{"id":25195,"date":"2024-09-12T11:22:08","date_gmt":"2024-09-12T19:22:08","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2024\/09\/12\/news-18925\/"},"modified":"2024-09-12T11:22:08","modified_gmt":"2024-09-12T19:22:08","slug":"news-18925","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2024\/09\/12\/news-18925\/","title":{"rendered":"Crimson Palace returns: New Tools, Tactics, and Targets\u00a0"},"content":{"rendered":"

Credit to Author: gallagherseanm| Date: Tue, 10 Sep 2024 10:00:54 +0000<\/strong><\/p>\n

\n

\u00a0<\/span>After a brief break in activity, Sophos X-Ops continues to observe and respond to what we assess with high confidence as a Chinese state-directed cyberespionage operation targeting a prominent agency within the government of a Southeast Asian nation.\u00a0<\/span>\u00a0<\/span><\/p>\n

In the process of investigating that activity, which we track as Operation Crimson Palace, Sophos Managed Detection and Response (MDR) found telemetry indicating the compromise of additional<\/span> government organizations in the region, and has detected related activity from these existing threat clusters in other organizations in the same region. The attackers consistently used other compromised organizational and public service networks in that region to deliver malware and tools under the guise of a trusted access point.<\/span>\u00a0<\/span><\/p>\n

Our previous report<\/a> covered activity from three associated security threat activity clusters (STACs) connected to the cyberespionage activity: Cluster Alpha (STAC1248), Cluster Bravo (STAC1870), and Cluster Charlie (STAC1305), all seen between March and August 2023. All three threat clusters operating inside the estate of the targeted agency went dormant in August 2023. <\/span>\u00a0<\/span><\/p>\n

However, Cluster Charlie resumed activity several weeks later. This activity, which included a previously undocumented keylogger which we have named “TattleTale,\u201d marked the beginning of a second phase and expansion of the intrusion activity throughout the region, which remains ongoing.\u00a0<\/span>\u00a0<\/span><\/p>\n

Sophos MDR also observed a series of detections that align with the tooling used by Cluster Bravo at entities outside the government agency covered in our initial report, including two non-governmental public service organizations and multiple additional organizations, all based in the same region. Those detections included telemetry that showed the use of one organization’s\u00a0 systems as a C2 relay point and a staging ground for tools, as well as the staging of malware on another organization’s compromised Microsoft Exchange server.\u00a0\u00a0<\/span>\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\"\u00a0Figure<\/a>
Figure 1. The three security threat activity clusters observed during the initial phase of Operation Crimson Palace and their overlap with previously reported threat actors and with each other, March-August 2023<\/em><\/figcaption><\/figure>\n

Cluster Bravo, expanded<\/span>\u00a0<\/span><\/h2>\n

While Cluster Bravo was only briefly active on the network of the organization covered in our first report, Sophos X-Ops subsequently detected activity associated with Cluster Bravo on the networks of at least 11 other organizations and agencies in the same region. In addition, Sophos identified multiple organizations whose infrastructure was used for malware staging including one government agency. The threat actors were precise in how they leveraged these compromised environments for hosting, making sure to always use an infected organization within the same vertical for their attacks.<\/span>\u00a0<\/span><\/p>\n

This new activity spanned from January to June of 2024, and included two private organizations with government-related roles.\u00a0 The affected organizations represent a broad swath of the targeted government’s critical functions.<\/span>\u00a0<\/span><\/p>\n

Cluster Charlie, renewed<\/span>\u00a0<\/span><\/h2>\n

Cluster Charlie went quiet in August 2023 after Sophos blocked <\/span>its custom C2 implants (PocoProxy)<\/span><\/a>. However, the actors behind the intrusion eventually returned with new techniques at the end of September.\u00a0<\/span>\u00a0<\/span><\/p>\n

This began with attempts to evade blocks by switching to different C2 channels, and with the Cluster Charlie actor varying how it deploys implants.\u00a0 These changes included, as we noted in our previous report, using a custom malware loader called <\/span>HUI loader<\/span><\/a> (identified by Sentinel Labs) to inject a Cobalt Strike beacon into the Remote Desktop utility mstsc.exe.\u00a0<\/span>\u00a0<\/span><\/p>\n

However, in September, the attackers behind Cluster Charlie modified their activities again in several ways:<\/span>\u00a0<\/span><\/p>\n