Samoa Issues Alert on APT40 Hackers Targeting Pacific Region

Chinese state-sponsored cyber group APT40 intensified its attacks on government and critical infrastructure networks in the Pacific region, prompting Samoa’s national cybersecurity agency to issue an urgent advisory.

See Also: Modernise Your IT Monitoring with Predictive Analytics

Samoa’s Computer Emergency Response Team, or SamCERT, warned that APT40 is deploying fileless malware and modified commodity malware to infiltrate and persist within networks while evading detection.

Most Chinese nation-state activity has focused on Southeast Asia and Western nations, but the advisory, based on SamCERT’s investigations and intelligence from partner nations, warned of cyberespionage risks posed by the group’s prolonged presence within targeted systems to the Blue Pacific region, which includes thousands of islands in the vast central Pacific Ocean.

“It is essential to note that throughout our investigations we have observed the threat actor pre-positioning themselves in the networks for long periods of time and remaining undetected before conducting exfiltration activity,” SamCERT wrote. “This activity is sophisticated.”

China-aligned APT40, tracked by Google as IslandDreams, in August 2023 launched a phishing campaign targeting victims in Papua New Guinea. The emails contained multiple attachments, including an exploit, a password-protected decoy PDF that couldn’t be opened, and an .lnk file. The .lnk file was designed to load a malicious .dll payload, either from a hard-coded IP address or a file-sharing site.

The final stage of the attack then tries to install BoxRat, an in-memory backdoor for .NET that links to attackers’ botnet command-and-control network through the Dropbox API.

APT40, previously linked to attacks on the United States and Australia, has shifted its focus to Pacific island nations, where it is using advanced tactics, including DLL side-loading, registry modifications and memory-based malware execution. The group’s methods also involve deploying modified reverse proxies to exfiltrate sensitive data while disguising command-and-control traffic.

SamCERT’s findings indicate that APT40 gains long-term access to networks, executing reconnaissance and data theft operations over extended periods.

The group relies on lateral movement across networks, often using legitimate administrative tools to evade security measures and maintain control.

The agency urges organizations to conduct systematic threat hunting, enable comprehensive logging, and review incident response plans. It also advises immediate patching of endpoints and firewalls to close vulnerabilities that APT40 exploits.