Virtual Event Today: Cyber AI & Automation Summit - Register/Login Now
Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cyberwarfare

Chinese Cyberspies Target National Data Center in Asia

A China-linked cyber espionage group has targeted a national data center in Central Asia and experts believe the goal is to conduct watering hole attacks on the country’s government websites.

A China-linked cyber espionage group has targeted a national data center in Central Asia and experts believe the goal is to conduct watering hole attacks on the country’s government websites.

The threat actor is tracked as LuckyMouse, Emissary Panda, APT27 and Threat Group 3390. The group has been active since at least 2010, targeting hundreds of organizations around the world, including U.S. defense contractors, financial services firms, a European drone maker, and the U.S.-based subsidiary of a French energy management company.

Researchers at Kaspersky Lab recently identified a new attack carried out by this actor. The security firm spotted the campaign in March 2018, but believes it was launched in the fall of 2017.Chinese hackers attack national data center in Central Asia

The attack targeted a national data center in an unnamed country in Central Asia. Researchers say the goal is likely to inject malicious JavaScript code into the government websites connected to the data center in order to conduct watering hole attacks.

When accessed, the compromised government websites served either the Browser Exploitation Framework (BeEF), a penetration testing suite that focuses on the web browser, or the ScanBox reconnaissance framework.

Kaspersky has not been able to determine how the national data center was breached, but believes the hackers may have used watering hole attacks aimed at the organization’s employees or through weaponized Office documents – the threat group has been spotted using CVE-2017-11882.

The attack involved a piece of malware tracked by Kaspersky as HyperBro, a RAT that has been used by several Chinese-speaking threat actors. The samples analyzed by Kaspersky had timestamps ranging from December 2017 to January 2018, with evidence found by experts suggesting that the malware had made its way to the data center sometime in mid-November 2017.

The main command and control (C&C) server used in this campaign is hosted on an IP address associated with a Ukrainian ISP. Specifically, the IP belongs to a MikroTik router running a firmware version released in March 2016.

“A national data center is a valuable source of data that can also be abused to compromise official websites,” Kaspersky researchers said in a blog post. “Another interesting point is the Mikrotik router, which we believe was hacked specifically for the campaign. The reasons for this are not very clear: typically, Chinese-speaking actors don’t bother disguising their campaigns. Maybe these are the first steps in a new stealthier approach.”

Advertisement. Scroll to continue reading.

Related: China-Linked Spies Used New Malware in U.K. Government Attack

Related: Researchers Link Several State-Sponsored Chinese Spy Groups

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join us as we delve into the transformative potential of AI, predictive ChatGPT-like tools and automation to detect and defend against cyberattacks.

Register

As cybersecurity breaches and incidents escalate, the cyber insurance ecosystem is undergoing rapid and transformational change.

Register

Expert Insights

Related Content

Cybercrime

The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Cybercrime

A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Cyberwarfare

WASHINGTON - Cyberattacks are the most serious threat facing the United States, even more so than terrorism, according to American defense experts. Almost half...

Cybercrime

Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.

Cyberwarfare

Russian espionage group Nomadic Octopus infiltrated a Tajikistani telecoms provider to spy on 18 entities, including government officials and public service infrastructures.

Malware & Threats

The NSA and FBI warn that a Chinese state-sponsored APT called BlackTech is hacking into network edge devices and using firmware implants to silently...

Cyberwarfare

Several hacker groups have joined in on the Israel-Hamas war that started over the weekend after the militant group launched a major attack.

Cybercrime

On the first anniversary of Russia’s invasion of Ukraine, cybersecurity companies summarize the cyber operations they have seen and their impact.