Full Report
Sygnia uncovered a prolonged cyber-espionage campaign targeting a major Asian telecom provider, orchestrated by a China-nexus APT group dubbed Weaver Ant. The group maintained stealthy, long-term access to the network for over four years using advanced techniques centered arou...
Analysis Summary
# Threat Actor: Weaver Ant
## Attribution & Identity
* **Identification:** China-nexus APT group.
* **Known Aliases:** Weaver Ant.
* **Associated Groups:** None explicitly mentioned besides the primary designation.
## Activity Summary
* **Campaign Type:** Prolonged cyber-espionage campaign.
* **Duration:** Over four years of stealthy, long-term network access.
* **Primary Goal:** Cyber-espionage and data exfiltration.
* **Key Operations:** Targeted a major Asian telecom provider, maintaining persistent access and exfiltrating sensitive data.
## Tactics, Techniques & Procedures
* **Initial Access:** Exploitation of a **Web vulnerability**.
* **Web Shell Usage:** Extensive use of web shells, including an **AES-encrypted China Chopper** variant and a novel **INMemory web shell** for remote code execution.
* **Evasion/Stealth:** Payload encryption, obfuscation, and **in-memory module execution**.
* **Persistence & Lateral Movement:** Advanced techniques including **recursive HTTP tunnels** (used for tunneling internal HTTP traffic through exposed web servers), **ETW patching**, **AMSI bypass**, and **PowerShell execution without PowerShell.exe**.
* **Reconnaissance/Exfiltration:** Used **Invoke-SharpView**, **Invoke-SMBClient**, and custom PowerShell ZIP functions for data staging (often in `C:\ProgramData`) and exfiltration.
* **Credential Access:** Credential theft from configuration files.
* **Pivot:** Compromising routers in Southeast Asia to pivot between telecom providers.
## Targeting
* **Sectors:** Telecommunications.
* **Geography:** Asia (specifically mentioning a "major Asian telecom provider" and observed pivots via compromised routers in Southeast Asia).
* **Victims:** A major Asian telecom provider.
## Tools & Infrastructure
* **Malware Families Used:**
* China Chopper (AES-encrypted variant)
* INMemory webshell
* **Observed Tools:**
* Invoke-SharpView
* Invoke-SMBClient
* **Infrastructure:** Compromised routers in Southeast Asia utilized for pivoting.
## Implications
Weaver Ant demonstrates a high level of operational sophistication, prioritizing long-term persistence and stealth over rapid execution. The four-year duration highlights significant success in evading established security controls. Their use of advanced in-memory techniques and native tools (PowerShell, ETW patching) makes detection difficult for traditional endpoint security solutions. The focus on telecom infrastructure suggests objectives related to intelligence gathering on communications or related critical infrastructure management.
## Mitigations
* Implement robust network segmentation, especially between external-facing servers and internal infrastructure.
* Monitor for anomalous web shell activity, paying close attention to encrypted or in-memory-only shell execution.
* Apply rigorous monitoring and alerting for standard defense evasion techniques (e.g., AMSI bypass, ETW tampering).
* Audit and secure exposed web servers to prevent their use as proxies or tunnel endpoints.
* Implement controls preventing PowerShell execution that does not utilize the standard `powershell.exe` binary path.