Sophos uncovers Chinese state-sponsored campaign in Southeast Asia

Sophos has uncovered a highly sophisticated Chinese state-sponsored espionage campaign against a high-level government target in Southeast Asia that involved the use of novel malware.

In its investigation, which began in 2023, Sophos’ managed detection and response (MDR) team found three distinct clusters of activity targeting the same organisation, two of which included tactics, techniques and procedures (TTPs) that overlap with well-known, Chinese nation-state groups: BackdoorDiplomacy, APT15 and the APT41 subgroup Earth Longzhi.

The attackers designed their operations to gather reconnaissance on specific users, as well as sensitive political, economic, and military information, using a wide variety of malware and tools throughout the campaign.

This included the use of a previously unseen persistence tool and malware dubbed PocoProxy, which masquerades as a Microsoft executable and establishes communications with the attackers’ command and control (C2) infrastructure.

Paul Jaramillo, director for threat hunting and threat intelligence at Sophos, said the different clusters of activity appeared to be tied to Chinese state interests by gathering military and economic intelligence related to China’s strategies in the South China Sea.

“Within just one of the three clusters that we identified – Cluster Alpha – we saw malware and TTPs overlap with four separately reported Chinese threat groups,” Jaramillo said. “It’s well-known that Chinese attackers share infrastructure and tooling, and this recent campaign is a reminder of just how extensively these groups share their tools and techniques.”

Jaramillo noted that the overlapping clusters of activity showed that focusing too much on any single Chinese attribution may put organisations at risk of missing trends about how these groups coordinate their operations. “By having the bigger, broader picture, organisations can be smarter about their defences,” he said.

Sophos first learned of malicious activity on the targeted organisation’s network in December 2022 when it found a data exfiltration tool previously attributed to the Chinese threat group, Mustang Panda.

From there, Sophos’ MDR team began a broader hunt for malicious activity. In May 2023, the company’s threat hunting operations uncovered a vulnerable VMware executable, which, upon analysis, revealed three distinct clusters of activity in the target’s network: Cluster Bravo, Cluster Charlie and Cluster Alpha.

Cluster Alpha was active from early March to at least August 2023 and deployed a variety of malware focused on disabling anti-virus protections, escalating privileges and conducting reconnaissance.

Cluster Bravo was only active in the targeted network for three weeks in March 2023 and focused on moving laterally through the victim’s network to sideload a backdoor called CCoreDoor, which established external communications pathways for the attackers, performed discovery and exfiltrated credentials.

Cluster Charlie was active from March 2023 to at least April 2024, with a focus on espionage and exfiltration where it exfiltrated military and political documents, as well as credentials and tokens to enable further access within the network.

Jaramillo said: “What we’ve seen with this campaign is the aggressive development of cyber espionage operations in the South China Sea. We have multiple threat groups, likely with unlimited resources, targeting the same high-level government organisation for weeks or months at a time, and they are using advanced custom malware intertwined with publicly available tools.

“They were, and are still, able to move throughout an organisation at will, rotating their tools on a frequent basis. At least one of the activity clusters is still very much active and attempting to conduct further surveillance.

“Given how often these Chinese threat groups overlap and share tooling, it’s possible that the TTPs and novel malware we observed in this campaign will resurface in other Chinese operations globally.”