Chinese state-sponsored cyber espionage ring expands activity: report

Sophos has released a report, titled ‘Crimson Palace returns: New Tools, Tactics, Targets’, which details the latest developments in a nearly two-year-long Chinese cyber espionage campaign in Southeast Asia. Sophos X-Ops first reported on what they named Operation Crimson Palace in June, detailing their discovery of three separate clusters of Chinese nation-state activity — Cluster Alpha, Cluster Bravo and Cluster Charlie — inside a high-profile government organisation. After a brief hiatus, Sophos X-Ops noted renewed Cluster Bravo and Cluster Charlie activity, both within the initial targeted organisation and in numerous other organisations within the region.

While investigating this renewed activity, Sophos X-Ops uncovered a novel keylogger that the threat hunters named ‘Tattletale’, which can impersonate users who have signed into the system and gather information related to password policies, security settings, cached passwords, browser information and storage data. Sophos X-Ops also notes in the report that, in contrast to the first wave of the operation, Cluster Charlie increasingly switched to using open-source tools rather than deploying the types of custom malware they developed in the initial wave of activity.

“We’ve been in an ongoing chess match with these adversaries. During the initial phases of the operation, Cluster Charlie was deploying various bespoke tools and malware,” said Paul Jaramillo, Director, Threat Hunting and Threat Intelligence, Sophos. “However, we were able to ‘burn’ much of their previous infrastructure, blocking their command-and-control (C2) tools and forcing them to pivot. This is good; however, their switch to open-source tools demonstrates just how quickly these attacker groups can adapt and remain persistent. It also appears to be an emerging trend among Chinese nation-state groups. As the security community works to secure our most sensitive systems from these attackers, it’s important to share the insights into this pivot.”

Cluster Charlie, which shares tactics, techniques and procedures (TTPs) with the Chinese threat group Earth Longzhi, was originally active from March to August 2023 in a high-level government organisation in Southeast Asia. While the cluster was dormant for several weeks, it re-emerged in September 2023 and was active again until at least May 2024. During this second stage of the campaign, Cluster Charlie focused on penetrating deeper into the network, evading endpoint detection and response tools and gathering further intelligence. In addition to switching to open-source tools, Cluster Charlie also began using tactics initially deployed by Cluster Alpha and Cluster Bravo, suggesting that the same overarching organisation is directing all three activity clusters. Sophos X-Ops has tracked ongoing Cluster Charlie activity across multiple other organisations in Southeast Asia.

Cluster Bravo, which shares TTPs with the Chinese threat group Unfading Sea Haze, was originally only active in the targeted network for a three-week span in March 2023. However, the cluster reappeared in January 2024, only this time it was targeting at least 11 other organisations and agencies in the same region.

“Not only are we seeing all three of the ‘Crimson Palace’ clusters refine and coordinate their tactics, but they’re also expanding their operations, attempting to infiltrate other targets in Southeast Asia,” Jaramillo said. “Given how frequently Chinese nation-state groups share infrastructure and tools, and the fact that Cluster Bravo and Cluster Charlie are moving beyond the original target, we will likely continue to see this campaign evolve — and in potentially new locations. We will be monitoring it closely.”

For an in-depth look at the threat hunting behind this nearly two-year-long cyber espionage campaign, readers can register for the upcoming webinar ‘Intrigue of the Hunt: Operation Crimson Palace: Unveiling a Multi-Headed State-Sponsored Campaign’, to be held on 24 September at 2 pm ET (USA): https://events.sophos.com/operation-crimson-palace/.

For a technical deep dive, click here.

Image credit: iStock.com/zhaojiankang