Unit 42 Tracks CL-UNK-1068 Operations Targeting Asian Critical Sectors
Summary
Unit 42 describes CL-UNK-1068 activity observed since 2020 against critical-sector organizations in Asia, detailing web shells, DLL side-loading, credential theft and data exfiltration. It assesses cyberespionage as the likely motive.
Key points
- Unit 42 reports CL-UNK-1068 activity since at least 2020 against aviation, energy, government and other organizations across South, Southeast and East Asia.
- The investigators assess with high confidence that the cluster is operated by a Chinese-communicating threat actor; they consider cyberespionage the likely primary motive but do not rule out cybercrime.
- The activity uses GodZilla and AntSword web shells, then steals web-server configuration files and other sensitive data, including database backups and saved credentials.
- Attackers use legitimate Python executables to DLL-side-load a malicious loader that executes shellcode and payloads in memory, including FRP, PrintSpoofer and the custom scanner ScanPortPlus.
- Observed credential-theft tools and methods include Mimikatz, LsaRecorder, memory dumps analyzed with Volatility, and extraction of saved SQL Server Management Studio connection data.
- The cluster uses custom FRP variants for tunneling and persistence and has deployed the Linux backdoor Xnote, which includes DDoS and proxy capabilities.
- Unit 42 advises defenders to look for behavioral signs such as Python binary side-loading, unauthorized FRP use and execution of custom reconnaissance scripts.
Article Details
- Attack Vectors
- Since at least 2020, CL-UNK-1068 has targeted high-value organizations across South, Southeast and East Asia, initially deploying GodZilla and AntSword web shells and using them to move laterally to additional hosts and SQL servers.
- Operators stole web-server configuration files, database backups, browser data, and other sensitive files; they archived data, Base64-encoded archives with certutil, and displayed the encoded output through web shells for exfiltration.
- Operators side-loaded malicious DLLs such as python20.dll with legitimate Python executables, then decrypted and executed payloads in memory, including FRP, PrintSpoofer, and ScanPortPlus.
- The cluster used custom FRP variants to maintain access and bypass firewalls, and deployed the Xnote Linux backdoor, which includes file, shell, proxy, and DDoS capabilities.
- Credential theft included Mimikatz, LsaRecorder, memory dumping with DumpIt and Volatility, extraction of SSMS connection data, and collection of credentials and configuration data from host files and registry artifacts.
- Reconnaissance included ScanPortPlus network scanning, SuperDump and batch scripts for host and network information, and attempts to escalate privileges using PwnKit, PrintSpoofer, PrintProgram, srunas.exe, and a Sliver implant.
- Defensive Notes
- Monitor for legitimate Python executables loading unexpected DLLs, including python20.dll, and for shellcode or payload execution in the Python process's memory.
- Detect unauthorized web-shell deployment, use of FRP tunneling, and execution of custom reconnaissance scripts such as hp.bat and hpp.bat.
- Monitor for credential dumping and collection, including suspicious access to LSASS, SAM and LSA data, saved SSMS connection files, and sensitive configuration files.
- Look for suspicious archiving followed by certutil Base64 encoding and command output through web shells, as well as batch scripts that clear Windows event logs.
- The article recommends behavioral detection, including identifying uncommon Linux processes connecting to rare external hosts and unauthorized attempts to access sensitive files such as /etc/hosts and /etc/ssl/private/.*.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 107[.]148[.]130[.]22 | IP identified in the article's list of C2 and infrastructure addresses observed in CL-UNK-1068 activity. |
| IPV4 | 107[.]148[.]33[.]60 | IP identified in the article's list of C2 and infrastructure addresses observed in CL-UNK-1068 activity. |
| IPV4 | 107[.]148[.]51[.]251 | IP identified in the article's list of C2 and infrastructure addresses observed in CL-UNK-1068 activity. |
| IPV4 | 13[.]250[.]108[.]65 | IP identified in the article's list of C2 and infrastructure addresses observed in CL-UNK-1068 activity. |
| IPV4 | 43[.]255[.]189[.]67 | IP identified in the article's list of C2 and infrastructure addresses observed in CL-UNK-1068 activity. |
| IPV4 | 52[.]77[.]253[.]4 | IP identified in the article's list of C2 and infrastructure addresses observed in CL-UNK-1068 activity. |
| IPV4 | 79[.]141[.]169[.]123 | IP identified in the article's list of C2 and infrastructure addresses observed in CL-UNK-1068 activity. |
| SHA256 | 082a55731f972cd15e103104229a68175a8c59a52bae05daa8ed4302df7c2dec | Hash of the Windows FRP variant used by the operators for tunneling and persistent access. |
| SHA256 | 0c7db12ec29f333bf5f53dc5c73ec446b2265fca3aad5144c3569409e15123cb | Hash of SuperDump, the custom host-reconnaissance tool used in earlier intrusions. |
| SHA256 | 0d03934eb181c2befbc5341208c4eb8f939e00382ac632216397b8210225c937 | Hash of the Windows version of ScanPortPlus, the custom network-scanning tool used by the operators. |
| SHA256 | 26483f0886078cc9f5f9912d3ffce1301e297b435920ab1c86c9107bbdce4db2 | Hash of a Mimikatz shellcode binary used in CL-UNK-1068 activity. |
| SHA256 | 3b2b6a3ee023dfa168f257b292a28f5fbdbacb5aa2250e1efb36e650529db1b5 | Hash of a malicious shellcode-loader DLL, identified as python20.dll, used in DLL side-loading. |
| SHA256 | 3e698c85660e2c012b3db7f47ca3f2b1af2b6b0e0a0d2bdb7903f91cf9d31732 | Hash of the Windows version of ScanPortPlus, the custom network-scanning tool used by the operators. |
| SHA256 | 524734501be19e9ed1bfab304b0622a2263a4f9e3db0971f3fae93f7e7369c20 | Hash of the shellcode loader identified in the CL-UNK-1068 indicator list. |
| SHA256 | 5c986203242e2ed25458b0606ee7be57070f6d66b7472b453d92b1b6786443bd | Hash of a web shell deployed in CL-UNK-1068 intrusions. |
| SHA256 | 6ddbfd3a96834087501f0c9415a925cafdb92cb8ff34685f138833b4795416d6 | Hash of a malicious shellcode-loader DLL, identified as python20.dll, used in DLL side-loading. |
| SHA256 | 8a3345f0d8f1a7d78ea485ae11358cf2ae3d51cb7975524d6d67ba05a08a37ea | Hash of LsaRecorder, which the article says operators used to capture login passwords. |
| SHA256 | 8d3907d56b1dd1609053cb55dd66f33499e1ea091133df76d8fe6f08f25f37b2 | Hash of the Linux version of ScanPortPlus, the custom network-scanning tool used by the operators. |
| SHA256 | b87cee18720c176c1972cf5c74e3c09877177e0c49c34a04b910bb3c70839b71 | Hash of an Xnote Linux backdoor sample deployed in CL-UNK-1068 activity. |
| SHA256 | c880936ba0ca153719c2cca33c1925a9480d28abc88cf4daa02f34cc8cc1c9e5 | Hash of the SQL Server Management Studio Password Export Tool used to extract saved connection data. |
| SHA256 | cdb90179188a142d24147edcb72be8b574fac4f6833fff15a6ee803754dec0c0 | Hash of a Linux FRP variant used by the operators for tunneling and persistent access. |
| SHA256 | cfcbb3014ecc560ba36103213b36fc62d6b0ef22c49067ff0d860fd7253a7c94 | Hash of a web shell deployed in CL-UNK-1068 intrusions. |
| SHA256 | cfdcbc553bc7464aedfb6758b0a38acc78d9537eabe9717e60ab0d8d3b355225 | Hash of a malicious shellcode-loader DLL, identified as python20.dll, used in DLL side-loading. |
| SHA256 | d6ed94589b0e6a7c3e1a6052e18f3962ca78c385c78036972d5ea72c07a5772c | Hash of the Windows version of ScanPortPlus, the custom network-scanning tool used by the operators. |
| SHA256 | d8378cf105146217e6ded438187c4ea0edcadb6cf27f5eeddda3fd80cce76d72 | Hash of a web shell deployed in CL-UNK-1068 intrusions. |
| SHA256 | e1ff808321ce952384b7fff720584c48ec0fd36480d6bc9ac0d5db036102c368 | Hash of a Linux FRP variant used by the operators for tunneling and persistent access. |
| SHA256 | edc0287da3c6bb62a7b2fd3949be5688628fc0e893b5822bd5734a63c39f7ab1 | Hash of SuperDump, the custom host-reconnaissance tool used in earlier intrusions. |
| SHA256 | f6ac9e5e76bc9daf4772c5be43c9eac1d2611caafd49fac70bbb8eebfa4781ac | Hash of a Linux FRP variant used by the operators for tunneling and persistent access. |
| SHA256 | f710dc61c2edc85841fd733a17b7977dfb889d6476c59bb3c54a5b2fd393ac13 | Hash of an Xnote Linux backdoor sample deployed in CL-UNK-1068 activity. |
| SHA256 | fb9400d763a009b3bd2b9468410e0c69ee8a4f58400e532f086cef749422210d | Hash of a web shell deployed in CL-UNK-1068 intrusions. |
MITRE ATT&CK
T1003.001 · LSASS MemoryLsaRecorder hooked an LSA callback to capture logon passwords, and operators also dumped LSASS data.T1003.002 · Security Account ManagerDumpIt and Volatility were used to extract local account password hashes from the SAM registry hive.T1003.004 · LSA SecretsVolatility's Lsadump module was used to dump LSA secrets, including service-account passwords.T1003.005 · Cached Domain CredentialsVolatility's Cachedump module was used to extract cached domain credentials.T1041 · Exfiltration Over C2 ChannelOperators Base64-encoded archived files with certutil and displayed the encoded content through web shells for exfiltration.T1046 · Network Service DiscoveryThe custom ScanPortPlus tool scanned compromised networks for IP addresses, ports, and vulnerabilities.T1059.003 · Windows Command ShellCustom batch scripts ran Windows commands for reconnaissance, credential collection, and other intrusion tasks.T1068 · Exploitation for Privilege EscalationThe operators deployed PwnKit for Linux privilege escalation and used PrintSpoofer to elevate privileges.T1070.001 · Clear Windows Event LogsBatch scripts used wevtutil commands to clear Security, System, Application, Setup, and PowerShell logs.T1082 · System Information DiscoverySuperDump and later batch scripts collected host, user, process, system, and registry information.T1090 · ProxyCustom-compiled FRP variants established tunnels and persistent access while bypassing firewalls.T1134.001 · Token Impersonation/TheftThe custom srunas.exe tool elevated processes by copying an access token from another process.T1505.003 · Web ShellThe operators deployed GodZilla and an AntSword variation as web shells for initial access and persistence.T1560.001 · Archive via UtilityWinRAR and RAR commands archived collected configuration files and reconnaissance output.T1574.002 · DLL Side-LoadingLegitimate Python executables loaded malicious python20.dll files, which decrypted and executed payloads in memory.
CVE
CVE-2021-4034Canonical · Ubuntu linux; Oracle · Http server; +28 morefor Privilege Escalation – Leveraging local exploits and tools for escalation such as PwnKit (CVE-2021-4034) and PrintSpoofer/PrintProgram: (‘Attackers deployed PwnKit, a self-contained exploit (CVE-2021-4034)CVE-2023-34048vmware · cloud_foundation; vmware · vcenter_server; +2 moreSHA256 hashes for CVE-2023-34048 Python Executable (vc.exe)
Threat Actors
Malware
AntSwordThe group’s toolkit includes GodZilla, AntSword, Xnote, ScanPortPlus and custom FRP variants and the activity shows a focus on exfiltrating configuration and database data for likely cyberespionage.GodzillaThe group’s toolkit includes GodZilla, AntSword, Xnote, ScanPortPlus and custom FRP variants and the activity shows a focus on exfiltrating configuration and database data for likely cyberespionage.XnoteThe group’s toolkit includes GodZilla, AntSword, Xnote, ScanPortPlus and custom FRP variants and the activity shows a focus on exfiltrating configuration and database data for likely cyberespionage.
Vendors
MicrosoftThe sqlstudio.bin file stores saved connection info for Microsoft SQL Server Management Studio (SSMS).Palo Alto NetworksPalo Alto Networks customers are better protected from the threats described through the following products and services:VMwareCortex Xpanse has the ability to identify exposed VMWare vCenter Server devices on the public internet and escalate these findings to defenders.
Products
Cortex XDRFigure 1. Cortex XDR alert indicating Linux webserver exploitation, triggered by CL-UNK-1068 activity.Cortex XpanseCortex Xpanse has the ability to identify exposed VMWare vCenter Server devices on the public internet and escalate these findings to defenders.Cortex XSIAMThese findings are also available for Cortex XSIAM customers who have purchased the ASM module.Microsoft SQL Server Management StudioThe sqlstudio.bin file stores saved connection info for Microsoft SQL Server Management Studio (SSMS).VMware vCenter ServerCortex Xpanse has the ability to identify exposed VMWare vCenter Server devices on the public internet and escalate these findings to defenders.
Tools
DumpItCredential theft techniques include Mimikatz, LsaRecorder, memory dumping with DumpIt + Volatility, SSMS sqlstudio.bin extraction (ssms.exe), and harvesting registry artifacts and application credentials via SuperDumpFast Reverse ProxyTheir TTPs rely heavily on open-source utilities and malware variants popular with Chinese-speaking users, including GodZilla, AntSword, Xnote and Fast Reverse Proxy (FRP).LsaRecorderCredential theft techniques include Mimikatz, LsaRecorder, memory dumping with DumpIt + Volatility, SSMS sqlstudio.bin extraction (ssms.exe), and harvesting registry artifacts and application credentials via SuperDumpMimikatzCredential theft techniques include Mimikatz, LsaRecorder, memory dumping with DumpIt + Volatility, SSMS sqlstudio.bin extraction (ssms.exe), and harvesting registry artifacts and application credentials via SuperDumpPrintSpooferThe group uses DLL sideâloading of legitimate Python executables to load shellcode in memory and execute payloads (ScanPortPlus, PrintSpoofer, FRP), avoiding diskâbased payload execution.pwnkit] Exploitation for Privilege Escalation – Leveraging local exploits and tools for escalation such as PwnKit (CVE-2021-4034) and PrintSpoofer/PrintProgram: (‘Attackers deployed PwnKit, a self-contained exploitScanPortPlusThe group’s toolkit includes GodZilla, AntSword, Xnote, ScanPortPlus and custom FRP variants and the activity shows a focus on exfiltrating configuration and database data for likely cyberespionage.SliverSHA256 hashes for Sliver (agent.exe)SQL Server Management Studio Password Export ToolAttackers attempted to extract data from this file using a tool named SQL Server Management Studio Password Export Tool, deployed as ssms.exe.srunas.exeSHA256 hashes for srunas.exe (srunas.exe)SuperDumpsqlstudio.bin extraction (ssms.exe), and harvesting registry artifacts and application credentials via SuperDump and batch scripts.volatilityCredential theft techniques include Mimikatz, LsaRecorder, memory dumping with DumpIt + Volatility, SSMS sqlstudio.bin extraction (ssms.exe), and harvesting registry artifacts and application credentials via SuperDump
Countries
Industries
AviationCL-UNK-1068 is an activity cluster observed since 2020 targeting aviation, energy, government, law enforcement, pharmaceutical, technology and telecommunications organizations across South, Southeast and East Asia.EnergyCL-UNK-1068 is an activity cluster observed since 2020 targeting aviation, energy, government, law enforcement, pharmaceutical, technology and telecommunications organizations across South, Southeast and East Asia.GovernmentCL-UNK-1068 is an activity cluster observed since 2020 targeting aviation, energy, government, law enforcement, pharmaceutical, technology and telecommunications organizations across South, Southeast and East Asia.Law enforcementCL-UNK-1068 is an activity cluster observed since 2020 targeting aviation, energy, government, law enforcement, pharmaceutical, technology and telecommunications organizations across South, Southeast and East Asia.pharmaceuticalCL-UNK-1068 is an activity cluster observed since 2020 targeting aviation, energy, government, law enforcement, pharmaceutical, technology and telecommunications organizations across South, Southeast and East Asia.TechnologyCL-UNK-1068 is an activity cluster observed since 2020 targeting aviation, energy, government, law enforcement, pharmaceutical, technology and telecommunications organizations across South, Southeast and East Asia.TelecommunicationsCL-UNK-1068 is an activity cluster observed since 2020 targeting aviation, energy, government, law enforcement, pharmaceutical, technology and telecommunications organizations across South, Southeast and East Asia.