Hackers Target Critical Infrastructure in Southeast Asia

guest · Aug 7, 2021

Hackers Target Critical Infrastructure in Southeast Asia
Symantec: China-Linked Actors Investigate SCADA Systems
August 7, 2021
https://www.inforisktoday.com/hackers-target-critical-infrastructure-in-southeast-asia-a-17237

An unidentified hacking group with suspected China ties is targeting critical infrastructure in South East Asia as part of a cyberespionage campaign to exfiltrate information about the victim's SCADA systems. says a report by security firm Symantec.

Once successful compromising the systems, the attackers proceeded to credential theft and then collected information about the victim's SCADA systems. SCADA comprises software and hardware that allows industrial organizations to control industrial processes locally or remotely, as well as monitor and gather real-time data.

Symantec reports that "There are some indications that the attacker behind this campaign is based in China," based on "certain artifacts found on the victim machines," but it did not provide further details and went on to say that, "with the current information available, Symantec cannot attribute the activity to a known actor."
Click to expand...

Symantec: Critical Infrastructure Organizations in South East Asia Targeted in Espionage Campaign

Attackers made extensive use of living-off-the-land techniques in campaign that lasted several months
Credential theft and lateral movement across victim networks seemed to be a key aim of the attacker, who made extensive use of living-off-the-land tools in this campaign. Among the living-off-the-land or dual-use tools used were:

• Windows Management Instrumentation (WMI)
• ProcDump
• PsExec
• PAExec
• Mimikatz
The attacker was also seen exploiting a legitimate multimedia player to load a malicious DLL via search order hijacking, as well as exploiting another legitimate tool to load suspicious files onto victim machines.
Click to expand...

While we cannot definitively say what the end goal of the attacker was in these attacks, espionage seems like the likeliest motive. This is indicated by the activity we did see - credential stealing, lateral movement, keyloggers being deployed - and the types of machines targeted in some of the organizations - those involved in design and engineering.

The ability of the attacker to maintain a stealthy presence on the targeted networks for a number of months indicates they were skilled.
Click to expand...

Log in or Sign up

Hackers Target Critical Infrastructure in Southeast Asia

guest Guest

Log in or Sign up

Hackers Target Critical Infrastructure in Southeast Asia

guest Guest

Useful Searches