Unmasking Operation Jacana: A Cyberespionage Campaign Against Guyana’s Government

Introduction: An Unfamiliar Battlefield

Cybersecurity is often likened to a game of cat and mouse, where each side continually evolves to outwit the other. But what happens when that game starts resembling a scene from a fantasy novel, complete with hobbits and secret doors? Welcome to Operation Jacana, a cyberespionage campaign that targeted a governmental entity in Guyana. While the perpetrators haven’t been definitively identified, signs point to a China-aligned APT group.

In this analysis based on the report by ESET¹, we will delve into the mechanics of this operation, shedding light on the tools, techniques, and possible motives behind it.

Attribution: Piecing Together the Puzzle

The attribution of Operation Jacana remains a subject of debate. While ESET researchers suggest a China-aligned APT group could be responsible, they’ve made this claim with only medium confidence. However, it’s essential to contextualize this within broader geopolitical dynamics. February 2023, the month when the operation occurred, was also the same month when Guyana’s Special Organised Crime Unit arrested three people in a money laundering investigation involving Chinese companies. This event strained Guyana–China relations, adding another layer to the intrigue.

Spearphishing: The Art of Deception

One of the most fascinating aspects of Operation Jacana is its spearphishing technique. The attackers didn’t just shoot in the dark; they aimed their arrows with precision. Spearphishing emails² referenced Guyanese public affairs, including President Mohamed Irfaan Ali’s official visit to Nassau, The Bahamas, and a story about a Guyanese fugitive in Vietnam. This specificity demonstrates a nuanced understanding of Guyana’s political landscape, suggesting that the attackers had done their homework.

The Backdoor: Introducing DinodasRAT

DinodasRAT, named after a hobbit from the Lord of the Rings, is the weapon of choice in this campaign. Developed in C++, this previously undocumented backdoor has capabilities ranging from file exfiltration to registry manipulation. What’s particularly striking about DinodasRAT is its encryption technique. It employs the Tiny Encryption Algorithm (TEA), a straightforward block cipher known for its ease of implementation. The use of TEA encryption implies a conscious choice by the attackers, possibly for its speed and efficiency.

DinodasRAT’s Arsenal

The backdoor’s capabilities are indeed expansive, but let’s focus on a few that stand out:

Screenshot Capture: The malware takes periodic screenshots of the victim’s machine, encrypting and storing them in a specific directory. This potentially allows for real-time surveillance of user activity.
Clipboard Content Extraction: The malware also captures clipboard content, suggesting that it could potentially snatch sensitive information copied to the clipboard.
Command Execution: DinodasRAT can execute a wide range of commands on the victim’s machine, from listing directory contents to manipulating Windows registry keys. This provides a high level of control over compromised systems.

Lateral Movement: Spreading the Net

Operation Jacana: Foundling hobbits in Guyana

After gaining initial access, the attackers didn’t rest on their laurels. They employed tools like Impacket for lateral movement within the network. This enabled them to spread the DinodasRAT backdoor to other systems, amplifying the scale and potential impact of the attack.

The Other Tools: Beyond DinodasRAT

While DinodasRAT was the star of the show, the attackers also deployed other tools:

Korplug (aka PlugX): This is another backdoor commonly associated with China-aligned groups, reinforcing the notion of Chinese involvement.
SoftEther VPN Client: Used likely to proxy local ports to the C&C server, it further obfuscates the attackers’ tracks.

Conclusion: A Cautionary Tale

Operation Jacana serves as a sobering reminder of the evolving threats in the cyber landscape. The use of a unique, previously undocumented backdoor and the intricacy of the spearphishing emails reveal a high level of sophistication. While attribution to a specific group remains elusive, the clues lean towards a China-aligned entity, especially given the strained Guyana-China relations at the time of the attack.

Cyberespionage campaigns like Operation Jacana exemplify the need for robust cybersecurity measures. They also highlight the increasing role of geopolitics in the cyber arena. In this interconnected world, a skirmish in the digital realm can have far-reaching implications in the physical world, making cybersecurity not just an IT issue, but a matter of national security.