🇨🇳

Hurricane Panda

APT Group Information theft and espionage 2 zero-day CVEs ETDA ✓

Also Known As

No alias recorded

Target Countries 1

Countries highlighted in red

United States

Sectors Targeted

Technology Public Administration 92 Telecommunications

Details

Origin 🇨🇳 CN

Last Updated 01 Jun 2022

MITRE ATT&CK 95

T1012 T1016 T1018 T1021 T1021.002 T1027 T1027.002 T1027.005 T1027.010 T1027.013 T1031 T1033 T1036 - Masquerading T1036.004 - Masquerade Task or Service T1040 - Network Sniffing T1041 T1043 T1045 - Software Packing T1047 T1053 - Scheduled Task/Job T1055 - Process Injection T1057 T1059 T1059.001 T1059.003 T1059.006 T1060 - Registry Run Keys / Startup Folder T1064 T1068 T1071 T1071.001 T1073 T1082 - System Information Discovery T1085 T1086 T1090 T1090.003 T1102 T1102.002 T1105 T1112 T1117 T1124 T1129 - Shared Modules T1132 T1132.001 T1133 T1140 T1143 T1189 T1190 T1193 T1199 - Trusted Relationship T1204 T1204.001 T1204.002 T1218 T1218.007 T1218.010 T1218.011 T1410 - Network Traffic Capture or Redirection T1448 - Carrier Billing Fraud T1505 T1505.003 T1543 T1543.003 T1546 T1546.008 T1547 T1547.001 T1555 T1555.003 T1564 T1564.003 T1566 T1566.001 T1566.002 T1567 T1567.002 T1573 T1573.001 T1574 T1574.001 T1574.002 T1583 T1583.001 T1583.006 T1584 T1584.008 T1588 T1588.002 T1598 T1598.003 T1665 TA0011 - Command and Control

Related Zero-Days 2

CVE-2017-0199 CVE-2019-0708

Known Names 1 entries

Hurricane Panda CrowdStrike

Description

(CrowdStrike) We have investigated their intrusions since 2013 and have been battling them nonstop over the last year at several large telecommunications and technology companies. The determination of this China-based adversary is truly impressive: they are like a dog with a bone. Hurricane Panda’s preferred initial vector of compromise and persistence is a China Chopper webshell – a tiny and easily obfuscated 70 byte text file that consists of an ‘eval()’ command, which is then used to provide full command execution and file upload/download capabilities to the attackers. This script is typically uploaded to a web server via a SQL injection or WebDAV vulnerability, which is often trivial to uncover in a company with a large external web presence. Once inside, the adversary immediately moves on to execution of a credential theft tool such as Mimikatz (repacked to avoid AV detection). If they are lucky to have caught an administrator who might be logged into that web server at the time, they will have gained domain administrator credentials and can now roam your network at will via ‘net use’ and ‘wmic’ commands executed through the webshell terminal.

Tools Used 2

China Chopper Mimikatz

Operations 1

2014-03 Operation “Poisoned Hurricane” https://www.fireeye.com/blog/threat-research/2014/08/operation-poisoned-hurricane.html

Reports & References 1

https://www.crowdstrike.com/blog/cyber-deterrence-in-action-a-story-of-one-long-hurricane-panda-campaign/

ETDA Profile

Hurricane Panda

Origin

China

First Seen 2013

Motivation

Information theft and espionage

View on ETDA APT Groups ↗