Palo Alto Networks Details China-Linked Espionage Campaign Targeting Southeast Asian Militaries
Summary
Palo Alto Networks reports that CL-STA-1087 has targeted Southeast Asian military organizations since at least 2020, using custom backdoors, credential theft and long periods of dormant access to seek sensitive military files.
Key points
- Palo Alto Networks says the campaign has likely been active since at least 2020 and attributes it to the tracked actor CL-STA-1087.
- In at least one observed intrusion, attackers remained in an organization’s environment for months before resuming activity; the initial infection vector is unknown.
- Attackers used PowerShell reverse shells, WMI and native .NET commands, then deployed a service and abused DLL hijacking for persistence and payload execution.
- The activity involved the AppleChris backdoor, the multi-stage MemFun malware and Getpass, a custom credential stealer targeting Windows authentication packages.
- AppleChris variants used Pastebin and, in one version, Dropbox for command-and-control resolution; capabilities included file operations and remote command execution.
- The attackers searched for military records on capabilities, organizational structures, strategy and collaboration with Western armed forces.
- Palo Alto Networks says targeting, infrastructure and Simplified Chinese on a C&C login page suggest the group likely operates from China.
Article Details
- Attack Vectors
- Initial infection vector was not identified.
- The attackers remotely executed malicious PowerShell scripts, including scripts designed to create reverse shells to a command-and-control server.
- They used WMI and native Windows .NET commands to infect domain controllers, web servers, IT workstations, and executive-level systems.
- They created a new service for persistence and payload execution, and used DLL hijacking to load a malicious DLL stored in the System32 folder via a shadow copy service.
- They used Pastebin and Dropbox for command-and-control distribution and dead drop resolution.
MITRE ATT&CK
T1005 · Data from Local SystemThe attackers searched for and collected sensitive files from compromised environments, including meeting records and military assessments.T1047 · Windows Management InstrumentationThe attackers used WMI to infect domain controllers, web servers, IT workstations, and executive-level systems.T1057 · Process DiscoveryAppleChris can enumerate processes on a compromised system.T1059.001 · PowerShellThe attackers remotely executed malicious PowerShell scripts, including scripts that created reverse shells to a command-and-control server.T1083 · File and Directory DiscoveryAppleChris can enumerate drives and list directories; the attackers also searched for sensitive files related to military capabilities and organization.T1102.001 · Dead Drop ResolverAn AppleChris variant used Pastebin and Dropbox as dead drop resolvers for command-and-control infrastructure.T1543.003 · Windows ServiceThe attackers created a new service for persistence and payload execution.T1574 · Hijack Execution FlowThe attackers used DLL hijacking to load a malicious DLL from the System32 folder via a shadow copy service.T1620 · Reflective Code LoadingMemFun relies on reflective DLL loading to execute its main backdoor.
Threat Actors
Malware
AppleChrisAs part of the observed intrusions, the hackers deployed custom tools, such as the AppleChris and MemFun backdoors and the Getpass credential stealer, and executed malicious PowerShell scripts remotely on multipleGetpassintrusions, the hackers deployed custom tools, such as the AppleChris and MemFun backdoors and the Getpass credential stealer, and executed malicious PowerShell scripts remotely on multiple infected systems.MemFunAs part of the observed intrusions, the hackers deployed custom tools, such as the AppleChris and MemFun backdoors and the Getpass credential stealer, and executed malicious PowerShell scripts remotely on multiple