{"id":24625,"date":"2024-06-05T03:21:03","date_gmt":"2024-06-05T11:21:03","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2024\/06\/05\/news-18355\/"},"modified":"2024-06-05T03:21:03","modified_gmt":"2024-06-05T11:21:03","slug":"news-18355","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2024\/06\/05\/news-18355\/","title":{"rendered":"Operation Crimson Palace: Sophos threat hunting unveils multiple clusters of Chinese state-sponsored activity targeting Southeast Asian government"},"content":{"rendered":"

Credit to Author: gallagherseanm| Date: Wed, 05 Jun 2024 10:00:34 +0000<\/strong><\/p>\n

\n

In May 2023, in a threat hunt across Sophos Managed Detection and Response telemetry, Sophos MDR\u2019s Mark Parsons uncovered a complex, long-running Chinese state-sponsored cyberespionage operation we have dubbed \u201cCrimson Palace\u201d targeting a high-profile government organization in Southeast Asia.<\/p>\n

MDR launched the hunt after the discovery of a DLL sideloading technique that exploited VMNat.exe, a VMware component. In the investigation that followed, we tracked at least three clusters of intrusion activity from March 2023 to December 2023. The hunt also uncovered previously unreported malware associated with the threat clusters, as well as a new, improved variant of the previously-reported EAGERBEE<\/a> malware. In line with our standard internal nomenclature, Sophos tracks these clusters as Cluster Alpha (STAC1248), Cluster Bravo (STAC1807), and Cluster Charlie (STAC1305).<\/p>\n

While our visibility into the targeted network was limited due to the extent to which Sophos endpoint protection had been deployed within the organization, our investigations also found evidence of related earlier intrusion activity dating back to early 2022. This led us to suspect the threat actors had long-standing access to unmanaged assets within the network.<\/p>\n

The clusters \u00a0were observed using tools and infrastructure that overlap with other researchers\u2019 public reporting on Chinese threat actors \u00a0BackdoorDiplomacy<\/a>, REF5961<\/a>, Worok<\/a>, TA428<\/a>, the recently-designated Unfading Sea Haze<\/a> and the APT41 subgroup Earth Longzhi<\/a>. Additionally, Sophos MDR has observed the actors attempting to collect documents with file names that indicate they are of intelligence value, including military documents related to strategies in the South China Sea.<\/p>\n

Based on our investigation, Sophos asserts with high confidence the overall goal behind the campaign was to maintain access to the target network for cyberespionage in support of Chinese state interests. This includes accessing critical IT systems, performing reconnaissance of specific users, collecting sensitive military and technical information, and deploying various malware implants for command-and control (C2) communications. We have moderate confidence that these activity clusters were part of a coordinated campaign under the direction of a single organization. Sophos is sharing indicators and context for the Crimson Palace campaign in hopes of contributing to further public research and helping other defenders and analysts disrupt related activity.<\/p>\n

\"\"<\/a>
Figure 1. Venn diagram showing distinction and overlap of the three security threat clusters uncovered during the Crimson Palace investigation, including connections to previously known threat actor groups.<\/figcaption><\/figure>\n

Sophos has repeatedly shared the details of the intrusion with authorized contacts for the targeted organization. Sophos MDR continues to closely monitor this environment to report the scope and scale of the ongoing activity to the victim organization, as well as collect intelligence to track attack tactics and generate updated detections for all Sophos customers. Sophos has also shared intelligence from this campaign with government and industry partners, including Elastic Security<\/a> and Trend Micro<\/a> who have previously reported on similar threats.<\/p>\n

Key findings of our investigation included:<\/p>\n