Cyberwarfare / Nation-State Attacks
,
Fraud Management & Cybercrime
Threat Actor Shifts From Targeting Exchange to Databases
A Chinese cyberespionage threat actor with a history of hacking Microsoft Exchange to spy on geopolitical events including summits in Africa, the Middle East and Asia, has shifted its attention to targeting databases, say researchers.
See Also: OnDemand | North Korea’s Secret IT Army and How to Combat It
Palo Alto’s Unit 42 threat intel division said Tuesday the threat actor uses some of the same infrastructure as Chinese nation-state groups commonly tracked as APT27 and Winnti. Chinese nation-state hackers commonly share tools and techniques (see: Chinese Hackers’ Evolution From Vandals to Strategists).
But, some of the components used by the threat actor are unique to its activity, “indicating operational compartmentalization within this shared ecosystem,” Palo Alto wrote. It christened the threat actor with a moniker of its own: “Phantom Taurus.”
Among its targets were Exchange servers of foreign ministries that participated in a China-Arab summit in Riyadh, Saudi Arabia, in 2022, Bloomberg reported. Hackers searched email accounts for terms related to the summit and for specific names such as Chinese President Xi Jinping and his wife, Peng Liyuan.
The group uses common Chinese nation-state hacking tools such as the China Chopper web shell, Potato suite and Impacket – but it also uses customized tools, including a previously undocumented malware suite researchers call “Net-Star.” It is a .NET malware suite for targeting Microsoft Internet Information Services web servers.
Net-Star consists of a fileless backdoor that deploys entirely in computer memory and two variants of .NET malware loaders. The backdoor, tracked as IIServerCore, operators within the w3wp.exe worker process of Internet Information Services servers.
Underscoring the group’s shift from targeting email servers to directly stealing from databases is the threat actor’s use of script, mssq.bat, which can connect to a SQL Server database using a password hackers previously stole. The script executes query searchers and exports the results to a CSV file for exfiltration.
Unit 42 first detected activity it now attributes to Phantom Taurus in June 2023, when it detected suspicious activity originating from an Exchange server’s w3wp.exe process, “which upon investigation appeared to be resulting from an in-memory VBscript implant deployed by the threat actor.
The threat intel firm was able to make a connection to China in May 2024, when it spotted the threat actor deploying backdoors that very likely borrowed source code from Ghost RAT, a Trojan developed by Chinese threat actor C. Rufus Security Team. Ghost RAT appears to date to 2008 and played a key role in a hacking campaign known as GhostNet that targeted Dali Lama Tibetan exile centers.
With reporting by Information Security Media Group’s David Perera in Northern Virginia.