Specialists Recognize 3 Chinese-Associated Clusters Behind Cyberbreaches in Southeast Asia
An ensemble of threat activity clusters associated with China has been noticed compromising additional government organizations in Southeast Asia as part of an upgraded state-sponsored initiative named Crimson Palace, showing an extension in the extent of the espionage campaign.
Cybersecurity company Sophos, which has been overseeing the cyber onslaught, mentioned that it comprises three intrusion sets identified as Cluster Alpha (STAC1248), Cluster Bravo (STAC1870), and Cluster Charlie (STAC1305). STAC is an acronym for “security threat activity cluster.”
“The perpetrators consistently relied on other compromised organizational and public service networks in that region to disseminate malware and tools under the guise of a credible access point,” security professionals Mark Parsons, Morgan Demboski, and Sean Gallagher expressed in a technical dossier shared with The Hacker News.
One notable aspect of the incursions is that it encompasses the utilization of an unspecified organization’s systems as a command-and-control (C2) relay station and a preparation area for tools. A different organization’s compromised Microsoft Exchange Server is purported to have been leveraged to host malware.
Crimson Palace was initially recorded by the cybersecurity firm in early June 2024, with the incursions occurring between March 2023 and April 2024.
Even though the initial activity tied to Cluster Bravo, which intersects with a threat faction identified as Unfading Sea Haze, was limited to March 2023, a new wave of attacks observed between January and June 2024 has been noted targeting 11 additional organizations and agencies in the same geographical area.
A series of new attacks masterminded by Cluster Charlie, a cluster known as Earth Longzhi, has also been discovered between September 2023 and June 2024, some of which also involve the implementation of the C2 frameworks like Cobalt Strike, Havoc, and XieBroC2 to facilitate post-exploitation and deliver additional payloads like SharpHound for Active Directory infrastructure mapping.
“Exfiltration of data of intelligence value remained a goal after the revival of activity,” the researchers stated. “Nonetheless, much of their focus seemed to be on re-establishing and expanding their presence on the target network by circumventing EDR software and swiftly regaining access when their C2 implants were hindered.”
Another significant element is Cluster Charlie’s heavy dependence on DLL hijacking to run malware, a technique previously employed by threat actors associated with Cluster Alpha, suggesting a “cross-pollination” of strategies.
Some of the other open-source applications used by the threat actor encompass RealBlindingEDR and Alcatraz, allowing for the termination of antivirus processes and the obfuscation of portable executable files (e.g., .exe, .dll, and .sys) with the goal of remaining undetected.
To complete the cluster’s malware collection is a formerly undisclosed keylogger named TattleTale, discovered in August 2023, capable of gathering Google Chrome and Microsoft Edge browser data.
“The malware can identify the compromised system and inspect for mounted physical and network drives by impersonating a logged-on user,” the researchers elucidated.
“TattleTale also gathers the domain controller name and pilfers the LSA (Local Security Authority) Query Information Policy, which is known to contain sensitive information related to password policies, security settings, and occasionally cached passwords.”
In brief, the three clusters collaborate, while concurrently specializing in particular roles in the attack sequence: infiltrating target environments and executing reconnaissance (Alpha), delving deep into the networks using various C2 methodologies (Bravo), and extracting valuable data (Charlie).
“Throughout the engagement, the adversary appeared to continually test and refine their techniques, tools, and practices,” the researchers concluded. “As we deployed countermeasures for their bespoke malware, they combined the use of their custom-developed tools with generic, open-source tools often used by legitimate penetration testers, testing different combinations.”
About Author
