Security News > 2024 > May > Chinese hackers hide on military and govt networks for 6 years
Unfading Sea Haze attacks start with spear-phishing emails carrying malicious ZIP archives that contain LNK files disguised as documents.
In earlier attacks, the hacker also used Ps2dllLoader, a tool that loads.
Interestingly, a custom tool checks for newly plugged USB and Windows Portable Devices every ten seconds and sends device details and specific files to the attackers.
To exfiltrate data from breached systems, Unfading Sea Haze uses a custom tool named 'DustyExfilTool' that performs secure data extraction via TLS over TCP. More recent attacks show that the threat actors have switched to a curl utility and the FTP protocol for data exfiltration, now also using dynamically generated credentials that are changed frequently.
Unfading Sea Haze shows stealth, persistence, and adaptability, leveraging fileless attacks, advanced evasion methods, and modular malware design.
Kimsuky hackers deploy new Linux backdoor in attacks on South Korea.
News URL
Related news
- Chinese hackers targeted sanctions office in Treasury attack (source)
- US sanctions Chinese company linked to Flax Typhoon hackers (source)
- Chinese hackers also breached Charter and Windstream networks (source)
- US adds web and gaming giant Tencent to list of Chinese military companies (source)
- US Treasury hack linked to Silk Typhoon Chinese state hackers (source)
- Chinese cyber-spies peek over shoulder of officials probing real-estate deals near American military bases (source)
- US sanctions Chinese firm, hacker behind telecom and Treasury hacks (source)
- Trump 'waved a white flag to Chinese hackers' as Homeland Security axed cyber advisory boards (source)
- Spain arrests suspected hacker of US and Spanish military agencies (source)
- Russian military hackers deploy malicious Windows activators in Ukraine (source)