Suspected Chinese hackers aim attacks at Vietnamese government officials

guest · May 1, 2020

These tiny islands are at the heart of an uncovered Chinese phishing campaign
April 30, 2020
https://www.cyberscoop.com/south-china-sea-maritime-hacking-vietnam/

Suspected Chinese hackers are behind a phishing campaign apparently aimed at collecting data about Vietnamese government officials amid an ongoing territorial dispute between the two nations, according to new findings.

A hacking group known as Pirate Panda, which has possible ties to the Chinese government, is trying to trick Vietnamese government officials into clicking on malicious Microsoft Excel documents attached to emails purportedly detailing festivities for Vietnamese holidays, according to research the threat intelligence firm Anomali shared with CyberScoop.
Targeted individuals appear to be located in Da Nang, Vietnam, near a collection of landmasses in the South China Sea known as the Paracel Islands.

In this case, Pirate Panda appears to be using email lures which include itineraries for two Vietnamese holidays, Reunification Day and Labor Day, scheduled for April 30 and May 1, respectively.
Click to expand...

Technical evidence also suggests the intended victims work in a Vietnamese government data center in Da Nang, based on the contents of the malicious files shared through the email campaign.
Pirate Panda has seized on major news events in recent months to try to target victims.

In recent days, FireEye exposed some suspected Vietnamese government-linked hacking campaigns targeting Chinese government entities in search of information on the coronavirus response in China. Whether that attack is linked to the Pirate Panda operation in any way remains unclear.
Click to expand...

Anomali: Anomali Suspects that China-Backed APT Pirate Panda May Be Seeking Access to Vietnam Government Data Center

The attacker is employing a DLL Side-Loading technique using a legitimate security product to load a malicious dll [8]. This is a common technique for a variety of threat actors and groups. A shortcut for utilman.exe is then created at the startup folder so that the dropped files execute during the next reboot of the machine and communicate with a command and control (C2).

The dropped executable mpsvc.dll, although containing a large quantity of unique code, was genetically similar to exile-RAT and keyboy; both are RATs Pirate Panda deploys.
[...]
The phishing email and the lure document suggest that the attack was crafted to target government employees working at a data centre, which is consistent with previous data center targeting by other campaigns attributed to APTs [9].
Click to expand...

Log in or Sign up

Suspected Chinese hackers aim attacks at Vietnamese government officials

guest Guest

Log in or Sign up

Suspected Chinese hackers aim attacks at Vietnamese government officials

guest Guest

Useful Searches