Likely Chinese Hackers Infiltrated Asian telecom for 4 Years

An apparent Chinese cyber espionage operation lurked inside the network of an Asian telecom for four years, camouflaging its presence through nested encryption and lightweight web shells.

Incident response firm Sygnia has uncovered the operation, dubbing the threat actor “Weaver Act.” It exhibits several characteristics of a Chinese nation-state threat actor, including a wide reliance on the China Chopper web shell, a pattern of activity that matches the Chinese time zone and holidays – and a backdoor that other security researchers have attributed to a Chinese group tracked as APT27 and Emissary Panda (see: US Seizes Chinese Hacker Infrastructure, Unseals Indictments).

They also used an operational relay box comprised of compromised Zyxel CPE routers to pivot from one compromised device in the telecom network to another telecom provider’s network (see: Chinese Cyberespionage Groups Tied to ORB Network Attacks).

Chinese hackers have been uncovered on the inside of telecom networks spanning the globe, including a highly publicized eruption into U.S. providers by a group tracked as Salt Typhoon.

Alongside China Chopper, attackers deployed multiple web shells and backdoors, enabling them to maintain stealth within the company’s network and navigate laterally to infiltrate additional systems. Among the obfuscation techniques the hackers deployed was the use of specific keywords as parameters inside the customized China Chopper code. The keywords they chose, such as “password” and “key” are often automatically redacted or masked inside logs by web application firewalls – making payloads of stolen information harder to detect.

Hackers also deployed a second web shell Sygnia dubbed “INMemory Web Shell” since it enabled in-memory execution of malicious modules. The web shells were conduits for payloads, including one tool that enabled HTTP tunneling to access telecom systems. The web shells also acted as proxy servers to redirect inbound malicious traffic, a method for lateral movement inside a network.

Traffic tunneled between the web shells was encrypted, leading researchers to set up a system to mirror and capture packets received by a compromised server. Attackers used an encryption key hardcoded into their webshells.

“This enabled us to ‘peel’ each layer of encryption and obfuscation within the payload code upon receiving the full output, thereby recovering the actual command or binary intended for execution on the server side,” Sygnia wrote.

Over more than four years of access, the attackers gathered configuration files, access logs and credential data to map the network and identify high-value targets. They disabled security monitoring mechanisms, including Event Tracing for Windows patching and AMSI bypass techniques. This involved modifying the AmsiScanBuffer function within the Windows amsi.dll module, allowing them to minimize footprint and extend persistence.

Sygnia reported that it has evicted the threat actor from the compromised network but said that the group was actively attempting to regain access.