected and any network that device connected to. “The access that they had was quite significant,” says Samani. “Everything from getting full insight into the file structure, being able to create files, delete files, being about to list processes, terminate processes.”

While the initial attacks focused on South Korea—and appear to have been instigated by people fluent in Korean—they at some point spread to targets in the United States and Canada, focusing especially on the financial, health care, and agricultural industries. McAfee says it’s not aware of any obvious ties between the impacted companies and South Korea, and that the move West may have been a separate campaign.

McAfee does note some differences between Oceansalt and its precursor. Seasalt, for instance, had a persistence method that let it remain on an infected device even after a reboot. Oceansalt does not. And where Seasalt sent data to the control server unencrypted, Oceansalt employs an encoding and decoding process.

Still, the two share enough code that McAfee is confident in the connection. It’s far less certain, though, about who’s behind it.

Who Done It?

It’s hard to overstate just how capable APT1 was, and how unprecedented Mandiant’s insights were at the time. “APT1 were extraordinarily prolific,” says Benjamin Read, senior manager for cyberespionage analysis at FireEye, which acquired Mandiant in 2014. “They were one of the highest in terms of volume. But volume can also allow you to build a pattern of life. When you’re doing that much stuff, you’re going to have slip-ups that expose some of the backend.”

It’s probably not accurate to say that APT1 disappeared after the Mandiant report. It’s just as likely that the unit’s hackers continued to work for China under a different guise. But it is true, Read says, that the tactics, the infrastructure, and specific malware associated with the group haven’t seen the light of day in those five years.