Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Chinese APT Targeting Cambodian Government

Summary: Unit 42 identified Chinese APT infrastructure masquerading as cloud backup services, with network connections from at least 24 Cambodian government organizations observed between September and October 2023. The researchers assess with high confidence that these entities were targeted and remain compromised, with the target-facing IP addresses used as command and control infrastructure running a Cowrie honeypot on port 2222 to deceive investigators.

Key Takeaway: Twenty-four government organizations in a single country, holding vast amounts of sensitive data, were in persistent contact with actor-controlled infrastructure for months - and the actor's activity dropped off during China's Golden Week holiday, a pattern that points to operators working China Standard Time business hours.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related