Security News > 2024 > May > Chinese hackers hide on military and govt networks for 6 years
Unfading Sea Haze attacks start with spear-phishing emails carrying malicious ZIP archives that contain LNK files disguised as documents.
In earlier attacks, the hacker also used Ps2dllLoader, a tool that loads.
Interestingly, a custom tool checks for newly plugged USB and Windows Portable Devices every ten seconds and sends device details and specific files to the attackers.
To exfiltrate data from breached systems, Unfading Sea Haze uses a custom tool named 'DustyExfilTool' that performs secure data extraction via TLS over TCP. More recent attacks show that the threat actors have switched to a curl utility and the FTP protocol for data exfiltration, now also using dynamically generated credentials that are changed frequently.
Unfading Sea Haze shows stealth, persistence, and adaptability, leveraging fileless attacks, advanced evasion methods, and modular malware design.
Kimsuky hackers deploy new Linux backdoor in attacks on South Korea.
News URL
Related news
- Spain arrests suspected hacker of US and Spanish military agencies (source)
- Russian military hackers deploy malicious Windows activators in Ukraine (source)
- Chinese hackers breach more US telecoms via unpatched Cisco routers (source)
- Chinese Hackers Exploit MAVInject.exe to Evade Detection in Targeted Cyber Attacks (source)
- Chinese hackers abuse Microsoft APP-v tool to evade antivirus (source)
- Chinese hackers use custom malware to spy on US telecom networks (source)
- Belgium probes if Chinese hackers breached its intelligence service (source)
- Belgium probes if Chinese hackers breached its intelligence service (source)
- US charges Chinese hackers linked to critical infrastructure breaches (source)
- Chinese Hackers Breach Juniper Networks Routers With Custom Backdoors and Rootkits (source)