China-Linked Hackers - Breach Southeast Asian Military Systems

The Threat

A sophisticated cyber espionage campaign, tracked as CL-STA-1087, has been targeting military organizations across Southeast Asia since at least 2020. This operation is believed to be linked to a China-aligned threat actor. Unlike typical data theft, the focus here is on gathering strategic and operational intelligence. The attackers have employed advanced techniques to maintain a stealthy presence within compromised networks, making detection challenging.

The campaign first came to light when endpoint security tools flagged suspicious PowerShell activity on a military network. Investigators discovered that the attackers had already established a foothold and were executing delayed scripts to connect to multiple command-and-control (C2) servers. This careful approach allowed them to evade detection for an extended period.

Who's Behind It

The threat actors behind this campaign have shown remarkable sophistication. They utilized custom-built tools like AppleChris and MemFun as backdoors, along with Getpass, a modified credential-theft tool. Their operational patterns align with UTC+8 business hours, and their infrastructure includes China-based cloud services. The presence of Simplified Chinese language elements further suggests a connection to Chinese cyber operations.

The attackers have demonstrated a methodical approach, using techniques such as DLL hijacking and creating new Windows services to blend in with legitimate operations. This persistence strategy has allowed them to maintain a long-term presence within the targeted environments.

Tactics & Techniques

The primary backdoor, AppleChris, retrieves its C2 server addresses dynamically, which helps avoid static indicators that defenders could track. It supports various operations, including file manipulation and remote shell execution. The secondary backdoor, MemFun, operates entirely in memory, making it difficult to detect on disk. This backdoor starts with a file disguised as GoogleUpdate.exe, which then downloads its payload from the C2 server.

Credential theft is handled by Getpass, which extracts sensitive information from the lsass.exe process. This variant of Mimikatz runs automatically, saving stolen data in a file named WinSAT.db, mimicking a legitimate Windows system file. These methods underline the attackers' commitment to stealth and long-term operational success.

Defensive Measures

Organizations within the defense sector must take proactive steps to protect themselves against such sophisticated threats. Key recommendations include:

• Strict monitoring of PowerShell and WMI activity to detect unusual behavior.
• Implementing DLL search order hardening to prevent DLL hijacking.
• Monitoring all LSASS access attempts to identify potential credential theft.

By adopting these measures, organizations can enhance their defenses against ongoing and future cyber espionage campaigns. The threat landscape continues to evolve, and vigilance is crucial for safeguarding sensitive military information.