A China-affiliated cyber threat actor has been implicated in a series of strategic cyber intrusions targeting prominent organizations across Southeast Asia, ongoing since October 2023.
According to a detailed report from the Symantec Threat Hunter Team, the espionage campaign focused on high-value targets across diverse sectors. These included government ministries in two separate countries, an air traffic control agency, a telecommunications firm, and a media organization. The findings were shared exclusively with The Hacker News.
Tools and Techniques Behind the Campaign
The attackers employed a blend of sophisticated tools and techniques often associated with China-based advanced persistent threat (APT) groups. Their methods incorporated a mix of open-source utilities and living-off-the-land (LotL) strategies. Key tools used in the attacks included reverse proxy programs like Rakshasa and Stowaway, along with reconnaissance utilities, keyloggers, and password-stealing software.
A central element of the attack was the deployment of PlugX (also known as Korplug), a remote access trojan (RAT) widely utilized by Chinese APT groups. Additionally, the attackers implemented customized DLL files acting as authentication filters, enabling them to intercept sensitive login credentials.
Reconnaissance and Data Exfiltration
In one specific case, an organization was compromised over a three-month period between June and August 2024. During this time, the threat actors conducted extensive reconnaissance, extracted passwords, deployed keylogging malware, and executed payloads designed to siphon user credentials.
The attackers maintained prolonged, covert access to the networks, enabling the harvesting of passwords and detailed mapping of the targeted organizations’ infrastructures. The stolen information was compressed into encrypted archives using WinRAR and subsequently exfiltrated via cloud storage services like File.io.
“This prolonged presence within compromised environments demonstrates the adversaries’ sophistication and persistence,” the Symantec report stated. “The overlap in tool usage and targeting points strongly towards actors based in China.”
Attribution Challenges
While the activity aligns with tactics observed in other China-linked APT operations, Symantec highlighted the challenges in attributing the attacks to a specific group. The frequent sharing of tools and tradecraft among Chinese cyber espionage entities complicates direct attribution.
Regional and Global Implications
These attacks are taking place amidst heightened geopolitical tensions in Southeast Asia, particularly concerning territorial disputes in the South China Sea. Notable threat activity groups such as Unfading Sea Haze, Mustang Panda, CeranaKeeper, and Operation Crimson Palace have previously targeted this region.
Adding to the complexity of the situation, similar activities have been observed in other parts of the world. A recent disclosure by SentinelOne SentinelLabs and Tinexta Cyber detailed an operation, Operation Digital Eye, involving China-based actors targeting IT service providers in Southern Europe.
Furthermore, Symantec recently reported that a major U.S.-based organization experienced a breach by likely Chinese threat actors earlier this year. This attack, spanning April to August 2024, allowed the adversaries to move laterally across the network and potentially exfiltrate sensitive data.
The uncovered espionage campaign highlights the methodical and calculated nature of China-linked APT groups. By leveraging advanced tools and prolonged dwell times, these actors pose a significant threat to organizational security. The findings underscore the critical need for robust cybersecurity measures to detect and thwart such sophisticated attacks.
