3 ms·

> X-Tunnel That one is more likely to be used by the Chinese: https://www.invincea.com/2016/07/tunnel-of-gov-dnc-hack-and-the-russian-xtunnel/ https://www.invi

• lern_too_spel 10y ago
  That document is yet another example of laughably poor security analysis. The Chinese implementation of the XTunnel protocol is in Java (the GitHub project is written in Java, and you can see an embedded JRE in your blog post's link to the Chinese tool in the strings here: https://cynomix.invincea.com/sample/e2101519714f8a4056a9de18443bc6e8a1f1b977 https://cynomix.invincea.com/sample/e2101519714f8a4056a9de18...). The FancyBear implementation is not (no embedded JRE here: https://cynomix.invincea.com/sample/f09780ba9eb7f7426f93126bc198292f5106424b https://cynomix.invincea.com/sample/f09780ba9eb7f7426f93126b...). If you want to see how professionals do it, take a look at https://www.eset.com/int/about/newsroom/research/dissection-of-sednit-espionage-group/ https://www.eset.com/int/about/newsroom/research/dissection-....