Cyber Risks · Unit 42 Palo Alto Networks

Operation Diplomatic Specter: An Active Chinese Cyberespionage Campaign Leverages Rare Tool Set to Target Governmental Entities in the Middle East, Africa and Asia

Summary: Unit 42 reports that a Chinese state-aligned APT group it calls TGR-STA-0043 has run Operation Diplomatic Specter since at least late 2022, targeting at least seven governmental entities in the Middle East, Africa and Asia and searching mail servers for information on foreign affairs ministries, embassies, military operations and personnel. The group used two previously undocumented backdoors, TunnelSpecter and SweetSpecter, which borrow small portions of leaked 2008 Gh0st RAT code and communicate with subdomains of microsoft-ns1[.]com, and gained initial access through the ProxyLogon (CVE-2021-26855) and ProxyShell (CVE-2021-34473) Exchange server exploits.
Bottom line: The actor exfiltrates automatically every day and resumed operations after being disrupted, so a single unpatched internet-facing Exchange server is not a one-time exposure but a standing collection channel into diplomatic and military correspondence.

Read the original at Unit 42 Palo Alto Networks ↗

Topics: Threat Actors & Nation-State
Mentions: CVE-2021-26855 CVE-2021-34473
Related: Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers Cyber Risks ·
CVE-2021-26855: Microsoft Exchange Server Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021
CVE-2021-34473: Microsoft Exchange Server Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021