Authorities Identify 3 Chinese-Associated Clusters Behind Cyberassaults in Southeast Asia
A triumvirate of menace activity clusters associated with China has been witnessed infiltrating additional government organizations in Southeast Asia as part of an enhanced state-backed operation named Crimson Palace, presenting an extension in the breadth of the intelligence gathering endeavor.
Cybersecurity establishment Sophos, which has been overseeing the cyber onslaught, mentioned that it consists of three intrusion sets recognized as Cluster Alpha (STAC1248), Cluster Bravo (STAC1870), and Cluster Charlie (STAC1305). STAC is an acronym for “security threat activity cluster.”
“The perpetrators consistently utilized other compromised organizational and public service networks in that vicinity to distribute malicious software and tools under the façade of a trusted entry point,” security experts Mark Parsons, Morgan Demboski, and Sean Gallagher mentioned in a technical document shared with The Hacker News.
An important feature of the attacks is the utilization of an undisclosed organization’s systems as a command-and-control (C2) relay station and a preparation site for tools. A second organization’s compromised Microsoft Exchange Server is reported to have been employed to host malicious software.
Crimson Palace was initially documented by the cybersecurity firm in early June 2024, with the assaults occurring between March 2023 and April 2024.
Even though the initial activity connected with Cluster Bravo, which coincides with a threat unit named Unfading Sea Haze, was concentrated in March 2023, a recent wave of attacks detected between January and June 2024 has been pinpointed targeting 11 other organizations and agencies in the same vicinity.
A series of fresh attacks orchestrated by Cluster Charlie, a cluster identified as Earth Longzhi, has also been unearthed between September 2023 and June 2024, some of which also involve the deployment of the C2 frameworks like Cobalt Strike, Havoc, and XieBroC2 with the intention of facilitating post-exploitation and delivering additional payloads like SharpHound for Active Directory infrastructure mapping.
“Stealing data of intelligence worth remained a target post the restart of activity,” the researchers articulated. “Nevertheless, a substantial portion of their endeavor appeared to be geared toward re-establishing and extending their foothold on the target network by circumventing EDR software and swiftly regaining access when their C2 implants had been obstructed.”
Another material aspect is Cluster Charlie’s heavy dependence on DLL hijacking to execute malicious software, an approach previously embraced by threat operators behind Cluster Alpha, suggesting a “cross-pollination” of strategies.
Some of the other publicly available programs utilized by the threat actor include RealBlindingEDR and Alcatraz, which enable terminating antivirus processes and concealing portable executable files (e.g., .exe, .dll, and .sys) with the goal of evading detection.
Completing the cluster’s inventory of malicious software is a formerly unidentified keylogger named TattleTale that was initially detected in August 2023 and has the ability to gather Google Chrome and Microsoft Edge browser information.
“The malware has the ability to identify the compromised system and inspect for mounted physical and network drives by imitating a logged-on user,” the researchers elucidated.
“TattleTale also captures the domain controller name and pilfers the LSA (Local Security Authority) Query Information Policy, which is recognized to contain sensitive details associated with password policies, security configurations, and sometimes cached passwords.”
To recap, the three clusters collaborate, while simultaneously concentrating on specific duties in the assault progression: infiltrating target environments and conducting reconnaissance (Alpha), navigating deep into the networks using various C2 mechanisms (Bravo), and extracting valuable information (Charlie).
“Throughout the operation, the adversary seemed to continuously experiment and refine their methods, tools, and methodologies,” the researchers concluded. “As we implemented countermeasures for their customized malicious software, they fused the usage of their custom-developed tools with generic, open-source tools commonly utilized by legitimate penetration testers, experimenting with different combinations.”
About Author
