CISA Details How China-Linked Actors Steal Sensitive Data
Summary
CISA’s advisory describes how China-linked actors use reconnaissance tools, XSS credential harvesting, password spraying, SoftEther VPNs, and mailbox and Active Directory collection to steal sensitive data from organizations.
Key points
- CISA links China-based Integrity Tech to activity tracked as Flax Typhoon, Ethereal Panda, or Red Juliett, targeting US critical infrastructure and organizations in several regions.
- Actors use automated tools to discover subdomains, open ports, and vulnerable web applications.
- XSS pages harvest credentials and deliver malware disguised as DiagTrack.exe; EBurst is used for password spraying against Exchange accounts.
- SoftEther VPN clients, sometimes disguised as conhost.exe or dllhost.exe, provide persistent remote access and conceal command-and-control traffic.
- Curlc4.txt and office-cli collect email and other mailbox data, while DC.exe performs DCSync to obtain Active Directory information.
- The article describes Picus attack simulations and security-control signatures for testing defenses against these techniques.
Article Details
- Attack Vectors
- Cross-site scripting (XSS) pages display username and password fields to harvest credentials, then provide a password-protected ZIP containing live700_v1.exe.
- EBurst performs password spraying and password guessing against Microsoft Office 365 and Exchange accounts through ECP, EWS, OAB, and OWA.
- SoftEther VPN clients installed on victim devices reconnect at startup to maintain remote access and conceal command-and-control communications.
- Curlc4.txt collects email through the Microsoft EWS API, compresses it, and uploads it to a remote server; the article says some collected data is encrypted using RC4 or AES-128-CBC.
- DC.exe performs DCSync over RPC and the Directory Replication Service to retrieve Active Directory data, including credentials, group memberships, and trust relationships.
- office-cli automates collection and exfiltration of email from Microsoft Outlook 365 accounts.
- Defensive Notes
- Picus recommends simulating the described attacks to test security controls and provides prevention signatures in its Mitigation Library.
- The article notes that SoftEther is legitimate VPN software and that its presence may be less likely to trigger endpoint alerts.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | dns[.]studiocloud[.]xyz | Domain used by DiagTrack.exe for encrypted HTTP communications. |
MITRE ATT&CK
T1003.006 · DCSyncDC.exe performs DCSync to retrieve sensitive Active Directory data through directory replication.T1041 · Exfiltration Over C2 ChannelCurlc4.txt uploads collected email to a remote server.T1056.003 · Web Portal CaptureXSS pages display username and password fields to capture credentials entered by users.T1059.001 · PowerShellPowerShell is used to download SoftEther VPN installers on Windows.T1071.001 · Web ProtocolsDiagTrack.exe communicates over HTTP with dns.studiocloud[.]xyz.T1074.001 · Local Data StagingEmail dumps are staged on victim systems under filenames including 001.gif and All_scanner_vXX.pl.gz.T1110.001 · Password GuessingEBurst also performs password guessing against Exchange and Office 365 accounts.T1110.003 · Password SprayingEBurst attempts password spraying against Exchange and Office 365 accounts.T1114.002 · Remote Email CollectionCurlc4.txt collects email through the Microsoft EWS API.T1114.003 · Email Forwarding Ruleoffice-cli collects email from Microsoft Outlook 365 accounts.T1189 · Drive-by CompromiseXSS payloads alter vulnerable web pages to present credential-harvesting fields.T1547.001 · Registry Run Keys / Startup FolderSoftEther clients are configured to reconnect automatically at startup.T1560.002 · Archive via LibraryCurlc4.txt compresses collected email before uploading it.T1566.002 · Spearphishing LinkThe article describes an email-infiltration threat module for Flax Typhoon, but gives no further delivery detail.T1590 · Gather Victim Network InformationActors use subdomain discovery tools, including OneForAll, during reconnaissance.T1592 · Gather Victim Host InformationActors fingerprint applications and enumerate website paths to identify potential targets.T1595 · Active ScanningActors scan potential targets with tools including masscan, Nmap, and WPScan.
Threat Actors
Ethereal PandaThe article identifies this as another name used by cybersecurity vendors for the activity tracked as Flax Typhoon.Flax TyphoonActivity supported by Integrity Tech is tracked by vendors under this name.Red JuliettThe article identifies this as another name used by cybersecurity vendors for the activity tracked as Flax Typhoon.
Malware
Vendors
Products
Microsoft 365Additionally, the actors use office-cli, a Linux command-line tool, to automate the collection and exfiltration of email from Microsoft Outlook 365 accounts across different time periods.Microsoft Exchange ServerInitial access combines XSS credential-harvesting pages delivering DiagTrack.exe malware with EBurst password spraying against Exchange.Picus PlatformThe Picus Platform simulates Flax Typhoon threats to validate security controls against these attacks.SoftEther VPNActors install SoftEther VPN clients disguised as conhost.exe or dllhost.exe to maintain stealthy, startup-persistent remote access.
Tools
BBScanThe actors use BBScan, dirsearch, Fscan, ksubdomain, masscan, Nmap, OneForAll, ShuiZe, and WPScan to identify potential targets.Curlc4.txtData theft combines Curlc4.txt and office-cli email collection with DCSync credential harvesting through DC.exe.DC.exeData theft combines Curlc4.txt and office-cli email collection with DCSync credential harvesting through DC.exe.dirsearchThe actors use BBScan, dirsearch, Fscan, ksubdomain, masscan, Nmap, OneForAll, ShuiZe, and WPScan to identify potential targets.EBurstInitial access combines XSS credential-harvesting pages delivering DiagTrack.exe malware with EBurst password spraying against Exchange.fscanThe actors use BBScan, dirsearch, Fscan, ksubdomain, masscan, Nmap, OneForAll, ShuiZe, and WPScan to identify potential targets.ksubdomainThe actors use BBScan, dirsearch, Fscan, ksubdomain, masscan, Nmap, OneForAll, ShuiZe, and WPScan to identify potential targets.masscanThe actors use BBScan, dirsearch, Fscan, ksubdomain, masscan, Nmap, OneForAll, ShuiZe, and WPScan to identify potential targets.MicroScanThe actors also use MicroScan, a Python-based web application containing more than 1,300 penetration testing scripts.NmapThe actors use BBScan, dirsearch, Fscan, ksubdomain, masscan, Nmap, OneForAll, ShuiZe, and WPScan to identify potential targets.office-cliData theft combines Curlc4.txt and office-cli email collection with DCSync credential harvesting through DC.exe.OneForAllThe actors use BBScan, dirsearch, Fscan, ksubdomain, masscan, Nmap, OneForAll, ShuiZe, and WPScan to identify potential targets.ShuiZeThe actors use BBScan, dirsearch, Fscan, ksubdomain, masscan, Nmap, OneForAll, ShuiZe, and WPScan to identify potential targets.WPScanThe actors use BBScan, dirsearch, Fscan, ksubdomain, masscan, Nmap, OneForAll, ShuiZe, and WPScan to identify potential targets.