China-Nexus Hackers Skulk in Southeast Asian Military Orgs for Years

There are more details about suspected Chinese-linked actors who quietly set up long-term access to the networks of military groups in Southeast Asia. Palo Alto Networks' Unit 42 incident response team wrote in a threat report last week that they had found a large cyberespionage campaign that they were moderately sure was being run by Chinese state-sponsored actors. This came right after they found a similar campaign that had been going on for years and was targeting important sectors in the region.

Unit 42 calls the threat activity CL-STA-1087. It was first found when Palo Alto Networks' Cortex XDR platform's new agents saw strange PowerShell activity on a victim's network. Unit 42 researchers found that the threat activity had been going on since at least 2020.

The researchers found new backdoor malware and a custom Getpass credential stealing tool, but they don't know how the attackers got into the organization in the first place. Rochberger says that Palo Alto Networks has seen more and more legitimate services being used for C2 infrastructure. "That trend has sped up with the rise of AI tools and cloud services that make it easy to get access without revealing your identity."

Related: LatAm is now getting twice as many cyberattacks as the US. Rochberger says that organizations should be more careful about how their networks connect to well-known services like Dropbox and Pastebin because abuse is on the rise. "If your company doesn't officially use or approve certain content hosting or storage services, we strongly suggest limiting access," she says.

"At the very least, businesses should set up strong monitoring and alerting for any strange traffic to these platforms. The truth is that threat actors pick these services on purpose because they look like normal internet traffic and security teams often miss them." Palo Alto Networks also released indicators of compromise (IOCs) for CL-STA-1087.

These included the SHA256 hashes of AppleChris variants and MemFun backdoors, as well as the IP addresses of the C2 servers.