🇨🇳

Operation Diplomatic Specter

APT Group Information theft and espionage 1 zero-day CVE ETDA ✓

Also Known As

No alias recorded

Target Countries 10

Countries highlighted in red

Afghanistan Angola American Samoa Republic of Korea Montenegro Pakistan Turkmenistan United States Uzbekistan South Africa

Sectors Targeted

Education Defense Educational Services 61 Telecommunications Government National Security and International Affairs 928110 Telecommunications 517 Retail National Security and International Affairs 928 Public Administration 92 Professional, Scientific, and Technical Services 54 Embassies Space Research and Technology 927 Food Services and Drinking Places 722 NAICS:44 44 Accommodation and Food Services 72

Details

Origin 🇨🇳 CN

Last Updated 21 Jun 2024

MITRE ATT&CK 5

T1027.001 T1059.001 T1071.001 T1204.002 T1566.001

Related Zero-Days 1

CVE-2023-0669

Known Names 3 entries

Operation Diplomatic Specter Palo Alto

CL-STA-0043 Palo Alto

TGR-STA-0043 Palo Alto

Observed Target Countries 2

Based on ETDA data — countries highlighted in red

USA Middle East, Africa and Asia

Description

(Palo Alto) A Chinese advanced persistent threat (APT) group has been conducting an ongoing campaign, which we call Operation Diplomatic Specter. This campaign has been targeting political entities in the Middle East, Africa and Asia since at least late 2022. An analysis of this threat actor’s activity reveals long-term espionage operations against at least seven governmental entities. The threat actor performed intelligence collection efforts at a large scale, leveraging rare email exfiltration techniques against compromised servers.

Tools Used 15

Agent Racoon China Chopper Gh0st RAT HTran JuicyPotatoNG LadonGo Mimikatz Mimilite nbtscan Ntospy PlugX SharpEfsPotato SweetSpecter TunnelSpecter Yasso

Reports & References 3

https://unit42.paloaltonetworks.com/operation-diplomatic-specter/ https://www.paloaltonetworks.com/blog/security-operations/through-the-cortex-xdr-lens-uncovering-a-new-activity-group-targeting-governments-in-the-middle-east-and-africa/ https://unit42.paloaltonetworks.com/new-toolset-targets-middle-east-africa-usa/

ETDA Profile

Operation Diplomatic Specter

Origin

China

First Seen 2022

Sponsor State-sponsored

Motivation

Information theft and espionage

View on ETDA APT Groups ↗