A recent cyberespionage operation aimed at industrial enterprises and public institutions in Eastern Europe and Afghanistan has been linked to a threat actor that is likely sponsored by the Chinese government.
The campaign, detailed on Monday by Kaspersky, is believed to be the work of TA428, a group that has been tracked by cybersecurity companies since at least 2019. TA428 activities and the malware used by the group were previously detailed by Recorded Future, Group-IB, Proofpoint, Cybereason, Dr.Web, and NTT Security. The group is also known as Colourful Panda and Bronze Dudley.
Some of TA428’s more recent attacks, ones disclosed in 2021, focused on Russia, targeting government and military organizations. The attacks analyzed by Kaspersky’s ICS CERT unit were first seen in January 2022 and they are likely an extension of that campaign.
The attacks seen by Kaspersky were aimed at more than a dozen organizations in Russia, Ukraine, Belarus and Afghanistan. Victims included military industrial complex enterprises and public institutions. Specifically, the attacks were aimed at industrial plants, design bureaus, research institutes, and various types of government organizations.
According to Kaspersky, six different backdoor malware families were used in the attacks, most of which were previously linked to TA428. This includes threats known as PortDoor, nccTrojan, Cotx, DNSep, and Logtu. The cybersecurity firm also spotted what appears to be a new piece of malware, which it has named CotSam due to similarities with Cotx.
The malware is delivered using phishing emails that carry Word documents designed to exploit an older vulnerability for arbitrary code execution.
The attackers have been observed searching for sensitive data on compromised systems and exfiltrating it, which has led researchers to believe that the likely goal is espionage.
Kaspersky also pointed out that in at least one case, the attacker managed to gain access to a server hosting a system that controls cybersecurity solutions. This allowed them to modify settings for the endpoint security solutions used by the victim organization. In addition, the hackers have been seen using DLL hijacking and process hollowing in an effort to protect their malware from security software.
Similar to other cybersecurity companies, Kaspersky believes it’s very likely that the hackers are Chinese. They are using hacking tools that are popular in China, they are leveraging Chinese services, and their work hours match the typical workday in China.
“The attack series that we have discovered is not the first in the campaign and, given that the attackers achieve a certain degree of success, we believe it is highly likely that they will continue to conduct similar attacks in the future. Industrial enterprises and public institutions should take extensive measures to repel such attacks successfully,” Kaspersky said.
Related: ICS Vendors Targeted in Espionage Campaign Focusing on Renewable Energy
Related: Mac Malware Used in Attacks Targeting Industrial Organizations in Middle East
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Intel Boasts Attack Surface Reduction With New 13th Gen Core vPro Platform
- Dole Says Employee Information Compromised in Ransomware Attack
- High-Severity Vulnerabilities Found in WellinTech Industrial Data Historian
- CISA Expands Cybersecurity Committee, Updates Baseline Security Goals
- Exploitation of 55 Zero-Day Vulnerabilities Came to Light in 2022: Mandiant
- Organizations Notified of Remotely Exploitable Vulnerabilities in Aveva HMI, SCADA Products
- Waterfall Security, TXOne Networks Launch New OT Security Appliances
- Hitachi Energy Blames Data Breach on Zero-Day as Ransomware Gang Threatens Firm
Latest News
- Intel Co-founder, Philanthropist Gordon Moore Dies at 94
- Google Leads $16 Million Investment in Dope.security
- US Charges 20-Year-Old Head of Hacker Site BreachForums
- Tesla Hacked Twice at Pwn2Own Exploit Contest
- CISA Ships ‘Untitled Goose Tool’ to Hunt for Microsoft Azure Cloud Infections
- Critical WooCommerce Payments Vulnerability Leads to Site Takeover
- PoC Exploit Published for Just-Patched Veeam Data Backup Solution Flaw
- CISA Gets Proactive With New Pre-Ransomware Alerts
