Connect with us

Hi, what are you looking for?

HEADLINES

Operation Crimson Palace, Chinese state-sponsored espionage, expands in SEAsia – Sophos

Sophos X-Ops first reported on what they named Operation Crimson Palace in June and detailed Sophos X-Ops’ discovery of three separate clusters of Chinese nation-state activity—Cluster Alpha, Cluster Bravo and Cluster Charlie—inside a high-profile government organization.

Sophos, a global player of security solutions for defeating cyberattacks, recently released its report, “Crimson Palace: New Tools, Tactics, Targets,” which details the latest developments in a nearly two-year long Chinese cyberespionage campaign in Southeast Asia.

Sophos X-Ops first reported on what they named Operation Crimson Palace in June and detailed Sophos X-Ops’ discovery of three separate clusters of Chinese nation-state activity—Cluster Alpha, Cluster Bravo and Cluster Charlie—inside a high-profile government organization. After a brief hiatus in August 2023, Sophos X-Ops noted renewed Cluster Bravo and Cluster Charlie activity, both within the initial targeted organization and in numerous other organizations within the region.

While investigating this renewed activity, Sophos X-Ops uncovered a novel keylogger that the threat hunters named “Tattletale,” which can impersonate users who have signed into the system and gather information related to password policies, security settings, cached passwords, browser information, and storage data. Sophos X-Ops also notes in the report that, in contrast to the first wave of the operation, Cluster Charlie increasingly switched to using open-source tools rather than deploying the types of custom malware they developed in the initial wave of activity.

“We’ve been in an ongoing chess match with these adversaries. During the initial phases of the operation, Cluster Charlie was deploying various bespoke tools and malware,” said Paul Jaramillo, director, threat hunting and threat intelligence, Sophos. “However, we were able to ‘burn’ much of their previous infrastructure, blocking their Command and Control (C2) tools and forcing them to pivot. This is good; however, their switch to open-source tools demonstrates just how quickly these attacker groups can adapt and remain persistent. It also appears to be an emerging trend among Chinese nation-state groups. As the security community works to secure our most sensitive systems from these attackers, it’s important to share the insights into this pivot.”

Advertisement. Scroll to continue reading.

Cluster Charlie, which shares tactics, techniques and procedures (TTPs) with the Chinese threat group Earth Longzhi, was originally active from March to August 2023 in a high-level government organization in Southeast Asia. While the cluster was dormant for several weeks, it re-emerged in September 2023 and was active again until at least May 2024. During this second stage of the campaign, Cluster Charlie focused on penetrating deeper into the network, evading endpoint detection and response (EDR) tools and gathering further intelligence. In addition to switching to open-source tools, Cluster Charlie also began using tactics initially deployed by Cluster Alpha and Cluster Bravo, suggesting that the same overarching organization is directing all three activity clusters. Sophos X-Ops has tracked ongoing Cluster Charlie activity across multiple other organizations in Southeast Asia.

Cluster Bravo, which shares TTPs with the Chinese threat group Unfading Sea Haze, was originally only active in the targeted network for a three-week span in March 2023. However, the cluster reappeared in January 2024, only this time it was targeting at least 11 other organizations and agencies in the same region.

“Not only are we seeing all three of the ‘Crimson Palace’ clusters refine and coordinate their tactics, but they’re also expanding their operations, attempting to infiltrate other targets in Southeast Asia. Given how frequently Chinese nation-state groups share infrastructure and tools, and the fact that Cluster Bravo and Cluster Charlie are moving beyond the original target, we will likely continue to see this campaign evolve—and in potentially new locations. We will be monitoring it closely,” said Jaramillo.

Advertisement. Scroll to continue reading.
Advertisement
Advertisement
Advertisement

Like Us On Facebook

You May Also Like

HEADLINES

Located in the Kaspersky office, the new facility will provide the company’s stakeholders with services ranging from an overview of Kaspersky’s practices, to a...

HEADLINES

Smart and Maya emphasize that they never send SMS with links requesting login credentials, personal information, or account verification. If you receive such a...

HEADLINES

In this new scheme, scammers call potential victims claiming that their phone number has been linked to illegal activities. The fraudsters would then extort...

White Papers

With an increase of 9% the industry is one of only three sectors with an increasing attack rate beside healthcare (+7%) and financial services...

HEADLINES

In August alone, PLDT and Smart’s Cyber Security Operations Group (CSOG) blocked access to more than 400,000 URLs that host child sexual abuse and...

White Papers

The survey reveals a crucial opportunity for mobile brands in the Philippines to stand out by prioritizing mobile app security and creating a better...

HEADLINES

Kaspersky’s solutions recorded Necro attacks targeting users in Russia, Brazil, Vietnam, Ecuador, and Mexico as part of this malicious campaign.

HEADLINES

Customers who received text scam and other phishing messages are encouraged to report these incidents to HULISCAM at https://smart.com.ph/huliscam. The portal will ask customers to...

Advertisement