Cyberspying Aimed at Industrial Enterprises in Russia and Ukraine Linked to China

guest · Aug 8, 2022

August 8, 2022

A recent cyberespionage operation aimed at industrial enterprises and public institutions in Eastern Europe and Afghanistan has been linked to a threat actor that is likely sponsored by the Chinese government.
Click to expand...

The campaign, detailed on Monday by Kaspersky, is believed to be the work of TA428, a group that has been tracked by cybersecurity companies since at least 2019. TA428 activities and the malware used by the group were previously detailed by Recorded Future, Group-IB, Proofpoint, Cybereason, Dr.Web, and NTT Security. The group is also known as Colourful Panda and Bronze Dudley.

Some of TA428’s more recent attacks, ones disclosed in 2021, focused on Russia, targeting government and military organizations. The attacks analyzed by Kaspersky’s ICS CERT unit were first seen in January 2022 and they are likely an extension of that campaign.
Click to expand...

The attacks seen by Kaspersky were aimed at more than a dozen organizations in Russia, Ukraine, Belarus and Afghanistan. Victims included military industrial complex enterprises and public institutions. Specifically, the attacks were aimed at industrial plants, design bureaus, research institutes, and various types of government organizations.
Click to expand...

Kaspersky (Full Report):
Targeted attack on industrial enterprises and public institutions

The attackers penetrate the enterprise network using carefully crafted phishing emails, some of which contain information that is specific to the organization under attackand is not publicly available. This could indicate that the attackers did preparatory work in advance (they may have obtained the information in earlier attacks on the same organization or its employees or on other organizations or individuals associated with the victim organization).
Click to expand...

An earlier series of attacks in which the PortDoor malware was also used was described by Cybereason experts.

In the new series of attacks, the attackers used six different backdoors at the same time – probably to set up redundant communication channels with infected systems in case one of the malicious programs was detected and removed by a security solution. The backdoors used provide extensive functionality for controlling infected systems and collecting confidential data.
Click to expand...

A Chinese-speaking group is highly likely to be behind the attacks.

We can see significant overlaps in tactics, techniques, and procedures (TTPs) with TA428 activity.

The attack analyzed used the same weaponizer, which embeds code of a CVE-2017-11882 exploit in documents, as in earlier TA428 attacks that targeted enterprises in Russia’s military-industrial complex.

Some indirect evidence also suggests a Chinese-speaking group very likely being behind the attack. This includes:

the use of hacking utilities that are popular in China, such as Ladon,

the fact that the second stage CnC server is located in China,

the fact that the CnC server registration information includes an email address in the Chinese domain 163.com specified in the administrator’s contact data.

Click to expand...

Kaspersky: Targeted attack on industrial enterprises and public institutions

Of the six backdoors identified on infected systems, five (PortDoor, nccTrojan, Logtu, Cotx, and DNSep) have been used earlier in attacks attributed by other researchers to APT TA428. The sixth backdoor is new and has not been observed in other attacks.
Click to expand...

Log in or Sign up

Cyberspying Aimed at Industrial Enterprises in Russia and Ukraine Linked to China

guest Guest

Log in or Sign up

Cyberspying Aimed at Industrial Enterprises in Russia and Ukraine Linked to China

guest Guest

Useful Searches