Chinese APT Mimics Cloud Backup
A malicious SSL certificate was found to be used by six facing IP addresses, each of which had several host domains linked with six domains.
Since these domains provide a sense of legitimacy to their names, they draw an unusual amount of traffic during high levels of activities like data exfiltration from the victim network.
24 Cambodian government organizations were found to be regularly communicating with this infrastructure
The observed activity aligns with geopolitical goals of the Chinese government as it seeks to leverage their strong relations with Cambodia to project their power and expand their naval operations in the region. We encourage all organizations to leverage our findings to inform the deployment of protective measures to defend against this activity.
Australian Secret Intelligence Service
https://en.wikipedia.org/wiki/Australian_Intelligence_Community
Probably a good idea for the Aussies to know.
A complete report about the threat actors’ activities has been published, providing detailed information about the compromise, Cambodian government entities, and other information.
Unit 42 has identified malicious Chinese APT infrastructure masquerading as cloud backup services. Monitoring telemetry associated with two prominent Chinese APT groups,
#CoSoSec
https://unit42.paloaltonetworks.com/chinese-apt-linked-to-cambodia-government-attacks/