New Threat Emerges! Multiple Healthcare and Shipping Firms in Asia Under Attack

Several shipping companies and medical laboratories in Asia have recently been targeted in a suspected espionage campaign. This attack did not deploy any custom malware and appeared to rely entirely on publicly available LotL tools.

The actor behind it, Hydrochasma, has not been linked to any previously known groups, but seems interested in industries related to COVID-19 treatments or vaccines.

This activity has been ongoing since at least October 2022. Although SecurityAssure Labs did not find any data exfiltration in this campaign, the targets and some of the tools used suggest that the most likely motivation for this campaign is intelligence gathering.

The infection vector used by Hydrochasma is highly likely to be phishing emails. The first suspicious activity observed on the compromised systems was a lure file, which used the victim organisation's native language for the filename and looked like an attachment:

[TRANSLATED FROM THE ORIGINAL] Product Specification-Freight-Company Qualification Information wps-pdf Export.pdf.exe

Another lure file disguised as a CV:

[TRANSLATED FROM THE ORIGINAL] [REDACTED] University-Development Engineer.exe

After gaining initial access to a machine, the attackers dropped Fast Reverse Proxy (FRP), a tool that can expose a local server behind a NAT or firewall to the internet. It dropped a legitimate Microsoft Edge update file: %TEMP%\MicrosoftEdgeUpdate.exe

Next, another file, %TEMP%/msedgeupdate.dll, appeared on the victim's machine. But this file is actually Meterpreter, a tool belonging to the Metasploit framework that can be used for remote access.

Tools that subsequently appeared on the victim's network included:

• Gogo scanning tool: An automated scanning engine, originally designed for use by red teams.

• Process Dumper (lsass.exe): A tool that allows attackers to dump domain passwords.

• Cobalt Strike Beacon: An off-the-shelf tool that can be used to execute commands, inject into other processes, elevate the current process, or impersonate other processes, and upload and download files. It can ostensibly be used legitimately as a penetration testing tool, but is invariably exploited by attackers.

• AlliN scanning tool: A penetration testing scanning tool that can be used for lateral movement within internal networks.

• Fscan: A publicly available hacking tool that can scan open ports, among other things.

• Dogz proxy tool: A free VPN proxy tool.

The attackers also deployed a shellcode loader and a corrupted portable executable (PE) on the victim's network.

Other tactics, techniques, and procedures (TTPs) observed across these campaigns include:

• SoftEtherVPN: The presence of this tool was the primary reason for our investigation into this campaign. It is free, open-source, cross-platform VPN software.

• Procdump: Microsoft's Sysinternals tool for monitoring applications for CPU spikes and generating crash dumps, but can also be used as a general process dumping tool.

• BrowserGhost: A publicly available tool to harvest passwords from internet browsers.

• Gost proxy: A tunneling tool. Ntlmrelay: NTLM relay attacks allow attackers to intercept valid authentication requests to access network services.

• Task Scheduler: Allows tasks to be executed automatically on a computer.

• Go-strip: Used to reduce the size of Go binaries.

• HackBrowserData: An open-source tool that can decrypt browser data.

The tools deployed by Hydrochasma indicate a desire to achieve persistent, stealthy access to victims' machines, as well as efforts to escalate privileges and move laterally within victims' networks.

While our security researchers did not observe any exfiltration of victim data, some of the tools deployed by Hydrochasma do allow remote access and could potentially be used for data exfiltration. The targeted organisations also suggest that the motivation for these attacks may currently be solely intelligence gathering.

It is also noteworthy that no custom malware was used in these attacks. Relying entirely on off-the-shelf, publicly available tools can make the attacks more stealthy, whilst also making detection and attribution more difficult. There is no evidence to link this campaign to any known threat group, so we are using Hydrochasma to name these activities.

The SecurityAssure security metrics validation platform has incorporated this technique into its simulated attack library. Search for "Hydrochasma" within the platform to obtain the relevant attack simulation experiments. We will use repeatable, continuous end-to-end testing with attack experiments that reference real attacks and cover all attack stages, thereby verifying whether the deployed security measures are working as expected and can effectively counter this attack method.