Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

An Investigation Into Years of Undetected Operations Targeting High-Value Sectors

Summary: Unit 42 has tracked a previously undocumented activity cluster it calls CL-UNK-1068, targeting aviation, energy, government, law enforcement, pharmaceutical, technology and telecommunications organizations across South, Southeast and East Asia since at least 2020. The group, assessed with high confidence as a Chinese threat actor, gains initial access through GodZilla and AntSword web shells, then uses DLL side-loading via legitimate Python executables, custom Go-based ScanPortPlus scanning, custom-compiled FRP, Xnote malware, and tools like Mimikatz and LsaRecorder for credential theft.

What you should know: This actor has kept operations stealthy for roughly five years using mostly open-source utilities, community-shared malware and batch scripts rather than bespoke implants, which means signature-based defenses tuned to custom malware would have missed it entirely. The exfiltration method is equally telling: attackers encoded stolen archives as text and printed them to screen to move data out without uploading a single file.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Threat Actors & Nation-State
Related