Newly Discovered Chinese APT Operating Cyberespionage Campaign Against APAC Organizations Since 2013

Context

On June 9, 2022, SentinelLabs disclosed technical details of a new Chinese-speaking cyberespionage group designated Aoqin Dragon. According to researchers at SentinelLabs, the group has been operating a cyberespionage campaign against government, education, and telecommunication organizations in Southeast Asia and Australia from at least 2013 to the present. SentinelLabs researchers also assessed with moderate confidence that the group is connected to another Chinese APT tracked by Mandiant as UNC94. The motive and targeting of the group are closely aligned to Chinese state interests.

Technical Details

Researchers found that Aoqin Dragon threat actors seek initial access to target networks via document exploits and fake removable devices. Once access is gained, the threat actors leverage DLL hijacking, Themida-packed files, and DNS tunneling to evade post-compromise detection.

The infection chain of the campaign is as follows:

1. Threat actors send a phishing message to trick target users into opening a malicious Word document and installing the Mongall or Heyoka backdoor
2. Threat actors lure target users into double-clicking a fake anti-virus link to execute malware on the target host
3. Threat actors plant a malicious removable device and trick target users into opening a malicious folder and installing malware on their system

Between 2012 and 2015, the group heavily exploited CVE-2012-0158 and CVE-2010-3333, vulnerabilities affecting various MS Office versions that could allow remote code execution against target organizations.

The group primarily uses malicious documents with themes related to Asia-Pacific (APAC) regional geopolitics or pornographic material.

Analysis

This research fits with established trends observed in the RH-ISAC community for the APAC region: the prevalence of sophisticated phishing, exploitation of known unpatched vulnerabilities, and the cyberespionage motivation of the group. As discussed in the recent TLP:WHITE RH-ISAC Industry Insights for the 2022 Verizon DBIR, these trends are all well documented not just by the region as a whole, but by RH-ISAC membership specifically. While the targeted industries (government, education, and telecommunications) do not align perfectly with RH-ISAC membership sectors, members in the APAC region will undoubtedly interact with major organizations in the targeted sectors as vendors or partner organizations. As such, members should remain vigilant of the technical details and indicators associated with the group.

IOCs

SentinelLabs provided the following indicators of compromise (IOCs):