Connect with us

Hi, what are you looking for?



Chinese Cyberspies Target National Data Center in Asia

A China-linked cyber espionage group has targeted a national data center in Central Asia and experts believe the goal is to conduct watering hole attacks on the country’s government websites.

A China-linked cyber espionage group has targeted a national data center in Central Asia and experts believe the goal is to conduct watering hole attacks on the country’s government websites.

The threat actor is tracked as LuckyMouse, Emissary Panda, APT27 and Threat Group 3390. The group has been active since at least 2010, targeting hundreds of organizations around the world, including U.S. defense contractors, financial services firms, a European drone maker, and the U.S.-based subsidiary of a French energy management company.

Researchers at Kaspersky Lab recently identified a new attack carried out by this actor. The security firm spotted the campaign in March 2018, but believes it was launched in the fall of 2017.Chinese hackers attack national data center in Central Asia

The attack targeted a national data center in an unnamed country in Central Asia. Researchers say the goal is likely to inject malicious JavaScript code into the government websites connected to the data center in order to conduct watering hole attacks.

When accessed, the compromised government websites served either the Browser Exploitation Framework (BeEF), a penetration testing suite that focuses on the web browser, or the ScanBox reconnaissance framework.

Kaspersky has not been able to determine how the national data center was breached, but believes the hackers may have used watering hole attacks aimed at the organization’s employees or through weaponized Office documents – the threat group has been spotted using CVE-2017-11882.

The attack involved a piece of malware tracked by Kaspersky as HyperBro, a RAT that has been used by several Chinese-speaking threat actors. The samples analyzed by Kaspersky had timestamps ranging from December 2017 to January 2018, with evidence found by experts suggesting that the malware had made its way to the data center sometime in mid-November 2017.

The main command and control (C&C) server used in this campaign is hosted on an IP address associated with a Ukrainian ISP. Specifically, the IP belongs to a MikroTik router running a firmware version released in March 2016.

Advertisement. Scroll to continue reading.

“A national data center is a valuable source of data that can also be abused to compromise official websites,” Kaspersky researchers said in a blog post. “Another interesting point is the Mikrotik router, which we believe was hacked specifically for the campaign. The reasons for this are not very clear: typically, Chinese-speaking actors don’t bother disguising their campaigns. Maybe these are the first steps in a new stealthier approach.”

Related: China-Linked Spies Used New Malware in U.K. Government Attack

Related: Researchers Link Several State-Sponsored Chinese Spy Groups

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

SecurityWeek’s Threat Detection and Incident Response Summit brings together security practitioners from around the world to share war stories on breaches, APT attacks and threat intelligence.


Securityweek’s CISO Forum will address issues and challenges that are top of mind for today’s security leaders and what the future looks like as chief defenders of the enterprise.


Expert Insights

Related Content


WASHINGTON - Cyberattacks are the most serious threat facing the United States, even more so than terrorism, according to American defense experts. Almost half...


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...


No one combatting cybercrime knows everything, but everyone in the battle has some intelligence to contribute to the larger knowledge base.


Websites of German airports, administration bodies and banks were hit by DDoS attacks attributed to Russian hacker group Killnet

Malware & Threats

Threat actors are increasingly abusing Microsoft OneNote documents to deliver malware in both targeted and spray-and-pray campaigns.


The war in Ukraine is the first major conflagration between two technologically advanced powers in the age of cyber. It prompts us to question...

Application Security

Fortinet on Monday issued an emergency patch to cover a severe vulnerability in its FortiOS SSL-VPN product, warning that hackers have already exploited the...