Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Squidoor: Suspected Chinese Threat Actor’s Backdoor Targets Global Organizations

Summary: Unit 42 Palo Alto Networks describes a suspected Chinese threat actor, tracked as CL-STA-0049, that has targeted governments, defense, telecommunications, education and aviation sectors in Southeast Asia and South America since at least March 2023, gaining entry through IIS server vulnerabilities and web shells. The actor uses a multi-platform backdoor named Squidoor (also called FinalDraft) with 10 Windows and nine Linux command-and-control methods, including Outlook email drafts and Pastebin, and executes it via the renamed Microsoft debugger cdb.exe.

Key Takeaway: The backdoor hides commands in ordinary Outlook traffic and uses a hard-coded refresh token to log in to the Microsoft identity platform, so mail and identity logs may be the only place this activity surfaces. The actor also pursued information on high-ranking officials at compromised organizations, not just general data.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Threat Actors & Nation-State
Related