Introduction
These are reported APT activities attributed to a country, but not to an individual threat group.
Activities and Tactics
Country of Origin: 🇨🇳 [“China”]
Notable Campaigns
- 2018-01
- 2019-06
- 2020-02
- 2020-03
- 2020-10
- 2021
- 2022-01
- 2022-10
- 2023
- 2023-04
- 2023-09
- 2023-10
- 2024-02
- Amnesty International Canada breached by suspected Chinese hackers
- Barracuda ESG Zero-Day Vulnerability (CVE-2023-2868) Exploited Globally by Aggressive and Skilled Actor
- China blamed for data theft from US Navy contractor
- China hacked Japan’s sensitive defense networks
- China is main suspect
- China-Linked Threat Group Targets Taiwan Critical Infrastructure
- China-Taiwan Tensions Spark Surge in Cyberattacks on Taiwan
- Chinese APT Targeting Cambodian Government
- Hackers stole ‘sensitive’ data from Taiwan telecom giant: ministry
- Likely China-based Attackers Target High-profile Organizations in Southeast Asia
- Ministry of Defence of the Netherlands uncovers COATHANGER
- Minority report: Fake human rights documents and websites used in cyberattacks targeting Uyghurs
- Mitsubishi Electric discloses security breach
- News Corp discloses hack from ‘persistent’ nation state cyber attacks
- Smokescreen Ransomware
- Suspected Chinese Threat Actors Exploiting FortiOS Vulnerability (CVE-2022-42475)
- Suspected Links to China
- Unknown China-Based APT Targeting Myanmarese Entities
- a Turkic ethnic minority in China
- a stealthy Chinese FortiGate RAT
- https://blog.checkpoint.com/security/minority-report-fake-human-rights-documents-and-websites-used-in-cyberattacks-targeting-uyghurs-a-turkic-ethnic-minority-in-china/
- https://english.ncsc.nl/latest/news/2024/june/10/ongoing-state-sponsored-cyber-espionage-campaign-via-vulnerable-edge-devices
- https://medium.com/cycraft/china-linked-threat-group-targets-taiwan-critical-infrastructure-smokescreen-ransomware-c2a155aa53d5
- https://unit42.paloaltonetworks.com/chinese-apt-linked-to-cambodia-government-attacks/
- https://www.anomali.com/blog/unknown-china-based-apt-targeting-myanmarese-entities#When:14:00:00Z
- https://www.bleepingcomputer.com/news/security/amnesty-international-canada-breached-by-suspected-chinese-hackers/
- https://www.bleepingcomputer.com/news/security/news-corp-discloses-hack-from-persistent-nation-state-cyber-attacks/
- https://www.france24.com/en/live-news/20240301-hackers-stole-sensitive-data-from-taiwan-telecom-giant-ministry
- https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally
- https://www.mandiant.com/resources/blog/chinese-actors-exploit-fortios-flaw
- https://www.ncsc.nl/binaries/ncsc/documenten/publicaties/2024/februari/6/mivd-aivd-advisory-coathanger-tlp-clear/TLP-CLEAR+MIVD+AIVD+Advisory+COATHANGER.pdf
- https://www.security.com/threat-intelligence/china-southeast-asia-espionage
- https://www.trellix.com/blogs/research/china-taiwan-tensions-spark-surge-in-cyberattacks-on-taiwan/
- https://www.washingtonpost.com/national-security/2023/08/07/china-japan-hack-pentagon/
- https://www.zdnet.com/article/china-blamed-for-data-theft-from-us-navy-contractor/
- https://www.zdnet.com/article/mitsubishi-electric-discloses-security-breach-china-is-main-suspect/
- officials say
Tactics, Techniques, and Procedures (TTPs)
Information pending cataloguing.
Notable Indicators of Compromise (IOCs)
No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.
Malware and Tools
- COATHANGER
- COATHANGER:
Attribution and Evidence
Country of Origin: [“China”] Additional attribution information pending cataloguing.
References
References pending cataloguing.