🇨🇳

Operation Shady RAT

APT Group Information theft and espionage ETDA ✓

Also Known As 2 names

Shady RAT Operation Shady RAT

Target Countries 20

Countries highlighted in red

Afghanistan Australia Canada Switzerland China Germany Denmark United Kingdom Hong Kong Indonesia India Italy Japan Republic of Korea Singapore Province of China Taiwan Ukraine United States Vietnam Yemen

Sectors Targeted

Finance and government organizations IT Space Research and Technology 927 National Security and International Affairs 928 Manufacturing Public Administration 92 Think Tanks Health Care and Social Assistance 62 Other Services (except Public Administration) 81 healthcare Technology Air Transportation 481 Utilities 22 Multiple and technology industries Arts, Entertainment, and Recreation 71 Government Multiple sectors including healthcare Telecommunications Construction of Buildings 236 Computer Systems Design and Related Services 5415 Industrial Sports Justice, Public Order, and Safety Activities 922 Healthcare Financial Computer Security Financial Services NAICS:48 48 Computer and Electronic Product Manufacturing 334 Transportation International Organizations Military Defense Aircraft Manufacturing 336411 and technology Accommodation and Food Services 72 NAICS:31 31 finance Educational Services 61 Energy Telecommunications 517 Computer Systems Design Services 541512 Professional, Scientific, and Technical Services 54 Education Non-profit organizations Finance and Insurance 52 Media Information 51 Entertainment

Details

Origin 🇨🇳 CN

Last Updated 11 May 2024

MITRE ATT&CK 5

T1055 T1059.001 T1078 T1105 T1566.002

Related Zero-Days

No zero-day CVE linked to this actor

Known Names 1 entries

Operation Shady RAT McAfee

Observed Target Countries 14

Based on ETDA data — countries highlighted in red

Canada Denmark Germany Hong Kong India Indonesia Japan Singapore South Korea Switzerland Taiwan UK USA Vietnam

Description

(McAfee) With the goal of raising the level of public awareness today we are publishing the most comprehensive analysis ever revealed of victim profiles from a five year targeted operation by one specific actor—Operation Shady RAT, as I have named it at McAfee (RAT is a common acronym in the industry which stands for Remote Access Tool). This is not a new attack, and the vast majority of the victims have long since remediated these specific infections (although whether most realized the seriousness of the intrusion or simply cleaned up the infected machine without further analysis into the data loss is an open question). McAfee has detected the malware variants and other relevant indicators for years with Generic Downloader.x and Generic BackDoor.t heuristic signatures (those who have had prior experience with this specific adversary may recognize it by the use of encrypted HTML comments in web pages that serve as a command channel to the infected machine). McAfee has gained access to one specific Command & Control server used by the intruders. We have collected logs that reveal the full extent of the victim population since mid-2006 when the log collection began. Note that the actual intrusion activity may have begun well before that time but that is the earliest evidence we have for the start of the compromises. The compromises themselves were standard procedure for these types of targeted intrusions: a spear-phishing email containing an exploit is sent to an individual with the right level of access at the company, and the exploit when opened on an unpatched system will trigger a download of the implant malware. That malware will execute and initiate a backdoor communication channel to the Command & Control web server and interpret the instructions encoded in the hidden comments embedded in the webpage code. This will be quickly followed by live intruders jumping on to the infected machine and proceeding to quickly escalate privileges and move laterally within the organization to establish new persistent footholds via additional compromised machines running implant malware, as well as targeting for quick exfiltration the key data they came for.

Reports & References 3

https://web.archive.org/web/20110804083836/http:/www.mcafee.com/us/resources/white-papers/wp-operation-shady-rat.pdf https://www.vanityfair.com/news/2011/09/chinese-hacking-201109 https://en.wikipedia.org/wiki/Operation_Shady_RAT

ETDA Profile

Operation Shady RAT

Origin

China

First Seen 2006

Sponsor State-sponsored, PLA Unit 61398

Motivation

Information theft and espionage

View on ETDA APT Groups ↗