🇨🇳

CL-STA-0043

APT Group Information theft and espionage 1 zero-day CVE ETDA ✓

Also Known As 1 names

TGR-STA-0043

Target Countries 2

Countries highlighted in red

United States South Africa

Sectors Targeted

Telecommunications Defense Food Services and Drinking Places 722 Retail Government Embassies Education

Details

Origin 🇨🇳 CN

Last Updated 25 Nov 2023

MITRE ATT&CK 4

T1059 T1071.001 T1203 T1566.001

Related Zero-Days 1

CVE-2023-0669

Known Names 3 entries

Operation Diplomatic Specter Palo Alto

CL-STA-0043 Palo Alto

TGR-STA-0043 Palo Alto

Observed Target Countries 2

Based on ETDA data — countries highlighted in red

USA Middle East, Africa and Asia

Description

(Palo Alto) A Chinese advanced persistent threat (APT) group has been conducting an ongoing campaign, which we call Operation Diplomatic Specter. This campaign has been targeting political entities in the Middle East, Africa and Asia since at least late 2022. An analysis of this threat actor’s activity reveals long-term espionage operations against at least seven governmental entities. The threat actor performed intelligence collection efforts at a large scale, leveraging rare email exfiltration techniques against compromised servers.

Tools Used 15

Agent Racoon China Chopper Gh0st RAT HTran JuicyPotatoNG LadonGo Mimikatz Mimilite nbtscan Ntospy PlugX SharpEfsPotato SweetSpecter TunnelSpecter Yasso

Reports & References 3

https://unit42.paloaltonetworks.com/operation-diplomatic-specter/ https://www.paloaltonetworks.com/blog/security-operations/through-the-cortex-xdr-lens-uncovering-a-new-activity-group-targeting-governments-in-the-middle-east-and-africa/ https://unit42.paloaltonetworks.com/new-toolset-targets-middle-east-africa-usa/

ETDA Profile

Operation Diplomatic Specter

Origin

China

First Seen 2022

Sponsor State-sponsored

Motivation

Information theft and espionage

View on ETDA APT Groups ↗