Summary:
Earlier this year, a large U.S. organization with operations in China experienced a targeted cyberattack attributed to China-based threat actors, likely for intelligence gathering. The attackers maintained a presence in the network from April to August 2024, using lateral movement to compromise multiple systems, including Exchange Servers, for email harvesting. Exfiltration tools were also deployed, indicating the theft of sensitive data. The attackers leveraged various tools and techniques, such as DLL sideloading with legitimate applications to execute malicious payloads. They also used open-source tools like Impacket, FileZilla, and PSCP, along with "living-off-the-land" methods such as WMI, PowerShell, and PsExec, to execute commands, move laterally, and exfiltrate data. Malicious activity included credential dumping, querying Active Directory via Kerberoasting, and targeting Exchange Servers for email data.


Security Officer Comments:
Suspicious activities were observed on multiple machines. These included executing PowerShell scripts for reconnaissance and downloading malicious files, using renamed legitimate applications for DLL sideloading, and exfiltrating data via tools like WinRAR and PSCP. Commands targeting Windows Event Logs, Active Directory, and system configurations were also employed. Connections to known China-based groups like Daggerfly and Crimson Palace were suggested by the use of previously identified tools and techniques.


Suggested Corrections:

IOCs:
https://www.security.com/threat-intelligence/china-southeast-asia-espionage


Organizations can make APT groups’ lives more difficult. Here’s how: