{"id":1576384,"date":"2022-06-17T09:34:04","date_gmt":"2022-06-17T13:34:04","guid":{"rendered":"https:\/\/platoaistream.com\/?post_type=station&p=1576384"},"modified":"2022-07-16T11:46:07","modified_gmt":"2022-07-16T15:46:07","slug":"china-linked-apt-flew-under-radar-for-decade","status":"publish","type":"station","link":"https:\/\/platoaistream.com\/plato-data\/china-linked-apt-flew-under-radar-for-decade\/","title":{"rendered":"China-linked APT Flew Under Radar for Decade"},"content":{"rendered":"
<\/div>\n
\n

Evidence suggests that a just-discovered APT has been active since 2013.<\/p>\n<\/p><\/div>\n

\n

Researchers have identified a small yet potent China-linked APT that has flown under the radar for nearly a decade running campaigns against government, education and telecommunication organizations in Southeast Asia and Australia.<\/p>\n

Researchers from SentinelLabs said<\/a> the APT, which they dubbed Aoqin Dragon, has been operating since at least 2013. The APT is \u201ca small Chinese-speaking team with potential association to [an APT called] UNC94,\u201d they reported.<\/p>\n

Researchers say one of the tactics and techniques of Aoqin Dragon include using pornographic themed malicious documents as bait to entice victims to download them.<\/p>\n

\u201cAoqin Dragon seeks initial access primarily through document exploits and the use of fake removable devices,\u201d researchers wrote.<\/p>\n

Aoqin Dragon\u2019s Evolving Stealth Tactics<\/strong><\/h2>\n

Part of what\u2019s helped Aoqin Dragon stay under the radar for so long is that they\u2019ve evolved. For example, the means the APT used to infect target computers has evolved.<\/p>\n

In their first few years of operation, Aoqin Dragon relied on exploiting old vulnerabilities \u2013 specifically, CVE-2012-0158 and CVE-2010-3333 \u2013 which their targets might not have yet patched.<\/p>\n

Later, Aoqin Dragon created executable files with desktop icons that made them appear to look like Windows folders or antivirus software. These programs were actually malicious droppers which planted backdoors and then established connections back to the attackers\u2019 command-and-control (C2) servers.<\/p>\n

Since 2018, the group has been utilizing a fake removable device as their infection vector. When a user clicks to open what seems to be a removable device folder, they in fact initiate a chain reaction which downloads a backdoor and C2 connection to their machine. Not only that, the malware copies itself to any actual removable devices connected to the host machine, in order to continue its spread beyond the host and, hopefully, into the target\u2019s broader network.<\/p>\n

The group has employed other techniques to stay off-the-radar. They\u2019ve used DNS tunneling \u2013 manipulating the internet\u2019s domain name system to sneak data past firewalls. One backdoor leverage \u2013 known as Mongall \u2013 encrypts communication data between host and C2 server. Over time, the researchers said, the APT began slowly working the fake removable disc technique. This was done to \u201d pgraded the malware to protect it from being detected and removed by security products.\u201d<\/p>\n

Nation-State Links<\/strong><\/h2>\n

Targets have tended to fall in just a few buckets \u2013 government, education and telecoms, all in and around Southeast Asia. Researchers assert \u201cthe targeting of Aoqin Dragon closely aligns with the Chinese government\u2019s political interests.\u201d<\/p>\n

Further evidence of China influence includes a debug log found by researchers that contains simplified Chinese characters.<\/p>\n

Most important of all, the researchers highlighted an overlapping attack on the president of Myanmar\u2019s website back in 2014. In that case, police traced the hackers\u2019 command-and-control and mail servers to Beijing. Aoqin Dragon\u2019s two primary backdoors \u201chave overlapping C2 infrastructure,\u201d with that case, \u201cand most of the C2 servers can be attributed to Chinese-speaking users.\u201d<\/p>\n

Still, \u201cproperly identifying and tracking State and State Sponsored threat actors can be challenging,\u201d Mike Parkin, senior technical engineer at Vulcan Cyber, wrote in a statement. \u201cSentinelOne releasing the information now on an APT group that has apparently been active for almost a decade, and doesn\u2019t appear in other lists, shows how hard it can be \u2018to be sure\u2019 when you\u2019re identifying a new threat actor.\u201d<\/p>\n<\/p><\/div>\n","protected":false},"author":1,"featured_media":1576385,"template":"","meta":{"_eb_attr":"","type":"","auto_type":false,"post":"","stream":"","stream_url":"","waveform_data":[],"duration":0,"start":0,"end":0,"bpm":0,"downloadable":false,"download_url":"","purchase_title":"","purchase_url":"","post-count-all":0,"like_count":0,"download_count":0,"editor_note":"","copyright":"","captions":[],"sources":[]},"genre":[10650],"station_tag":[3884,14557,15679,15663,7027,6174,4897,15662,5133,15665,4182,6535,5026,6464,9242,7457,14558,8453,15312,9642,14556,5367,4239,15675,14555],"artist":[15687],"mood":[],"activity":[],"_links":{"self":[{"href":"https:\/\/platoaistream.com\/wp-json\/wp\/v2\/station\/1576384"}],"collection":[{"href":"https:\/\/platoaistream.com\/wp-json\/wp\/v2\/station"}],"about":[{"href":"https:\/\/platoaistream.com\/wp-json\/wp\/v2\/types\/station"}],"author":[{"embeddable":true,"href":"https:\/\/platoaistream.com\/wp-json\/wp\/v2\/users\/1"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/platoaistream.com\/wp-json\/wp\/v2\/media\/1576385"}],"wp:attachment":[{"href":"https:\/\/platoaistream.com\/wp-json\/wp\/v2\/media?parent=1576384"}],"wp:term":[{"taxonomy":"genre","embeddable":true,"href":"https:\/\/platoaistream.com\/wp-json\/wp\/v2\/genre?post=1576384"},{"taxonomy":"station_tag","embeddable":true,"href":"https:\/\/platoaistream.com\/wp-json\/wp\/v2\/station_tag?post=1576384"},{"taxonomy":"artist","embeddable":true,"href":"https:\/\/platoaistream.com\/wp-json\/wp\/v2\/artist?post=1576384"},{"taxonomy":"mood","embeddable":true,"href":"https:\/\/platoaistream.com\/wp-json\/wp\/v2\/mood?post=1576384"},{"taxonomy":"activity","embeddable":true,"href":"https:\/\/platoaistream.com\/wp-json\/wp\/v2\/activity?post=1576384"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}