Some people seem surprised that APT malware, like the recent FrostyGoop (what's with this name btw?) sample, are relatively simple pieces of code with no obfuscations and big chunks of code copied from open-source repos on GitHub.
There is one thing you need to understand about state-sponsored actors. They don't do it for the internet clout (at least most of them). They only care about finishing their mission given to them by their commanders. So they will use whatever works for them.
Despite what some people think, obfuscation is mostly used to defeat AV/EDR signature detection, not to thwart manual reverse-engineering (this is only a good side-effect). If the devices you are targeting (like ICS or edge devices) do not traditionally run AV/EDR products, there is no point in wasting time obfuscating your code. Plus there's always a risk of obfuscation breaking the code, or introducing new bugs, and each obfuscated sample should be tested (again more wasted time).
As per the GitHub code - APTs LOVE Open Source. Again, despite what some people think, these groups do not have unlimited resources. In particular, time is limited to 24 hours a day for them like for every human being. Could they develop similar in-house code? Most of them probably could, but this would waste months of development and testing. Here they have a code that simply works, it's easily accessible, and as a bonus was tested by thousands of volunteers across the world. It's a win-win situation.
If you looked at malware that Chinese groups use on edge devices (I will talk more about this on Bsides in SG this year btw - spoiler alert!) it looks mostly similar. No obfuscation, big chunks of code copied from GitHub with slight modifications, or even simply GitHub code 1:1.
On the other hand, these groups can be "advanced" when they need to. They have deep operational knowledge of their targets, they know how to move stealthily while inside the network, and how to hide in plain sight. Most importantly they know how to complete their mission objectives (of course caveats apply to all of these points) - something I saw many RedTeams struggle with (but they had crazy EDR bypasses and obfuscations, only no idea how to finish their mission ;) )
#frostygoop #malware #apt #threatintelligence
The Threat Codex
Lasq
InfoSecSherpa
securityaffairs
🛡 
webhat