Chinese APT Data-Harvesting Campaign Analyzed

guest · Sep 23, 2021

Chinese APT Data-Harvesting Campaign Analyzed
Nation-State Chinese Groups APT27, APT41 Likely Candidates
September 20, 2021
https://www.databreachtoday.com/chinese-apt-data-harvesting-campaign-analyzed-a-17581

Earlier this month, cybersecurity company McAfee Enterprise's Advanced Threat Research team, working with McAfee's Professional Services IR team, reported that an APT campaign dubbed Operation Harvest had been in operation for years. The threat actor is suspected to be a nation-state Chinese group, and APT27 and APT41 are reportedly the most likely candidates.

The adversary uses a combination of known and new malware for their attacks, according to the report's author, Christiaan Beek, who is a lead scientist at McAfee.
The report notes how this adversary "mostly seems to work from Monday to Thursday and typically during office hours, albeit with the occasional exception."
Click to expand...

Attack Analysis
The attackers then installed software to help collect information about the victim's network, move laterally through the system and execute malicious files and help store tools, including:

Mimikatz: an open-source pentesting tool that allows users to view and save authentication credentials;

PsExec: a Microsoft tool that allows runs processes remotely using any user's credentials;

Procdump: a tool that supports monitoring of hung windows and unhandled exceptions;

RottenPotato: an open-source tool that is used to access a privileged token - for example, “NT AUTHORITYSYSTEM” - to be able to execute tasks with system rights;

The adversary, the report adds, used privilege escalation exploits to steal credentials and move on to other systems.
Click to expand...

Mitigation
Over the past year, attackers have increasingly used initial access vectors other than spear-phishing, such as compromising remote access systems or supply chains, according to a separate McAfee blog post.

The exploitation of public-facing vulnerabilities for initial access is a technique associated with Operation Harvest and other APT groups to gain entry, the researchers say.
In the attack scenario described by McAfee, patching and monitoring could have prevented the initial foothold from taking place, Malik says.
Click to expand...

McAfee: Operation ‘Harvest’: A Deep Dive into a Long-term Campaign

In this report, ATR provides a deep insight into this long-term campaign where we will map out our findings against the Enterprise MITRE ATT&CK model. There will be parts that are censored since we respect the confidentiality of the victim. We will also zoom in and look at how the translation to the MITRE Techniques, historical context, and evidence artifacts like PlugX and Winnti malware led to a link with another campaign, which we highly trust to be executed by the same adversary.

IOCs that could be shared are at the end of this document.
Click to expand...

Log in or Sign up

Chinese APT Data-Harvesting Campaign Analyzed

guest Guest

Log in or Sign up

Chinese APT Data-Harvesting Campaign Analyzed

guest Guest

Useful Searches