Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Rare Backdoors Suspected to be Tied to Gelsemium APT Found in Targeted Attack in Southeast Asian Government

Summary: Unit 42 identified a threat cluster it calls CL-STA-0046 that spent over six months between 2022 and 2023 inside a Southeast Asian government's IIS servers, gaining entry through web shells and deploying the rare backdoors OwlProxy and SessionManager. Unit 42 attributes the activity to the Gelsemium APT group with moderate confidence, citing that combination of malware and a victimology overlap with a group ESET says has operated since at least 2014 against governments, universities, electronics manufacturers and religious organizations, mostly in East Asia and the Middle East.

Key Takeaway: The attackers adapted in real time: when Cortex XDR blocked OwlProxy and SessionManager, they pivoted to the publicly available EarthWorm SOCKS tunneler and a Cobalt Strike beacon to keep a tunnel from the victim's LAN to their command-and-control servers. Gelsemium has been active since at least 2014 with only a handful of public reports, so most defenders have little to match against its tactics.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Threat Actors & Nation-State
Related