Joint Advisory Details China-Linked Actors’ Tools for Stealing Sensitive Data
Summary
A joint government advisory, based on FBI investigations, describes China-linked actors using scanning, password attacks, XSS, VPNs and scripts to access networks and steal emails and credentials. It recommends patching, MFA and other defenses.
Key points
- The advisory says Integrity Technology Group enabled China-linked actors targeting organizations worldwide, including US critical infrastructure; it links their activity to patterns associated with Flax Typhoon, Ethereal Panda and Red Juliett, while noting attribution may vary.
- Actors use open-source scanners and MicroScan to find vulnerable network services and web applications, and use exploit-code utilities, XSS and password spraying or guessing for access.
- A recovered XSS payload displayed fake login fields to harvest credentials; investigators assessed an associated executable likely targeted mailbox data.
- Actors install SoftEther VPN clients for persistent access and use scripts and utilities to collect email, credentials and Active Directory information, including through DCSync.
- The FBI observed stolen email data from government, law-enforcement, healthcare and religious organizations in Southeast Asia; the advisory also describes email theft from on-premises and cloud services.
- Recommended defenses include disabling unused services, sanitizing web inputs, enforcing MFA, patching, monitoring unusual account and replication activity, and reviewing outbound traffic.
Article Details
- Attack Vectors
- The actors scan networks and web applications for vulnerabilities, including with MicroScan and open-source scanning tools.
- They use exploit-code command-line utilities, cross-site scripting payloads that imitate login forms, and password spraying and guessing against Microsoft Exchange accounts.
- They install SoftEther VPN clients on victim devices for persistent remote access and use DCSync to retrieve Active Directory information.
- They collect and exfiltrate email and credentials using Curlc4.txt, office-cli, and other scripts or utilities.
- Defensive Notes
- Disable unused services and ports, sanitize web application input, and apply timely software and firmware patches.
- Require multifactor authentication, replace default passwords, and limit administrative privileges using least privilege.
- Monitor for abnormal scanning and outbound traffic, unauthorized Active Directory replication, unusual account activity, and suspicious web application access.
- Monitor cloud accounts for connected applications accessing sensitive data, and isolate compromised hosts while investigating incidents.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | dns[.]studiocloud[.]xyz | The FBI attributes this domain to Integrity Tech; live700_v1.exe used it for encrypted HTTP communications. |
| DOMAIN | natcloudservice[.]com | Identified as the main C2 domain for the Curlc4.txt email-collection bot. |
| DOMAIN | upl[.]natcloudservice[.]com | Used to host the original Curlc4.txt file and communicate with the bot. |
| IPV4 | 149[.]28[.]132[.]137 | IP address used to download the original Curlc4.txt file. |
| URL | hxxps[:]//natcloudservice[.]com/ews | C2 endpoint used by the Curlc4.txt email-collection bot. |
| URL | hxxps[:]//upl[.]natcloudservice[.]com | Download location for the original Curlc4.txt file. |
MITRE ATT&CK
T1003.006 · DCSyncDC.exe uses DCSync replication to retrieve sensitive information from Active Directory.T1020 · Automated ExfiltrationCurlc4.txt automatically uploads collected emails to a remote server.T1036.003 · Rename Legitimate UtilitiesThey name executables or installers after legitimate Windows software, including using DiagTrack.exe, conhost.exe, or dllhost.exe.T1059.001 · PowerShellThey use PowerShell to download SoftEther installers onto victim devices.T1059.004 · Unix ShellThey run office-cli from a command line or Bash script to access and exfiltrate mailbox contents.T1059.006 · PythonThey use command-line utilities based on Python exploit code to access victim networks and cloud services.T1059.007 · JavaScriptThey use JavaScript to execute XSS attacks.T1074.001 · Local Data StagingCurlc4.txt searches for a writable directory on the target system to use for its files.T1110.001 · Password GuessingEBurst performs password guessing against email accounts on Microsoft Exchange servers.T1110.003 · Password SprayingEBurst performs password spraying against email accounts on Microsoft Exchange servers.T1114.002 · Remote Email CollectionCurlc4.txt interfaces with the Microsoft EWS API to access emails, calendars, and contacts.T1133 · External Remote ServicesThey install SoftEther VPN clients on victim devices for persistence and to obfuscate C2 communications.T1189 · Drive-by CompromiseThey use XSS attacks to modify content on vulnerable third-party webpages.T1560.003 · Archive via Custom MethodThe Curlc4.txt bot compresses emails before exfiltration and sometimes encrypts them using RC4 or AES-128-CBC.T1595.002 · Vulnerability ScanningThe actors use scanning tools to find vulnerabilities in networks and web applications.
Threat Actors
Ethereal PandaThe advisory says the enabled actors use TTPs consistent with activity publicly known as Ethereal Panda; it does not attribute all described activity to this group.Flax TyphoonThe advisory says the enabled actors use TTPs consistent with activity publicly known as Flax Typhoon; it does not attribute all described activity to this group.Red JuliettThe advisory says the enabled actors use TTPs consistent with activity publicly known as Red Juliett; it does not attribute all described activity to this group.
Products
Microsoft Active Directoryinformation from the Active Directory (AD), including account credentials, group membership details, andMicrosoft Exchangespraying on Microsoft Exchange servers, while establishing persistence throughMicrosoft Outlook 365Microsoft Outlook 365 email accounts to exfiltrate emails across different time periods. The threat actorsSoftEtherThe threat actors typically download SoftEther installers onto victim devices from threat actor-controlled
Tools
BBScanbased applications, including: BBScan, dirsearch, Fscan, ksubdomain, masscan, NMAP, OneForAll, ShuiZe,Curlc4.txtThe FBI observed that the threat actors created a bot using the PHP script Curlc4.txt to obtain emails fromDC.exeDC.exe...........................................................................................................................................................10dirsearchbased applications, including: BBScan, dirsearch, Fscan, ksubdomain, masscan, NMAP, OneForAll, ShuiZe,EBurstThe threat actors use EBurst, an open source Python-based tool, to target accounts in the Microsoftfscanbased applications, including: BBScan, dirsearch, Fscan, ksubdomain, masscan, NMAP, OneForAll, ShuiZe,masscanbased applications, including: BBScan, dirsearch, Fscan, ksubdomain, masscan, NMAP, OneForAll, ShuiZe,MicroScanAs early as 2017, these threat actors have also used a malicious application known as “MicroScan.” ThisNmapbased applications, including: BBScan, dirsearch, Fscan, ksubdomain, masscan, NMAP, OneForAll, ShuiZe,office-cliOffice-cli Program .........................................................................................................................................11
Countries
Industries
critical manufacturingSectors: Government Services and Facilities, Critical Manufacturing, HealthcareEducationThe actors also targeted victims in US law enforcement, education, and religious organizations, as well asGovernment Services and FacilitiesSectors: Government Services and Facilities, Critical Manufacturing, HealthcareHealthcare and public healthServices and Facilities, Critical Manufacturing, Healthcare and Public Health, and Information Technology.Information Technologyand Public Health, and Information Technology.Law enforcementThe actors also targeted victims in US law enforcement, education, and religious organizations, as well asreligious organizationsThe actors also targeted victims in US law enforcement, education, and religious organizations, as well as