Chinese espionage crew 'Ink Dragon' expands its snooping activities into European government servers
In the last few months, the China-linked threat Ink Dragon's activities show increased focus on government targets in Europe in addition to continued activities in Southeast Asia and South America.
Here is the original (technical) report: Inside Ink Dragon: Revealing the Relay Network and Inner Workings of a Stealthy Offensive Operation
...
These attacks begin with Ink Dragon probing security weaknesses, such as misconfigured Microsoft IIS and SharePoint servers, to gain access to victims' environments. This tactic, as opposed to abusing zero-days or other high-profile vulnerabilities, helps attackers fly under the radar and reduces their chances of being caught.
Ink Dragon then scoops up credentials and uses existing accounts to infiltrate targets, tactics that help the gang blend in with normal network traffic.
"This stage is typically characterized by low noise and spreads through infrastructure that shares the same credentials or management patterns," Check Point's researchers said in a Tuesday blog.
Once Ink Dragon finds an account with domain-level access, the spies set to work establishing long-term access across high-value systems, installing backdoors and implants that store credentials and other sensitive data.
...
In addition to their new targets and relay node activity, Check Point says the cyber spies have also updated their FinalDraft backdoor so that it blends in with common Microsoft cloud activity, hiding its command traffic inside mailbox drafts.
The new version also lets the malware check in during business hours - so as not to draw unwanted after-hour attention - and can more efficiently transfer large files with minimal noise.
...
The threat hunters' investigation into Ink Dragon also uncovered similar, stealth activity by another China-linked espionage crew RudePanda, which "had quietly entered several of the same government networks," they wrote.
While the two groups are unrelated, they both abused the same server vulnerability to gain access to the same IT environments. This also illustrates the changing tactics among other government-sponsored cyber squads, including not only Beijing-backed crews, but also those from Russia.
...
This has nothing to do with our "ally" in the West, nor any "ally." This is about China which apparently acts as an enemy of Europe that goes far beyond this cyberattack. The fact that the US gets worse doesn't make China in any way better.
I didnt say it does?!