cyber.hendryadrian.com
Threat Research · cyber.gov.au

Advisory Details China-Linked Actors’ Tools and Tactics for Stealing Sensitive Data

· Original article ↗

Summary

A joint government advisory based on FBI investigations details China-linked actors’ use of scanning tools, XSS, password attacks, SoftEther VPNs and custom tools to access and exfiltrate email and Active Directory data, with mitigation guidance.

Key points

  • The advisory draws on technical evidence from multiple FBI investigations and describes activity enabled by China-based Integrity Technology Group.
  • Actors targeted U.S. critical infrastructure and other organizations, as well as victims in Southeast Asia, Africa and North America.
  • The report details scanning tools and MicroScan scripts used to identify vulnerable networks and web applications.
  • An observed XSS payload presented fake login fields to harvest credentials and delivered a password-protected archive containing live700_v1.exe.
  • The actors used EBurst for password spraying and guessing against Exchange interfaces, and SoftEther VPN clients to maintain access and obscure activity.
  • FBI observations describe tools used to collect email and Active Directory data, including Curlc4, office-cli and DC.exe's DCSync activity.
  • Recommended defenses include MFA, input sanitization, monitoring for unusual Active Directory replication and outbound traffic, patching, and network segmentation.

Article Details

Attack Vectors
  • The actors scanned networks and web applications for vulnerabilities using open-source scanning tools and MicroScan penetration-testing scripts.
  • They used exploit-code command-line utilities, including tools written in Python and Go, and JavaScript-based cross-site scripting payloads that displayed credential-harvesting fields on vulnerable websites.
  • EBurst conducted password spraying and password guessing against Microsoft Exchange accounts through multiple interfaces.
  • The actors installed SoftEther VPN clients on victim devices for persistent remote access and to obscure command-and-control communications.
  • They used DC.exe for Active Directory DCSync replication, and PHP scripts and office-cli to collect and exfiltrate email data.
Defensive Notes
  • Sanitize web application input to prevent cross-site scripting, and review application logs for exploitation and enumeration attempts.
  • Require multifactor authentication where possible, replace default passwords, and monitor for password spraying, password guessing, and abnormal account activity.
  • Monitor for unauthorized living-off-the-land tool use, unexpected Active Directory replication, and unusual outbound or upload traffic.
  • Review firewall configurations and logs for unusual IP addresses, ports, and unauthorized external connections; monitor cloud accounts for applications accessing sensitive data.
  • Apply software and firmware updates, enable antivirus and protective DNS, and segment networks to limit access from compromised devices.

Indicators of compromise

TypeIndicatorContext
DOMAIN98aiblog[.]comIdentified as a domain hosting SoftEther connections used by the actors for persistent remote access and C2.
DOMAINdns[.]studiocloud[.]xyzThe FBI attributed this domain to Integrity Technology Group; live700_v1.exe used it for encrypted communications.
DOMAINhmbcloud[.]comIdentified as a domain hosting SoftEther connections used by the actors for persistent remote access and C2.
DOMAINhmbcloud[.]netIdentified as a domain hosting SoftEther connections used by the actors for persistent remote access and C2.
DOMAINhmbiplc-01[.]comIdentified as a domain hosting SoftEther connections used by the actors for persistent remote access and C2.
DOMAINiepl[.]node[.]cmIdentified as a domain hosting SoftEther connections used by the actors for persistent remote access and C2.
DOMAINjavacheck[.]ooguy[.]comIdentified as a domain hosting SoftEther connections used by the actors for persistent remote access and C2.
DOMAINjavaupdate[.]giize[.]comIdentified as a domain hosting SoftEther connections used by the actors for persistent remote access and C2.
DOMAINnatcloudservice[.]comIdentified as the main C2 domain for the Curlc4.txt bot.
DOMAINsexytube0[.]comIdentified as a domain hosting SoftEther connections used by the actors for persistent remote access and C2.
DOMAINtwimg[.]co[.]ukIdentified as a domain hosting SoftEther connections used by the actors for persistent remote access and C2.
IPV4149[.]28[.]132[.]137IP address used to download the original Curlc4.txt file.
URLhxxps[:]//natcloudservice[.]com/ewsC2 communication endpoint used by the Curlc4.txt bot.
URLhxxps[:]//upl[.]natcloudservice[.]comThe Curlc4.txt bot downloaded its original file from this URL.

MITRE ATT&CK

T1003.006 · DCSyncDC.exe used DCSync replication to retrieve sensitive Active Directory information, including account credentials.T1020 · Automated ExfiltrationCurlc4.txt automatically uploaded collected emails to a remote server.T1036.003 · Rename Legitimate UtilitiesThe actors named SoftEther installers conhost.exe or dllhost.exe and used DiagTrack.exe for the live700_v1.exe process.T1059.001 · PowerShellThe actors used PowerShell to download SoftEther installers onto victim devices.T1059.004 · Unix ShellThe actors ran office-cli, a Linux-based binary, from the command line or Bash scripts to access and exfiltrate Outlook 365 mail.T1059.006 · PythonThe actors used command-line utilities based on exploit code written in Python to gain access to victim networks and cloud services.T1059.007 · JavaScriptThe actors used JavaScript to execute XSS attacks.T1074.001 · Local Data StagingCurlc4.txt searched for a writable directory on the target system to use for its files.T1110.001 · Password GuessingEBurst attempted password guessing against supplied email addresses on Microsoft Exchange servers.T1110.003 · Password SprayingEBurst conducted password spraying against supplied email addresses on Microsoft Exchange servers.T1114.002 · Remote Email CollectionThe Curlc4.txt PHP script interfaced with the Microsoft EWS API to collect emails, calendars, and contacts.T1133 · External Remote ServicesThe actors installed VPN clients on victim devices to maintain remote access and obscure C2 communications.T1189 · Drive-by CompromiseThe actors used XSS attacks through vulnerable third-party applications to modify webpage content and target users.T1560.003 · Archive via Custom MethodThe Curlc4.txt bot compressed emails before exfiltration and sometimes encrypted them using RC4 or AES-128-CBC.T1595.002 · Vulnerability ScanningThe actors used scanning tools, including BBScan, dirsearch, Fscan, masscan, and NMAP, to find vulnerabilities in networks and web applications.

Threat Actors

Ethereal PandaThe advisory says the Integrity Technology Group-enabled actors used TTPs consistent with cyber activity publicly known as Ethereal Panda; it does not establish that Ethereal Panda conducted the activity.Flax TyphoonThe advisory says the Integrity Technology Group-enabled actors used TTPs consistent with cyber activity publicly known as Flax Typhoon; it does not establish that Flax Typhoon conducted the activity.Red JuliettThe advisory says the Integrity Technology Group-enabled actors used TTPs consistent with cyber activity publicly known as Red Juliett; it does not establish that Red Juliett conducted the activity.

Vendors

Integrity Technology GroupIntegrity Technology Group, a China-based company with links to the Chinese government, enables China-linked threat actors to exploit U.S. and foreign organization networks across multiple sectors using various toolsMicrosoftThe threat actors use EBurst, an open source Python-based tool, to target accounts in the Microsoft Office365 Cloud environment. The tool compromises email accounts on Microsoft Exchange servers using multiple

Products

Microsoft Exchangeaccounts in the Microsoft Office365 Cloud environment. The tool compromises email accounts on Microsoft Exchange servers using multiple interfaces for password spraying [T1110.003] and password guessingMicrosoft Office365 CloudThe threat actors use EBurst, an open source Python-based tool, to target accounts in the Microsoft Office365 Cloud environment. The tool compromises email accounts on Microsoft Exchange servers using multipleMicrosoft Outlook 365threat actors use a command-line utility office-cli [T1059.004] to continuously target and access Microsoft Outlook 365 email accounts to exfiltrate emails across different time periods. The threat actors occasionallySoftEtherThe threat actors typically download SoftEther installers onto victim devices from threat actor-controlled infrastructure using PowerShell or LOTL binaries for Windows Systems [T1059.001]. For Linux/Unix distributions,

Tools

BBScanof open source scanning tools to find vulnerabilities in networks and web-based applications, including: BBScan, dirsearch, Fscan, ksubdomain, masscan, NMAP, OneForAll, ShuiZe, and wpscan [T1595.002]. See Appendix A:Curlc4.txtThe FBI observed that the threat actors created a bot using the PHP script Curlc4.txt to obtain emails from victims. The script is specifically designed to interface with the Microsoft EWS API, which allows the threatDC.exeThe threat actors used DC.exe to execute the DCSync replication technique [T1003.006] to copy sensitive information from the Active Directory (AD), including account credentials, group membership details, and trustdirsearchscanning tools to find vulnerabilities in networks and web-based applications, including: BBScan, dirsearch, Fscan, ksubdomain, masscan, NMAP, OneForAll, ShuiZe, and wpscan [T1595.002]. See Appendix A: IndicatorsEBurstThe threat actors use EBurst, an open source Python-based tool, to target accounts in the Microsoft Office365 Cloud environment. The tool compromises email accounts on Microsoft Exchange servers using multiplefscantools to find vulnerabilities in networks and web-based applications, including: BBScan, dirsearch, Fscan, ksubdomain, masscan, NMAP, OneForAll, ShuiZe, and wpscan [T1595.002]. See Appendix A: Indicators ofmasscanvulnerabilities in networks and web-based applications, including: BBScan, dirsearch, Fscan, ksubdomain, masscan, NMAP, OneForAll, ShuiZe, and wpscan [T1595.002]. See Appendix A: Indicators of Compromise for a completeMicroScanAs early as 2017, these threat actors have also used a malicious application known as “MicroScan.” This Python-based web application contains over 1,300 penetration testing scripts written to scan websites for specificNmapin networks and web-based applications, including: BBScan, dirsearch, Fscan, ksubdomain, masscan, NMAP, OneForAll, ShuiZe, and wpscan [T1595.002]. See Appendix A: Indicators of Compromise for a complete listoffice-cliOffice-cli Program

Countries

ChinaIntegrity Technology Group, a China-based company with links to the Chinese government, enables China-linked threat actors to exploit U.S. and foreign organization networks across multiple sectors using various toolsUnited Statesa China-based company with links to the Chinese government, enables China-linked threat actors to exploit U.S. and foreign organization networks across multiple sectors using various tools and techniques. This

Industries

critical manufacturingmultiple U.S. critical infrastructure sectors, including: Government Services and Facilities, Critical Manufacturing, Healthcare and Public Health, and Information Technology. The actors also targeted victims inEducationPublic Health, and Information Technology. The actors also targeted victims in U.S. law enforcement, education, and religious organizations, as well as organizations across Southeast Asia, Africa, and North America.Government Services and Facilitiesactors targeted victims across multiple U.S. critical infrastructure sectors, including: Government Services and Facilities, Critical Manufacturing, Healthcare and Public Health, and Information Technology. TheHealthcare and public healthinfrastructure sectors, including: Government Services and Facilities, Critical Manufacturing, Healthcare and Public Health, and Information Technology. The actors also targeted victims in U.S. law enforcement,Information TechnologyGovernment Services and Facilities, Critical Manufacturing, Healthcare and Public Health, and Information Technology. The actors also targeted victims in U.S. law enforcement, education, and religiousLaw enforcementHealthcare and Public Health, and Information Technology. The actors also targeted victims in U.S. law enforcement, education, and religious organizations, as well as organizations across Southeast Asia, Africa, andreligious organizationsInformation Technology. The actors also targeted victims in U.S. law enforcement, education, and religious organizations, as well as organizations across Southeast Asia, Africa, and North America.

Related Articles