Cyber espionage by Chinese hackers in neighbouring nations is on the rise

guest · Jun 20, 2021

Cyber espionage by Chinese hackers in neighbouring nations is on the rise
RedFoxtrot operations linked to China’s PLA Unit 69010 due to bad opsec
June 18, 2021
https://thehackernews.com/2021/06/cyber-espionage-by-chinese-hackers-in.html

In a wide-ranging report published by Massachusetts-headquartered Recorded Future this week, the cybersecurity firm's Insikt Group said it identified ties between a group it tracks as "RedFoxtrot" to the People's Liberation Army (PLA) Unit 69010 operating out of Ürümqi, the capital of the Xinjiang Uyghur Autonomous Region in the country.

RedFoxtrot is noted to target government, defense, and telecommunications sectors across Central Asia, India, and Pakistan, with intrusions in the last six months directed against three Indian aerospace and defense contractors as well as major telecommunications providers and government agencies in Afghanistan, India, Kazakhstan, and Pakistan.
Click to expand...

Recorded Future: Threat Activity Group RedFoxtrot Linked to China’s PLA Unit 69010; Targets Bordering Asian Countries

Recorded Future’s Insikt Group has identified ties between a suspected Chinese state-sponsored threat activity group we track as RedFoxtrot and the Chinese military intelligence apparatus, specifically People’s Liberation Army (PLA) Unit 69010 located in Ürümqi, Xinjiang. This activity offers a glimpse into PLA operations following a major organizational restructure beginning in 2015 and follows a period where public reporting has largely concentrated on groups affiliated with China’s Ministry of State Security (MSS).
Click to expand...

Key Judgments

Formerly known as the Lanzhou Military Region‘s Second Technical Reconnaissance Bureau, PLA Unit 69010 has very likely been incorporated into the Network Systems Department of the PLA-SSF following a 2015 restructure.

We believe that RedFoxtrot is a Chinese state-sponsored threat activity group based on identified links to a specific PLA unit and the use of shared custom capabilities considered unique to Chinese cyber espionage groups.

In 2020, RedFoxtrot, alongside multiple other PLA and MSS-affiliated threat groups, likely gained access to the ShadowPad backdoor.

In the aftermath of the 2015 restructuring, activity linked to previously tracked PLA-affiliated cyber espionage groups has declined, likely due to old activity groups disbanding or merging to form new clusters. With continued activity from suspected PLA groups such as Tonto Team, Tick, Naikon, and RedFoxtrot, and the emergence of new Chinese threat activity groups with suspected PLA links, Insikt Group believes that PLA-affiliated groups remain prominent within the Chinese cyber espionage sphere despite increased attention on their MSS counterparts.

Click to expand...

guest · Sep 29, 2021

Suspected Chinese state-linked threat actors infiltrated major Afghan telecom provider
September 28, 2021
https://therecord.media/suspected-c...rs-infiltrated-major-afghan-telecom-provider/

Four distinct infiltrations by suspected Chinese-state sponsored threat actors stole gigabytes of data from the corporate mail server of major Afghan telecom provider Roshan within the past year, with data exfiltration by some spiking during the Taliban’s recapture of the country, according to new research from Recorded Future’s Insikt Group.

Roshan is a mobile phone provider that operates throughout Afghanistan, “covering all 34 provinces with over 6.5 million active subscribers,” according to its website.

“It’s among the biggest suppliers of Internet access to the people of Afghanistan” and a major source of online traffic in and out of the country, Doug Madory, Director of Internet Analysis at Kentik and a longtime observer of global traffic trends, told The Record.
The researchers identified the apparent infiltrations of Roshan’s internal mail server through an analysis of adversary instructure and global network traffic, including observation of communication from the infected system to command and control servers.
Click to expand...

The earliest activity identified by the researchers that targeted Roshan was linked to suspected Chinese state-sponsored group Calypso Advanced Persistent Threat (APT). That intrusion appears to date back to at least July of 2020 and was ongoing through September 2021, with a significant increase in activity in August and September of this year.

The researchers identified the same Roshan mail server communicating with the infrastructure of another named suspected Chinese APT group, RedFoxtrot, from at least March through May of this year.

RedFoxtrot also appeared to have infiltrated another unidentified Afghan telecom provider during this period, according to the Insikt post published Tuesday. A report from the research team publicly released in June previously identified RedFoxtrot as targeting unnamed telecommunications companies in Afghanistan as well as India, Pakistan, and Kazakhstan. The report also linked the RedFoxtrot to a specific unit of the People’s Liberation Army, Unit 69010 located in Ürümqi, Xinjiang.
Click to expand...

Insikt Group: 4 Chinese APT Groups Identified Targeting Mail Server of Afghan Telecommunications Firm Roshan

The earliest identified activity targeting Roshan is linked to the suspected Chinese state-sponsored group Calypso APT, and has been ongoing from at least July 2020 to September 2021, and was first reported by Insikt Group in August last year.

More recently, the same Roshan server was identified communicating with RedFoxtrot PlugX command and control infrastructure from at least March to May 2021. During this time, RedFoxtrot was also identified targeting a second Afghan telecommunications organization.

Two more clusters were also engaged in the targeting of the same Roshan mail server. These are referred to as the Winnti and PlugX clusters respectively and are outlined further in the sections below. Both of these clusters appear unrelated to each other or the Calypso APT and RedFoxtrot activity, but we have been unable to link them to a tracked activity group at this time.

Click to expand...

Log in or Sign up

Cyber espionage by Chinese hackers in neighbouring nations is on the rise

guest Guest

guest Guest

Log in or Sign up

Cyber espionage by Chinese hackers in neighbouring nations is on the rise

guest Guest

guest Guest

Useful Searches