SPIDER1CODE

Title:
Covert Espionage in Asia’s Communication Networks

Hello and welcome, dear reader, to a new article 😁

In one of the most serious cyber espionage campaigns recently discovered, Palo Alto Networks – Unit 42 reported intense activity from an advanced threat group known as CL-STA-0969, which is believed to have targeted the critical telecommunications infrastructure of Southeast Asia over a span of ten months.

It is suspected that this operation was state-sponsored 🕵🏻

---

🧠 So, what was their goal?

Their primary goal was to silently infiltrate and control telecom networks without detection — complete stealth.

Investigations revealed that the attacks occurred between February and November 2024, with the primary objective being Remote Code Execution (RCE) for data theft, without requiring user interaction.

---

⚠️ Wait — what is RCE?

RCE (Remote Code Execution) is a cyberattack that allows an attacker to gain access to a system and execute commands remotely via a shell — one of the most dangerous forms of attack.

---

🔍 Example of the attack:

The attackers used a tool called Cordscan to gather intelligence about network devices.
To this day, no direct evidence has been found regarding their initial access point.

Then, they performed brute-force attacks on SSH protocols, eventually gaining access and planting multiple malware payloads:

AuthDoor: A malicious authentication module that steals credentials and allows persistent access using a "magic password."

Cordscan: A network scanning and packet capturing tool.

GTPDOOR: Specifically built for telecom networks near GPRS roaming exchanges.

EchoBackdoor: A passive backdoor using ICMP packets for command execution and result delivery.

SGSN Emulator (sgsnemu): Bypasses firewalls through network manipulation.

ChronosRAT: Malware capable of executing shellcode, capturing screenshots, keylogging, and more.

NoDepDNS (MyDns): A Go-based backdoor that receives commands over DNS using UDP on port 53.

---

🎯 Targeted Threat Groups:

They also interacted with or mimicked operations of other known APTs:

LightBasin (UNC1945): Targeting telecom since 2016.

UNC2891: Financially motivated, known for ATM attacks.

UNC3886: Exploited vulnerabilities in VMware systems.

---

🧰 Tools Used:

Microsocks Proxy

FRP (Fast Reverse Proxy)

FScan

Responder

ProxyChains

---

🔓 CVEs Exploited:

CVE-2016-5195

CVE-2021-4034

CVE-2021-3156

---

🕵️‍♂️ Stealth Techniques:

DNS tunneling for traffic obfuscation

Using compromised telecom infrastructure as intermediate relays

Log tampering and credential wiping

Disabling SELinux

Renaming malicious processes to appear legitimate

---

🌍 International Response – China & USA

When asked on Fox News about alleged Chinese cyberattacks on U.S. telecom infrastructure and intellectual property theft, former U.S. President Donald Trump responded:

> “You really think we don’t do that too?
We do a lot of things like that... the world isn’t simple.”

This controversy coincided with statements from a Chinese tech team claiming China was the victim, after discovering a Zero-Day vulnerability in Microsoft Exchange.

They further alleged that over 50 devices belonging to a major Chinese military entity were compromised between July 2022 and July 2023.

The Chinese claimed the targets included universities, research institutes, and satellite internet companies.

According to their reports, U.S. hackers exploited electronic file system vulnerabilities to compromise the targets between July and November 2024.

---

Source:
The Hacker News – CL-STA-0969 Campaign

570 views10:00