Chinese Nation-State Hackers Breach Southeast Asian Telecoms

Chinese nation-state hackers penetrated mobile telecom networks across Southeast Asia likely in order to track individuals’ location, say security researchers.

Palo Alto Networks’ Unit 42 said hackers from the group it tracks as CL-STA-0969 don’t appear to have stolen data or to have communicated with mobile devices.

The campaign occurred between February and November 2024 and targeted mobile operators using a range of custom backdoors and publicly available tools.

One tell about the hackers’ intentions was deployment of a custom-made network scanning and packet capture utility tracked as CordScan. Cybersecurity firm CrowdStrike describes it as a tool that can capture common mobile telecom communication protocols, including SGSN, a protocol used to keep track of the location of mobile devices.

CL-STA-0969 heavily overlaps with activity CrowdStrike began tracking in 2024 as Liminal Panda. The threat actor, as CrowdStrike describes it, looks for low-security organizations that have connections with telecoms, against which hackers bring a deep understanding of mobile protocols.

CrowdStrike assesses with low confidence that Liminal Panda had a connection to official Chinese hacking operations, a qualification not shared by Palo Alto, which connected CL-STA-0969 to Beijing with high confidence.

Unit 42 said the attackers achieved initial access by brute-forcing SSH credentials, using a dictionary of usernames and passwords tailored for telecommunications equipment. Once inside, they deployed backdoors. Among them was a new backdoor called NoDepDNS, so named because it uses port 53 – generally recognized as the port for DNS – to tunnel through malicious communications.

To obscure their presence, the threat actors disguised malware with names mimicking legitimate telecom or system processes. They also manipulated the binaries’ timestamp – a technique known as timestomping – and disabled features of Security-Enhanced Linux such as by setting it to “permissive” mode in which the operating systems restricts itself to logging events rather than enforcing policy. They used tools to remove traces of activity from authentication logs.

The group’s “malware, tools and techniques reveal a calculated effort to maintain persistent, stealthy access,” Unit 42 wrote.

China has been the source of high-profile attacks against communications infrastructure, including attacks by the nation-state group tracked as Salt Typhoon against U.S. telecoms (see: Chinese Data Leak Reveals Salt Typhoon Contractors).

During a November Senate hearing, CrowdStrike executive Adam Meyers said China is placing a growing emphasis on bulk data collection, making communication networks obvious targets. “Their intention is to collect large amount of information that they can later exploit, whether that be political information, military information, or intellectual property,” he said.

“We’ve seen the Chinese over the past decade significantly up-level what they were doing,” Meyers added.