{"id":63847,"date":"2024-06-06T11:50:11","date_gmt":"2024-06-06T03:50:11","guid":{"rendered":"http:\/\/www.upgrademag.com\/web\/?p=63847"},"modified":"2024-06-06T11:50:13","modified_gmt":"2024-06-06T03:50:13","slug":"sophos-claims-to-have-uncovered-chinese-espionage-campaign-in-seasia","status":"publish","type":"post","link":"http:\/\/www.upgrademag.com\/web\/2024\/06\/06\/sophos-claims-to-have-uncovered-chinese-espionage-campaign-in-seasia\/","title":{"rendered":"Sophos claims to have uncovered Chinese espionage campaign in SEAsia"},"content":{"rendered":"\n

Sophos, a global player of security solutions for defeating cyberattacks, released its report, \u201cOperation Crimson Palace: Threat Hunting Unveils Multiple Clusters of Chinese State-Sponsored Activity Targeting Southeast Asia,\u201d which details a highly sophisticated, nearly two-year long espionage campaign against a high-level government target. <\/strong><\/p>\n\n\n\n

During Sophos X-Ops’ investigation, which began in 2023, the managed detection and response (MDR) team found three distinct clusters of activity targeting the same organization, two of which included tactics, techniques and procedures (TTPs) that overlap with well-known, Chinese nation-state groups: BackdoorDiplomacy, APT15 and the APT41 subgroup Earth Longzhi.<\/p>\n\n\n\n

The attackers designed their operation to gather reconnaissance on specific users as well as sensitive political, economic, and military information, using a wide variety of malware and tools throughout the campaign that Sophos has since dubbed \u201cCrimson Palace.\u201d This includes previously unseen malware: a persistence tool that Sophos named PocoProxy.<\/p>\n\n\n\n

The different clusters appear to have been working in support of Chinese state interests by gathering military and economic intelligence related to the country\u2019s strategies in the South China Sea. In this particular campaign, we believe these three clusters represent distinct groups of attacks who are working in parallel against the same target under the overarching directive of a central state authority. Within just one of the three clusters that we identified\u2014Cluster Alpha\u2014 we saw malware and TTPs overlap with four separately reported Chinese threat groups. It\u2019s well-known that Chinese attackers share infrastructure and tooling, and this recent campaign is a reminder of just how extensively these groups share their tools and techniques.<\/p>\n\n\n\n

\u201cAs Western governments elevate awareness about cyberthreats from China, the overlap Sophos has uncovered is an important reminder that focusing too much on any single Chinese attribution may put organizations at risk of missing trends about how these groups coordinate their operations,\u201d said Paul Jaramillo, director, threat hunting and threat intelligence, Sophos. \u201cBy having the bigger, broader picture, organizations can be smarter about their defenses.\u201d<\/p>\n\n\n\n

Sophos X-Ops first learned of malicious activity on the targeted organization\u2019s network in December 2022 when they found a data exfiltration tool previously attributed to the Chinese threat group Mustang Panda. From there, the MDR team began a broader hunt for malicious activity. In May 2023, Sophos X-Ops threat hunting uncovered a vulnerable VMWare executable and, after analysis, three distinct clusters of activity in the target\u2019s network: Cluster Bravo, Cluster Charlie and Cluster Alpha.<\/p>\n\n\n\n

Cluster Alpha was active from early March to at least August 2023 and deployed a variety of malware focused on disabling AV protections, escalating privileges and conducting reconnaissance. This included an upgraded version of the EAGERBEE malware that has been associated with the Chinese threat group REF5961. Cluster Alpha also utilized TTPs and malware that overlap with the Chinese threat groups BackdoorDiplomacy, APT15, Worok, and TA428.<\/p>\n\n\n\n

Cluster Bravo was only active in the targeted network for a three-week span in March 2023 and focused on moving laterally through the victim\u2019s network to sideload a backdoor called CCoreDoor. This backdoor establishes external communications pathways for the attackers, performs discovery and exfiltrates credentials.<\/p>\n\n\n\n

Cluster Charlie was active from March 2023 to at least April 2024, with a focus on espionage and exfiltration. This included the deployment of PocoProxy: a persistence tool that masquerades as a Microsoft executable and establishes communications with the attackers\u2019 command and control infrastructure. Cluster Charlie worked to exfiltrate a large volume of sensitive data for espionage purposes, including military and political documents and credentials\/tokens for further access within the network. Cluster Charlie shares TTPs with Chinese threat group Earth Longzhi, a reported subgroup of APT41. Unlike Cluster Alpha and Cluster Bravo, Cluster Charlie remains active.<\/p>\n\n\n\n

\u201cWhat we\u2019ve seen with this campaign is the aggressive development of cyberespionage operations in the South China Sea. We have multiple threat groups, likely with unlimited resources, targeting the same high-level government organization for weeks or months at a time, and they are using advanced custom malware intertwined with publicly available tools. They were, and are still, able to move throughout an organization at will, rotating their tools on a frequent basis. At least one of the activity clusters is still very much active and attempting to conduct further surveillance.<\/p>\n\n\n\n

\u201cGiven how often these Chinese threat groups overlap and share tooling, it\u2019s possible that the TTPs and novel malware we observed in this campaign will resurface in other Chinese operations globally. We will keep the intelligence community informed of what we find as we continue our investigations into these three clusters,\u201d said Jaramillo.<\/p>\n\n\n\n

Read more about this espionage campaign in \u201cOperation Crimson Palace: Threat Hunting Unveils Multiple Clusters of Chinese State-Sponsored Activity Targeting Southeast Asia<\/a>\u201d on Sophos.com.<\/p>\n","protected":false},"excerpt":{"rendered":"

During Sophos X-Ops’ investigation, which began in 2023, the managed detection and response (MDR) team found three distinct clusters of activity targeting the same organization, two of which included tactics, techniques and procedures (TTPs) that overlap with well-known, Chinese nation-state groups: BackdoorDiplomacy, APT15 and the APT41 subgroup Earth Longzhi.<\/p>\n","protected":false},"author":6,"featured_media":61252,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19],"tags":[286,54,2103,206],"class_list":["post-63847","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-headlines","tag-it-security","tag-security","tag-security-breach","tag-sophos"],"_links":{"self":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/posts\/63847","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/comments?post=63847"}],"version-history":[{"count":0,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/posts\/63847\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/media\/61252"}],"wp:attachment":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/media?parent=63847"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/categories?post=63847"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/tags?post=63847"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}