An advanced persistent threat actor likely operating on behalf of the Chinese government has compromised dozens of foreign government entities worldwide, Trend Micro reports.
Referred to as Earth Krahang, the hacking group appears linked to Earth Lusca, which is believed to be a penetration team within the Chinese company I-Soon.
Leaked documents recently showed that I-Soon is a private contractor linked to the Ministry of Public Security, China's top policing agency.
Earth Krahang, Trend Micro says, is focused on cyberespionage, and is believed to have compromised at least 70 organizations across 23 different countries, mainly in Asia and America, but also in Europe and Africa.
The APT has targeted at least 100 other entities across 35 countries as well.
Earth Krahang, Trend Micro says, was seen compromising government infrastructure to host malicious payloads, proxy traffic, and send spear-phishing emails targeting other governmental entities.
The threat actor would also build VPNs on compromised public-facing servers to access the victims' networks and harvest email credentials using brute-force attacks.
According to Trend Micro, operational errors allowed it to tap into the APT's servers and retrieve malware samples and configuration and log files.
The group was seen employing open source tools to scan victims' web-facing servers, brute-forcing directories to collect sensitive information, and exploiting command execution vulnerabilities in OpenFire and Oracle Web Applications Desktop Integrator.
Earth Krahang would send spear-phishing emails containing attachments or embedded URLs leading to malware execution.
In one instance, a compromised government email account was used to send a malicious attachment to roughly 800 accounts belonging to the same organization.
Following initial access, the APT would deploy the SoftEther VPN to connect to the victim environment, would use task scheduling to obtain persistence, enable remote desktop connections, scan the network, extract credentials from memory dumps, move laterally, and escalate privileges.
To maintain access to the victim's systems, the threat actor would deploy Cobalt Strike, as well as two custom backdoors named Reshell and XDealer.
In some instances, Earth Krahang also deployed PlugX and ShadowPad variants on victim's systems.
Trend Micro's investigation into Earth Krahang revealed links to other Chinese threat actors, including a strong connection to Earth Lusca, due to overlaps in infrastructure and the preference of initial stage backdoors.
This Cyber News was published on www.securityweek.com. Publication date: Tue, 19 Mar 2024 14:13:05 +0000