Chinese Attacks On Russian Government Agencies 

Cyber security researchers have uncovered an apparently new Advanced Persistent Threat (APT) group  targeting Russian government entities, known as CloudSorcerer. 

They use a sophisticated cyber espionage tool, discovered by Kaspersky and reported is an advisory they published,  in June, is designed for covert data collection and exfiltration, using Microsoft Graph, Yandex Cloud and Dropbox for its command and control (C2) infrastructure. 

In late July 2024, a series of targeted cyber attacks on dozens of computers at Russian government organisations and IT companies was detected. This campaign was described in detail by Kaspersky, who named  it EastWind. 

The threat actors infected devices using phishing emails with malicious shortcut attachments. These shortcuts were used to deliver malware that received commands via the Dropbox cloud service. Attackers used this malware to download additional payloads onto infected computers, in particular tools previously that have been used before by the Chinese APT31 group.

Interesting features about the implants used in this campaign:-

 

  • The malware downloaded by the attackers from Dropbox has been used by APT31 since at least 2021. 
  • The attackers updated the The CloudSorcerer backdoor and it currently uses LiveJournal (a social network popular in Russia) and Quora profiles as initial C2 servers.
  • The attacks additionally deploy a previously unknown implant with a classic backdoor functionality. It is loaded via the CloudSorcerer backdoor, and its command set is quite extensive. It supports three different protocols for communicating with C2.

The attackers used spear phishing to gain an initial foothold into the organisations and they sent malicious emails with attached RAR archives to target organisational email addresses. After running the tool, the attackers downloaded the following files to the infected machine:-

  • A file with the .ini extension, containing the encrypted payload. The name of this file varied across infected machines.
  • The renamed legitimate application dbgsrv.exe (example name: WinDRMs.exe), signed by Microsoft.
  • The malicious library dll.

The implants identified during the attack significantly differ from each other and, because of this complicating feature, experts advise that it is necessary to use a separate set of Indicators of Compromise (IoCs) to identify each malware used in any compromise.

In attacks on government organisations, threat actors often use toolkits that implement a wide variety of techniques and tactics. In developing these tools, they go to the greatest lengths possible to hide malicious activity in network traffic. The attackers behind the EastWind campaign used popular network services (GitHub, Dropbox, Quora, LiveJournal and Yandex.Disk) as C2 servers. 

Notably, the EastWind campaign bore traces of malware from two different Chinese-speaking groups: APT27 and APT31.

This clearly shows that APT groups very often team up, actively sharing knowledge and tools. To successfully counter such collaborations, there are now monitors of the techniques and tactics of APT groups operating around the world.

Kaspersky   |   Fortinet   |    Securelist   |    Reuters   |   Profero.io  |   Industrial Cyber   |   Infosecurity-magazine    | 

Hacker News

Image: Ideogram

You Might Also Read: 

Chinese Hackers Have A Global Impact:


If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Predictions For The Fourth Industrial Revolution [extract]
China & Russia In Technology Collaboration »

CyberSecurity Jobsite
Check Point

Directory of Suppliers

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

National Cyber Security Directorate (DNSC) - Romania

National Cyber Security Directorate (DNSC) - Romania

DNSC (formerly CERT-RO) is the Romanian national cyber security and incident response team.

Logic Supply

Logic Supply

Logic Supply is a global industrial PC company focused on hardware for the IoT edge. We design highly-configurable computers engineered for reliability.

Stratus Cyber

Stratus Cyber

Stratus Cyber is a premier Cyber Security company specializing in Managed Security Services. Our services include Blockchain Security, Pentesting, and Compliance Assessments.

Alpine Security

Alpine Security

Alpine Security provides penetration testing, security assessments and cybersecurity training services.

FraudWatch International

FraudWatch International

FraudWatch has been protecting client brands around the world since 2003, and are the leaders in online brand protection from phishing, malware, social media and mobile apps impersonation.

Take Five

Take Five

Take Five is a national campaign offering straight-forward, impartial advice that helps prevent email, phone-based and online fraud – particularly where criminals impersonate trusted organisations.

PhishFirewall

PhishFirewall

PhishFirewall is an advanced AI-driven CyberSecurity Awareness Education, Threat Emulation, and Human Security Analytics Platform.

SignalFire

SignalFire

SignalFire invest across both enterprise and consumer sectors at the seed and early growth stages.

Censinet

Censinet

Censinet provides the first and only third-party risk management platform for healthcare organizations to manage the threats to patient care that exist within an expanding ecosystem.

Cognisys Group

Cognisys Group

Cognisys provides cyber security penetration testing and compliance services from its offices in Leeds and Manchester.

Collabera Digital

Collabera Digital

Collabera Digital engineer the next generation of solutions that power tech-forward organizations and create an impact on people and communities.

Mindsprint

Mindsprint

Mindsprint (formerly Olam Technology and Business Services - OTBS) are a leading edge technology and business services firm.

CaseMatrix

CaseMatrix

Discover a new era of legal intelligence with CaseMatrix. We identify potential class action cases arising from cyber incidents and data breaches.

RunReveal

RunReveal

RunReveal's mission is to make sure no breach goes undetected. That means having a product that is accessible and effective for companies of all sizes.

StackGen

StackGen

StackGen (formerly appCD) automatically generates Infrastructure from Code (IfC) based on application code with golden standards applied.

Elixirr

Elixirr

Elixirr is an award-winning global consulting firm working with clients across a diverse range of markets, industries and geographies.