Chinese APTs Targeted ASEAN During Summit with Espionage Malware

Chinese APT groups launched a cyberespionage campaign targeting ASEAN organizations with malware, coinciding with the recent ASEAN-Australia Special Summit — Palo Alto Networks’ Unit 42 report reveals the attacks, highlighting the need for robust cybersecurity measures in Southeast Asia.

A recent report by Palo Alto Networks’ Unit 42 cybersecurity research team has revealed a coordinated cyber espionage campaign that targeted countries affiliated with the Association of Southeast Asian Nations (ASEAN). The Chinese Advanced Persistent Threat (APT) groups are blamed for this.

The report, titled “ASEAN Entities in the Spotlight: Chinese APT Group Targeting,” highlights the activities of two separate APT groups. One identified group is Stately Taurus, a well-known threat actor with a history of cyberespionage operations.

Unit 42 researchers discovered that the cyber attack involved two malicious packages including “Talking_Points_for_China.zip,” a ZIP file and “PSO.scr,” an executable screensaver file. One of these malware packages was created by Stately Taurus specifically matching with the dates of the ASEAN-Australia Special Summit held in March 2024 in Melbourne.

The malicious package (Screenshot: Unit 42)

This suggests a targeted effort to gather intelligence during the critical regional event. This incident is also similar to the one in July 2023, where pro-Ukraine attendees of the NATO Summit were targeted with the RomCom RAT malware. Russian government hackers were suspected in that case.

“These types of campaigns continue to demonstrate how organizations are targeted for cyber espionage purposes, where nation-state affiliated threat groups collect intelligence of geopolitical interests within the region”

Palo Alto Networks’ Unit 42

The report goes on to show why organizations within ASEAN countries must take strong measures to defend against such cyberattacks. Palo Alto Networks recommends deploying advanced security solutions like DNS Security, Advanced URL Filtering, and WildFire to mitigate these threats.

While the Unit 42 report identifies two specific APT groups, the full extent of the campaign and the potential involvement of other actors remain under investigation. Continued monitoring and threat intelligence gathering are essential to fully understand the scope of this espionage activity.

Nevertheless, this discovery comes amidst heightened geopolitical tensions in the Southeast Asian region. The targeted nature of the attacks, coinciding with a major regional summit, raises concerns about potential attempts to gain an advantage in international relations.

Cybersecurity experts are urging ASEAN member states and affiliated organizations to remain alert against such cyberespionage efforts. Collaboration on information sharing and implementing proper cybersecurity measures is a must to defend against these ongoing threats.

1. China Arrests 4 for Weaponizing ChatGPT for Ransomware Attack
2. China-Linked Spyware Found in Google Play Apps, 2m Downloads
3. Chinese Evasive Panda Targets Tibetans with Nightdoor Backdoor
4. China-Blackwood APT Uses NSPX30 Backdoor in Cyberespionage
5. Chinese Hackers Hack Dutch Defense Networks with Coathanger RAT