Connect with us

Hi, what are you looking for?



Industrial Organizations in Eastern Europe Targeted by Chinese Cyberspies

The China-linked cyberspy group APT31 is believed to be behind a data-theft campaign targeting industrial organizations in Eastern Europe.

A China-linked cyberspy group appears to be behind a campaign targeting industrial organizations in Eastern Europe, cybersecurity firm Kaspersky reported last week.

The attacks have been linked to APT31, a group believed to be sponsored by the Chinese government that is also known as Zirconium, Judgement Panda, Bronze Vinewood and Red Keres. The threat actor has focused on operations whose goal is to steal valuable intellectual property from victims. 

While the targets of the campaign analyzed by Kaspersky were industrial organizations, the company told SecurityWeek there is no indication that the hackers targeted industrial control systems (ICS).

“We do not have any evidence that the attackers could have anything in addition to data theft as their goal in this campaign,” Kaspersky said. 

The attacks were observed in 2022 and the cybersecurity firm recently concluded its investigation into the campaign. 

The hackers attempted to establish permanent channels for data exfiltration, including for information stored on air-gapped systems, which they targeted through malware-infected removable drives.

The attackers used improved variants of a previously known malware named FourteenHi, which enables the attackers to upload or download files, run commands, and initialize a reverse shell.

Advertisement. Scroll to continue reading.

The new variants were designed to specifically target the infrastructure of industrial organizations.

In addition, the cyberspies leveraged a new malware implant dubbed MeatBall, which provides extensive remote access capabilities. 

The attackers exploited DLL hijacking vulnerabilities affecting legitimate applications to load some of their malware. 

“To exfiltrate data and deliver next-stage malware, the threat actor (or actors) abuse(s) a cloud-based data storage, e.g., Dropbox or Yandex Disk, as well as a service used for temporary file sharing. They also use C2 deployed on regular virtual private servers (VPS),” Kaspersky explained.

The cybersecurity firm’s report includes technical details on these attacks, including indicators of compromise (IoCs) and tactics, techniques, and procedures (TTPs). 

Related: Chinese Cyberspy Group APT31 Starts Targeting Russia

Related: EU Organizations Warned of Chinese APT Attacks

Related: China-Linked APT15 Targets Foreign Ministries With ‘Graphican’ Backdoor

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join security experts as they discuss ZTNA’s untapped potential to both reduce cyber risk and empower the business.


Join Microsoft and Finite State for a webinar that will introduce a new strategy for securing the software supply chain.


Expert Insights

Related Content


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.


As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...


Luxury retailer Neiman Marcus Group informed some customers last week that their online accounts had been breached by hackers.


Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.


Satellite TV giant Dish Network confirmed that a recent outage was the result of a cyberattack and admitted that data was stolen.

Artificial Intelligence

The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.


A new study by McAfee and the Center for Strategic and International Studies (CSIS) named a staggering figure as the true annual cost of...