Malware · Vulnerabilities · Threat Intelligence
Chinese Government-linked Hackers Use Automated and Manual Tools to Steal Data Worldwide
US authorities warn that hackers linked to the Chinese government are using both automated and hands-on methods to steal sensitive data from organisations around the world, including critical infrastructure.
Ross Grant3 min read
The short version
US authorities say hackers linked to the Chinese government are using both automated tools and manual hacking to break into organisations and steal sensitive data. They use scanning tools to find weaknesses, install malware, and hide their tracks with VPN software. The attackers target a wide range of organisations, including those running critical infrastructure.
What happened?
CISA and the FBI have warned that hackers linked to the Chinese government are using a mix of automated tools and hands-on hacking to steal sensitive data from organisations around the world. The attackers, supported by Integrity Technology Group, use scanning tools, malware, and legitimate VPN software to gain and maintain access to victim networks, including US critical infrastructure.
Who is behind the attacks?
The US Cybersecurity and Infrastructure Security Agency (CISA) and FBI have issued a joint advisory warning about cyber threat actors linked to the Chinese government. These groups are enabled by a China-based company called Integrity Technology Group (Integrity Tech). According to CISA, Integrity Tech supports malicious cyber activity by building and selling hacking tools, hosting infrastructure, and helping compromise networks globally. The groups' tactics overlap with those known as Flax Typhoon, Ethereal Panda, and Red Juliett, but the US government notes that tracking names and methods can differ between cybersecurity companies and official agencies.CISA (opens in a new tab)
How do the attackers operate?
The attackers use a mix of automated scanning tools and hands-on hacking. They start by scanning the internet for vulnerable systems using open source tools like NMAP, masscan, and dirsearch. These tools help them find weaknesses in websites and network services, especially on common ports such as FTP (21), SSH (22), DNS (53), HTTP (80), HTTPS (443), and SOCKS (1080). They look for web pages built with PHP or ASP.NET, and target known software like OpenSSL, Oracle WebLogic, WordPress, Jenkins, and Apache Struts.
A custom tool called MicroScan is used to automate much of this process. MicroScan contains over 1,300 scripts to probe for specific vulnerabilities. Once a weakness is found, the attackers may use cross-site scripting (XSS) attacks to deliver malware. For example, a malicious file called live700_v1.exe is delivered via a password-protected zip file. When run, this file mimics legitimate Windows software, but actually connects to attacker-controlled servers and tries to steal email data from the victim's computer.
How do they maintain access and steal data?
To keep access to compromised systems, the attackers install legitimate VPN software called SoftEther. This helps hide their activity and makes it harder for defenders to spot the intrusion. The VPN client is often disguised with names like conhost.exe or dllhost.exe to look like normal Windows files. The attackers configure the VPN to reconnect automatically, ensuring they can return even if the system restarts.
For stealing data, the attackers use several techniques. They target Microsoft Office365 and Exchange email accounts using a tool called EBurst, which tries to guess passwords through different interfaces. They also use scripts to pull emails and other data, then upload the stolen information to remote servers. The attackers use misleading file names to hide their tracks, such as naming email dumps "All_scanner_vXX.pl.gz". Some scripts are designed to interact directly with Microsoft Exchange Web Services (EWS) to extract emails, calendars, and contacts.
What organisations are at risk?
CISA and the FBI report that these attacks target organisations worldwide, including US critical infrastructure sectors. This means that utilities, government agencies, and private companies with sensitive data are all potential victims. The attackers' use of open source tools and broad scanning means that any organisation with exposed internet-facing systems could be at risk if they have unpatched vulnerabilities.
What should defenders do?
CISA and the FBI recommend that network defenders monitor for the use of the scanning tools and VPN software mentioned in the advisory. They should also check for unusual file names and processes, especially those mimicking Windows system files. Monitoring for suspicious outbound connections, especially to domains or IP addresses linked to Integrity Tech, can help detect ongoing attacks. Organisations should ensure that all software is up to date and that strong, unique passwords are used for all accounts, especially email and remote access systems.
What happens next?
The advisory includes a list of indicators of compromise and technical details for defenders. Organisations are encouraged to review these resources and update their defences accordingly. As the attackers continue to evolve their methods, staying informed and vigilant is key to reducing the risk of data theft.
Claimed vs confirmed
- Confirmed
Chinese government-linked threat actors are stealing sensitive data using automated and hands-on tools.
CISA and the FBI have jointly confirmed this activity in their advisory.
The impact
- Money
- There is no public estimate of financial losses. However, under US law, organisations suffering a data breach may face costs for investigation, remediation, and possible regulatory fines.
- Reputation
- Organisations affected by these attacks may face reputational damage, especially if sensitive data is stolen or critical services are disrupted. The use of legitimate software by attackers makes detection harder and could delay public awareness.
- Customers
- Customers of affected organisations could have their data exposed or services disrupted. Anyone running internet-facing systems should ensure they are patched and monitored for suspicious activity.
Why it matters
These attacks put sensitive data and critical services at risk worldwide. Organisations with internet-facing systems are potential targets, especially if they have unpatched vulnerabilities. The use of both automated and manual techniques makes these attacks harder to detect and stop.
How does it work?
The attackers use open source scanning tools to find vulnerable systems, then exploit these weaknesses using automated scripts and manual methods. They deliver malware through cross-site scripting attacks and maintain access with legitimate VPN software. Data is stolen using scripts that extract emails and other sensitive information, which is then uploaded to attacker-controlled servers.
Key points
- Chinese government-linked hackers use both automated and manual methods to steal data.
- They scan for vulnerabilities, exploit them, and use malware and VPNs to maintain access.
- Targets include organisations worldwide, especially those in critical infrastructure.
- Attackers use open source tools and legitimate software to hide their activity.
- Defenders should monitor for known tools, unusual processes, and suspicious connections.
Sources
CISA
Government
FBI IC3
Government
