Security News > 2024 > May > Chinese hackers hide on military and govt networks for 6 years
![Chinese hackers hide on military and govt networks for 6 years](/static/build/img/news/chinese-hackers-hide-on-military-and-govt-networks-for-6-years-medium.jpg)
Unfading Sea Haze attacks start with spear-phishing emails carrying malicious ZIP archives that contain LNK files disguised as documents.
In earlier attacks, the hacker also used Ps2dllLoader, a tool that loads.
Interestingly, a custom tool checks for newly plugged USB and Windows Portable Devices every ten seconds and sends device details and specific files to the attackers.
To exfiltrate data from breached systems, Unfading Sea Haze uses a custom tool named 'DustyExfilTool' that performs secure data extraction via TLS over TCP. More recent attacks show that the threat actors have switched to a curl utility and the FTP protocol for data exfiltration, now also using dynamically generated credentials that are changed frequently.
Unfading Sea Haze shows stealth, persistence, and adaptability, leveraging fileless attacks, advanced evasion methods, and modular malware design.
Kimsuky hackers deploy new Linux backdoor in attacks on South Korea.
News URL
Related news
- Poland says Russian military hackers target its govt networks (source)
- Researchers Warn of Chinese-Aligned Hackers Targeting South China Sea Countries (source)
- Chinese hackers breached 20,000 FortiGate systems worldwide (source)
- 20,000 FortiGate appliances compromised by Chinese hackers (source)
- Chinese Hackers Deploy SpiceRAT and SugarGh0st in Global Espionage Campaign (source)