A newly identified cyber threat group, known as “Unfading Sea Haze,” has been secretly infiltrating military and government networks in the South China Sea region since 2018, according to a recent report by Bitdefender researchers. The group’s activities align with Chinese geopolitical interests, focusing on gathering intelligence and conducting espionage. Unfading Sea Haze shares many tactics, techniques, and procedures (TTPs) with other Chinese state-sponsored hacking groups, particularly APT41.
The group’s attacks typically begin with spear-phishing emails containing malicious ZIP files disguised as legitimate documents. These ZIP files, often named to appear as Windows Defender installers, contain LNK files with obfuscated PowerShell commands. If an ESET security executable is detected on the target system, the attack is halted. Otherwise, the PowerShell script uses Microsoft’s msbuild.exe to launch fileless malware directly into memory, leaving no traces on the victim’s machine.
The code executed by MSBuild installs a backdoor called ‘SerialPktdoor,’ which gives the attackers remote control over the compromised system. Additionally, the hackers use scheduled tasks and manipulate local administrator accounts to maintain their presence on the network. By resetting and enabling the typically disabled local admin account, they create a hidden profile for continuous access.
Unfading Sea Haze employs a variety of custom tools and malware. Among these are ‘xkeylog,’ a keylogger for capturing keystrokes, info-stealers targeting browser data, and PowerShell
[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.