Story image

China cyberespionage group targets US maritime & engineering sectors

19 Mar 2018

A China-based cyberespionage group may be targeting United States engineering and maritime industries tied up in activities centering on the South China Sea.

The Group, called TEMP.Periscope or Leviathan, has been active since at least 2013. The latest wave of attacks started at the beginning of 2018 and is described as a ‘sharp escalation’ of activity since 2017.

“FireEye found a group of Chinese cyber-spies that appear to specialize in collecting data on maritime industries, and more broadly, the engineering sector. This group, which we call TEMP.Periscope, had gone quiet like many other Chinese groups after the Obama-Xi agreement in late 2015,” explains FireEye senior analyst Fred Plan.

The attacks have used malware often shared with other China-based cybercrime groups to attack targets including those involved in the maritime and engineering sectors. Other industries including research institutes, academic organizations and private firms in the United States.

Attacks have also focused on targets in Europe and at least one in Hong Kong, FireEye believes.

The latest attacks call upon malware including a JavaScript-based backdoor called AIRBREAK; a 64-bit Windows password cracker called HOMEFRY; a code injection webshell called China Chopper; a command-line reconnaissance tool called MURKYTOP; an uploader capable of exfiltrating files to Dropbox called LUNCHMONEY; a DLL backdoor called PHOTO; and a backdoor called BADFLICK.

The group also uses a number of other tactics to infiltrate targets:

  • Spear phishing, including the use of probably compromised email accounts.
  • Lure documents using CVE-2017-11882 to drop malware.
  • Stolen code signing certificates used to sign malware.
  • Use of bitsadmin.exe to download additional tools.
  • Use of PowerShell to download additional tools.
  • Using C:\Windows\Debug and C:\Perflogs as staging directories.
  • Leveraging Hyperhost VPS and Proton VPN exit nodes to access webshells on internet-facing systems.
  • Using Windows Management Instrumentation (WMI) for persistence.
  • Using Windows Shortcut files (.lnk) in the Startup folder that invoke the Windows Scripting Host (wscript.exe) to execute a Jscript backdoor for persistence.
  • Receiving C2 instructions from user profiles created by the adversary on legitimate websites/forums such as Github and Microsoft's TechNet portal.

FireEye says that the attacks are likely the result of the group’s plans to collect information that could provide economic advantage, intellectual property, an edge in commercial negotiations or research and development data.

“Because of the group’s tendency to target engineering organizations we believe the group is seeking technical data that can help inform strategic decision-making. Hypothetically, this could be used to answer questions like ‘what is the range and effectiveness of this marine radar system?’ or ‘how precisely can a system detect and identify activities at sea?’” Plan concludes.

Privacy: The real cost of “free” mobile apps
Sales of location targeted advertising, based on location data provided by apps, is set to reach $30 billion by 2020.
Myth-busting assumptions about identity governance - SailPoint
The identity governance space has evolved and matured over the past 10 years, changing with the world around it.
Forrester names Crowdstrike leader in incident response
The report provides an in-depth evaluation of the top 15 IR service providers across 11 criteria.
Slack doubles down on enterprise key management
EKM adds an extra layer of protection so customers can share conversations, files, and data while still meeting their own risk mitigation requirements.
Security professionals want to return fire – Venafi
Seventy-two percent of professionals surveyed believe nation-states have the right to ‘hack back’ cybercriminals.
Alcatraz AI to replace corporate badges with AI security
The Palo Alto-based startup supposedly leverages facial recognition, 3D sensing, and machine learning to enable secure access control.
Ensign and IronNet partner to create cyber analytics capabilities
The Singapore-based joint venture will form a Cyber Analytics Center for Excellence focused on securing regional enterprises from sophisticated cyber threats.
Unencrypted Gearbest database leaves over 1.5mil shoppers’ records exposed
Depending on the countries and information requirements, the data could give hackers access to online government portals, banking apps, and health insurance records.