Full Report
Sysdig researchers say UNC5174’s use of open-source tools like VShell and WebSockets has likely helped the group mask its presence in other campaigns. The post Chinese espionage group leans on open-source tools to mask intrusions appeared first on CyberScoop.
Analysis Summary
# Threat Actor: UNC5174
## Attribution & Identity
* **Identification/Attribution:** Chinese state-sponsored hacking group believed to have ties to the Chinese government.
* **Associated Groups/Aliases:** Referred to as a moderately sophisticated and discreet intrusion set.
## Activity Summary
UNC5174 is an espionage-minded hacking group focused on initial access and post-exploitation. A recent campaign observed by Sysdig shows a shift towards utilizing common, open-source offensive security tools instead of exclusively bespoke malware, likely to blend in with common cybercriminal activity. In 2024, ANSSI observed this group exploiting vulnerabilities in Ivanti’s Cloud Service Appliance product, including a zero-day flaw (CVE2024-8190) to achieve remote code execution. There is suspicion that UNC5174 may be functioning as an initial access broker, selling access points secured via their intrusion set to other operators. The observed blending of tactics suggests activity dating back to at least November 2023.
## Tactics, Techniques & Procedures
* **Initial Access:** Potential use of **typosquatted website domains** and **phishing tactics**. Exploitation of vulnerabilities, such as zero-day flaws in Ivanti Cloud Service Appliances (e.g., CVE2024-8190).
* **Execution/Persistence/Defense Evasion:** Demonstrated in-depth knowledge of Linux-based operating systems, including methods for **maintaining persistence, defensive evasion, and injection techniques** on Linux systems.
* **Command and Control (C2):** Use of **WebSockets**, an open-source communication protocol, to mask malicious traffic through encrypted transmissions.
* **Custom Tooling Transition:** Historically relied on custom-built tooling, but recently is leveraging open-source tools like VShell alongside custom malware for post-exploitation.
* [MITRE ATT&CK IDs not explicitly provided in the source text]
## Targeting
* **Sectors:** Western governments, technology companies, research institutions, and think tanks.
* **Geography:** Not explicitly detailed, but inferred involvement in activities observed by ANSSI (France).
* **Victims:** Organizations targeted via Ivanti Cloud Service Appliances.
## Tools & Infrastructure
* **Malware Families:**
* **VShell:** Open-source Remote Access Trojan (RAT) made by a Chinese developer.
* **SNOWLIGHT:** Malware family used in tandem with VShell for deploying fileless malware.
* **dnsloger:** A specific payload observed as part of the SNOWLIGHT family.
* Use of **rootkit10 code** was historically noted by ANSSI.
* **Infrastructure:** Command-and-control domains suggestive of typosquatting.
## Implications
UNC5174's adoption of readily available open-source tools (like VShell and WebSockets) significantly increases their potential operational security by making their traffic and activity harder to distinguish from legitimate or common cybercriminal noise. This shift complicates attribution and detection efforts for defenders, especially given their continued focus on high-value espionage targets. Their potential role as an initial access broker suggests a multi-layered threat landscape where access gained by UNC5174 could subsequently be used by other actors for various objectives.
## Mitigations
* Implement scrutiny over network traffic that utilizes **WebSockets** for C2 or data exfiltration, focusing on traffic anomalies introduced within the encrypted streams.
* Proactive vulnerability management, specifically patching products like **Ivanti Cloud Service Appliances**, to counter exploitation of known and zero-day vulnerabilities.
* Monitor for the deployment and execution of **VShell** or related known Chinese cybercriminal tools on Linux environments.
* Investigate for indicators related to the **SNOWLIGHT** malware family and fileless deployment techniques on targeted Linux systems.
* Enhance defenses against **phishing and domain squatting** as potential initial access vectors.