New Chinese Cyberespionage Group Targeting IT Service Providers and Telcos

Telecommunications and IT company providers in the Middle East and Asia are currently being specific by a beforehand undocumented Chinese-talking menace team dubbed WIP19.

“Throughout this activity, the threat actor abused the certificate to sign several malicious components,” SentinelLabs explained.

“Almost all operations performed by the threat actor were completed in a ‘hands-on keyboard’ fashion during an interactive session with compromised machines. This meant the attacker gave up on a stable C2 channel in exchange for stealth.

“The use of WinEggDrop-authored malware, stolen certificates and correlating TTPs [tactics, techniques and procedures] indicate possible links to Operation Shadow Force, as reported by TrendMicro and AhnLab,” SentinelLabs explained.

“As the toolset itself appears to be shared among several actors, it is unclear whether this is a new iteration of operation ‘Shadow Force’ or simply a different actor utilizing similar TTPs. The activity we observed, however, represents a more mature actor, utilizing new malware and techniques.”

Additionally, SentinelLabs linked an implant dubbed “SQLMaggie,” recently described by DCSO CyTec, to WIP19’s latest activity. 

“SQLMaggie appears to be actively maintained and provides insights into the development timeline with hardcoded version names.”

The experts have no doubts about the attackers’ motivation, another China-linked threat actor is gathering intelligence with this operation.

IOCS

Follow Us on: Twitter, Instagram, Facebook to get the latest security news!