Key industries in 12 provinces attacked as overseas APT group storm strikes!

▍Event Overview

Detection has revealed that since November last year, overseas hackers have utilized multiple attack assets to launch attacks against several targets in 18 cities across 12 provinces in China, which may increase the risk of data leakage. Further tracing of historical attacks and real-time risk status assessment indicated that between November 2022 and February 2023, the attackers exploited vulnerabilities in a domestic firewall to target 23 high-value targets across critical sectors in China, including healthcare, energy, chemical, geological, and infrastructure. Due to the large target coverage and wide-ranging impact of this APT attack campaign, which began in November 2022 close to the landing time of Tropical Storm Nalgae, this campaign has been named "Storm Nalgae".

Following multi-party attribution analysis, this APT attack is believed to be carried out by "OceanLotus", a hacker group with a Vietnamese government background. OceanLotus (APT32, also known as OceanLotus) is an active hacker group in Southeast Asia, with their attacks primarily focused on governments, diplomacy, business, and human rights organizations. The group is believed to have links to the Vietnamese government, though this remains unconfirmed.

Utilizing its attack techniques and resources, OceanLotus has conducted organized, planned, and targeted long-term, continuous attacks on high-value targets in China's critical industries in recent years, including scientific research institutes, maritime agencies, marine construction, and shipping companies, demonstrating clear attack intentions and a strong geopolitical inclination. This incident poses a serious threat and challenge to China's network security and information security, demanding high attention and effective response and prevention measures.

▍Attack Vectors

OceanLotus primarily distributes Trojan horse programs to specific domestic target groups through methods such as spear-phishing and watering hole attacks to secretly control target users' computer systems and steal confidential data from critical areas within the system:

• Spear-phishing: Spear-phishing is an attack targeting specific individuals or organizations. Hackers utilize social engineering and other means to send seemingly legitimate emails, text messages, or social media messages to target users, enticing them to click links or download attachments, thereby infecting them with malware or leaking sensitive information. Spear-phishing is characterized by covert tactics, precise targeting, and a high success rate.

• Watering hole attack: A watering hole attack targets specific websites or applications. Hackers exploit vulnerabilities or social engineering to plant malicious code into the target website or application. Once a user visits, they are infected with malware or experience sensitive data leaks. Watering hole attacks are characterized by covert methods, wide coverage, and a high success rate.

OceanLotus has also utilized advanced techniques, such as zero-day exploits and custom malware, to bypass security defense measures. The group frequently uses internal tools and techniques in its attacks, such as BITSAdmin, regsvr32, and PowerShell, making its attacks more difficult to detect and trace.

▍Enterprises Must Maintain High Vigilance

The activities of OceanLotus have drawn concern and vigilance from the international community. Many countries and organizations have taken measures to protect themselves against the group. With its broad target range, OceanLotus could launch cyberattacks against Chinese enterprises and organizations at any time.

A common misconception in enterprise security defense is assuming these hacker groups won't attack us and that we won't be their targets. This overlooks the fact that once these hacker groups are publicly named, their attack techniques also become public. Hackers, white hats, and penetration testing professionals worldwide can see and learn to use these techniques. Furthermore, different hacker groups may adopt similar, proven-effective attack methods, which can create confusion and increase the difficulty of attribution. Hacker attack techniques and methods are diverse; hence, enterprises need to remain highly vigilant, pay as much attention as possible to the attack methods, techniques, trends, and major vulnerabilities of all publicly named hacker groups, update their security measures in a timely manner, and strengthen security monitoring and early warnings to prevent hackers from achieving long-term stealth to fulfill their attack objectives, thereby reducing their own losses.

The simulated attack library of the SecurityMetrics Validation Platform covers over 200 named threat organizations including APT, UNC, FIN, special naming, and temporary naming, such as OceanLotus (APT32), Bitter, Poison Ivy, Sidewinder, APT28, and more. Search for "APT32" within the platform to access relevant attack simulation experiments and verify whether your security defense system can effectively counter the various attack techniques of this hacker organization.

Build Long-term Security with Continuous Validation

Long press the image to scan the QR code and add [Official Customer Service]