Home Cyber Security Chinese language Hackers Launch Covert Espionage Assaults on 24 Cambodian Organizations

Chinese language Hackers Launch Covert Espionage Assaults on 24 Cambodian Organizations

Chinese language Hackers Launch Covert Espionage Assaults on 24 Cambodian Organizations


Nov 13, 2023NewsroomNationwide Safety / Cyber Assault

Espionage Campaign

Cybersecurity researchers have found what they are saying is malicious cyber exercise orchestrated by two outstanding Chinese language nation-state hacking teams concentrating on 24 Cambodian authorities organizations.

“This exercise is believed to be a part of a long-term espionage marketing campaign,” Palo Alto Networks Unit 42 researchers mentioned in a report final week.

“The noticed exercise aligns with geopolitical targets of the Chinese language authorities because it seeks to leverage their sturdy relations with Cambodia to undertaking their energy and increase their naval operations within the area.”

Focused organizations embrace protection, election oversight, human rights, nationwide treasury and finance, commerce, politics, pure assets, and telecommunications.

The evaluation stems from the persistent nature of inbound community connections originating from these entities to a China-linked adversarial infrastructure that masquerades as cloud backup and storage companies over a “interval of a number of months.”


A few of the command-and-control (C2) domains are listed under –

  • api.infinitycloud[.]information
  • join.infinitycloud[.]information
  • join.infinitybackup[.]internet
  • file.wonderbackup[.]com
  • login.wonderbackup[.]com
  • replace.wonderbackup[.]com

The tactic is probably going an try on the a part of the attackers to fly underneath the radar and mix in with legit community visitors.

What’s extra, the hyperlinks to China are based mostly on the truth that the risk actor’s exercise has been noticed primarily throughout common enterprise hours in China, with a drop recorded in late September and early October 2023, coinciding with the Golden Week nationwide holidays, earlier than resuming to common ranges on October 9.

Covert Espionage Attacks

China-nexus hacking teams reminiscent of Emissary Panda, Gelsemium, Granite Storm, Mustang Panda, RedHotel, ToddyCat, and UNC4191 have launched an array of espionage campaigns concentrating on public- and personal sectors throughout Asia in latest months.

Final month, Elastic Safety Labs detailed an intrusion set codenamed REF5961 that was discovered leveraging customized backdoors reminiscent of EAGERBEE, RUDEBIRD, DOWNTOWN, and BLOODALCHEMY in its assaults directed towards the Affiliation of Southeast Asian Nations (ASEAN) international locations.


The malware households “have been found to be co-residents with a beforehand reported intrusion set, REF2924,” the latter of which is assessed to be a China-aligned group owing to its use of ShadowPad and tactical overlaps with Winnti and ChamelGang.

The disclosures additionally observe a report from Recorded Future highlighting the shift in Chinese language cyber espionage exercise, describing it as extra mature and coordinated, and with a robust give attention to exploiting identified and zero-day flaws in public-facing e mail servers, safety, and community home equipment.

For the reason that starting of 2021, Chinese language state-sponsored teams have been attributed to the exploitation of 23 zero-day vulnerabilities, together with these recognized in Microsoft Trade Server, Solarwinds Serv-U, Sophos Firewall, Fortinet FortiOS, Barracuda E mail Safety Gateway, and Atlassian Confluence Information Middle and Server.

The state-sponsored cyber operations have advanced “from broad mental property theft to a extra focused strategy supporting particular strategic, financial, and geopolitical targets, reminiscent of these associated to the Belt and Street Initiative and important applied sciences,” the corporate mentioned.

Discovered this text fascinating? Observe us on Twitter and LinkedIn to learn extra unique content material we put up.



Please enter your comment!
Please enter your name here