Chinese APTs targeting semiconductor companies in South Asian countries

Chinese APTs targeting semiconductor companies in South Asian countries

Speakers: Niranjan Jayanand, Director of Threat Hunting Service, CyberProof; Deepak Nayak, CTI Lead, CyberProof

Conference: Virus Bulletin

YouTube: https://www.youtube.com/watch?v=8pGGa86shaw

Overview

This talk, presented by Niranjan Jayanand of CyberProof, delves into an ongoing investigation into sophisticated cyberattacks attributed to Chinese Advanced Persistent Threat (APT) groups targeting the critical semiconductor industry within South Asian countries. Co-authored with Deepak Nayak, CTI Lead at CyberProof, the presentation sheds light on the challenges faced by threat hunters and incident responders when confronting highly evasive adversaries, particularly when telemetry data is limited. The investigation highlights the strategic importance of the semiconductor sector to nation-state interests, aligning with broader geopolitical objectives such as China's 5-year plan, which explicitly mentions the development and control of advanced technologies.

The talk underscores the persistent and evolving nature of these threats, noting that multiple Chinese APTs appear to be operating in the same region, sometimes sharing tactics, techniques, and procedures (TTPs) or even resources. This overlap complicates attribution and necessitates a deep understanding of adversary behaviors. Despite the inherent difficulties stemming from incomplete visibility into the initial access vectors and full infection chains, CyberProof's analysis, informed by insights from other security vendors like Proofpoint, Cisco, and Google, reveals commonalities in attack methodologies, including specific lure documents, sophisticated execution techniques, and dynamic command-and-control (C2) infrastructure.

Background

▶ Watch: Introduction: Chinese APTs targeting semiconductor industry (0:00)

The targeting of the global semiconductor industry by nation-state actors, particularly those affiliated with China, is a well-documented and long-standing concern. As highlighted in the talk, groups like APT41 have been explicitly linked to these campaigns, with their activities often seen as directly supporting China's strategic economic and technological ambitions, such as those outlined in its 5-year plans. This geopolitical context provides the primary motivation for these highly sophisticated and persistent cyber espionage efforts.

However, investigating these campaigns presents significant hurdles. The speakers emphasized the acute lack of telemetry and comprehensive data, which often obscures critical details such as the initial access vector, the specific vulnerabilities exploited, and the full scope of the payload deployment. This makes it exceedingly difficult for security teams to piece together a complete narrative of an attack. The challenge is further compounded by the observation that multiple Chinese threat groups, such as Nikon and another unnamed group mentioned in a Cisco blog, are active in the South Asian region, often employing similar tools like PlugX RAT. This convergence of activity makes it hard to distinguish between different threat actors and their specific campaigns.

The talk also referenced prior work and TTPs that serve as contextual background for their current investigation. Specifically, the speakers mentioned the ClickFix campaign and the widespread use of IDAT loader (also known as Hijack loader by CrowdStrike) by numerous info-stealers, including Sector RAT. These loaders often leverage sophisticated techniques like process doppelganging and process injection into legitimate processes like msbuild.exe, indicating a trend of advanced evasion techniques that Chinese APTs have adopted over the past 18 months or more. This historical context helps researchers anticipate potential adversary behaviors even when direct evidence is scarce.

Key Findings

▶ Watch: Lure documents and double-extension file patterns (5:00)

CyberProof's investigation, while ongoing and constrained by limited telemetry, yielded several crucial findings regarding Chinese APT activity targeting South Asian semiconductor companies:

• Multiple Threat Actors and Shared TTPs: The analysis strongly suggests the presence of not just one, but potentially two or three distinct Chinese-origin threat groups actively targeting the region. A significant observation was the apparent code or resource sharing among these groups, leading to identical or highly similar infection chains. This complicates traditional attribution efforts but points to a collaborative or highly adaptive adversary landscape.
• Consistent Infection Chains: Despite the attribution challenges, a recurring infection chain was identified. This typically commenced with email-borne password-protected archives. Upon extraction, the attack progressed through DLL sideloading techniques, often initiated by a VBS script, and leveraged legitimate-looking PDF files as lures.
• Deployment of Advanced Backdoors: The observed infection chains consistently led to the deployment of sophisticated remote access tools. Specifically, Cobalt Strike was identified in one variant of the attack chain, while the Bladabindi backdoor (also known as Nikon RAT), historically associated with Chinese groups, was observed in another.
• Specific Lure Themes: Attackers employed highly targeted lure documents. Examples included themes related to "Taiwan" and "job applicants," often using Chinese names in metadata. A notable file pattern involved double extension files dropped on victim machines, such as filename.pdf.lnk, which were also reported by Proofpoint.
• Dynamic Command and Control (C2) Infrastructure: Adversaries demonstrated agility in managing their C2 infrastructure. This included the rotation of SSL certificates and the transition of infrastructure between different domains, such as from slack.com to go.com or gomeeting.com within a short timeframe (e.g., less than 20 days), indicating an effort to evade detection and maintain persistence.
• Unique RC4 Key: During infrastructure hunting, a specific XOR key RC4 key was identified within some Cobalt Strike-related samples. This unique key provided a pivot point for further investigation, allowing researchers to identify additional related hash values and potentially new samples, even if full code similarity could not always be confirmed.

These findings, while representing "loose bits and pieces" of an evolving story, provide critical insights into the operational methodologies and strategic objectives of Chinese APTs operating in the South Asian semiconductor sector.

Technical Deep Dive

▶ Watch: Attribution challenges and distinct infection chains (8:00)

The investigative approach taken by CyberProof was rooted in a blend of MITRE ATT&CK-based hunting, Intel-based hunting, and custom hunting methodologies. Given the limited telemetry from the newly onboarded customer, the team focused on enriching available signals and fine-tuning existing hunting queries to extract maximum detail.

Initial Access and Execution:

The primary initial access vector observed was through email-borne password-protected archives. Once extracted, the infection chain typically involved DLL sideloading. The speakers noted that VBS scripts were frequently used to launch the attack, often displaying a benign-looking PDF document as a lure to mask the malicious activity. The use of double extension files, such as filename.pdf.lnk, was a recurring pattern, indicating an attempt to trick users into executing malicious shortcuts.

Evasion Techniques:

Chinese APTs demonstrated several evasion techniques:

• Process Injection/Doppelganging: Drawing parallels to the ClickFix campaign and Sector RAT, the team specifically looked for alerts related to process injection and process doppelganging, particularly targeting processes like msbuild.exe. While not explicitly confirmed in their current customer's environment, this TTP was a high-priority hunting focus due to its prevalence in recent Chinese APT operations.
• Legitimate Services for C2: Although not confirmed in this specific investigation, the team proactively checked for C2 communications leveraging legitimate services like Google Calendar and Google Sheets, a known tactic used by some Chinese groups.
• Dynamic Infrastructure: A core technical challenge was the adversary's dynamic C2 infrastructure. This involved rotating SSL certificates and transitioning domains. For instance, an IP address might initially use an SSL certificate linked to slack.com and then shift to go.com or gomeeting.com within a matter of weeks. This constant churn makes static blacklisting less effective.

Payloads and Backdoors:

Two distinct primary payloads were identified:

• Cobalt Strike: One infection chain consistently delivered Cobalt Strike, a widely used legitimate penetration testing tool often weaponized by APTs for post-exploitation. A critical finding related to Cobalt Strike was the discovery of a specific XOR key RC4 key. This unique key allowed for broader searches for related binaries and infrastructure.
• Bladabindi Backdoor: Another infection chain resulted in the deployment of the Bladabindi backdoor, a malware long associated with Chinese threat groups.

Infrastructure Hunting with OSINT Tools:

To overcome the telemetry gaps, CyberProof extensively leveraged open-source intelligence (OSINT) tools for infrastructure hunting:

• Shodan: Used to search for specific host banners, port 443 activity, and SSL certificate values tied to known Cobalt Strike infrastructure. By pivoting on discovered SSL certificate hashes, the team identified additional related IPs, domains, and values (e.g., 20 other values, 12 different IPs).
• Validin: Complementing Shodan, Validin was used to track infrastructure transitions and identify inactive domains or those that had rotated their SSL certificates. The team searched for banner hash JARM fingerprints and performed facet analysis to uncover additional connected domains.
• VirusTotal: The discovered RC4 key was used to create Yara rules and perform content searches in VirusTotal, yielding lists of hash values. This led to the identification of files like JLI.DLL, which had been previously mentioned in Proofpoint's blogs, indicating a potential connection to broader campaigns, though full code similarity was not always present.

Attribution and False Flags:

The speakers acknowledged the complexities of attribution. The observation of "code sharing or resource sharing" between different Chinese groups makes it difficult to definitively attribute specific campaigns to a single actor. Furthermore, the presence of Chinese metadata within some samples was noted as a potential false flag, a common tactic used by sophisticated adversaries to mislead researchers and misattribute attacks. The team shared a list of ASN records believed to be associated with the supporting infrastructure of these attacks with their customer for blocking purposes.

Demo / Proof of Concept

▶ Watch: Infrastructure hunting using Shodan, Validin, SSL certificates (10:00)

The talk did not include a live demonstration or a proof of concept. Instead, Niranjan Jayanand focused on presenting the investigative findings, challenges, and methodologies employed by CyberProof's threat hunting team during an ongoing incident response and onboarding process for a customer in the semiconductor industry. The content was centered on real-world observations and the analytical work undertaken to piece together the adversary's TTPs from limited data.

Defensive Implications

▶ Watch: RC4 key analysis, code similarity, ongoing investigation (14:00)

Understanding the sophisticated and persistent nature of Chinese APTs targeting the semiconductor industry is crucial for effective defense. Defenders should consider the following implications and adopt proactive strategies:

• Enhanced Endpoint and Network Telemetry: The primary challenge highlighted in the talk was the lack of comprehensive telemetry. Organizations, especially those in critical sectors like semiconductors, must invest in robust Endpoint Detection and Response (EDR) and Network Detection and Response (NDR) solutions to capture detailed logs, process activity, network connections, and file modifications. This is vital for reconstructing attack chains and identifying initial access vectors.
• Proactive Threat Hunting: Implement a dedicated threat hunting program leveraging frameworks like MITRE ATT&CK. Focus hunting efforts on TTPs observed in this talk:
• DLL sideloading detections.
• Process injection and process doppelganging into legitimate processes (e.g., msbuild.exe).
• Suspicious outbound network connections to unusual TLDs (.shop, .space) or known C2 indicators (Cobalt Strike, Bladabindi).
• Monitoring for VBS script execution and the dropping of double extension files (.pdf.lnk).
• Strengthen Email Security: Given that email with password-protected archives is a common initial access vector, organizations must deploy advanced email security gateways capable of:
• Scanning password-protected attachments (requiring integration with sandboxing).
• Detecting malicious lure documents and social engineering attempts.
• Implementing user awareness training on recognizing phishing and suspicious attachments.
• Leverage External Threat Intelligence: Integrate and actively use intelligence from reputable sources like Proofpoint, Cisco, Mandiant, Zscaler, and Kaspersky. This helps in identifying emerging TTPs, new IOCs (IPs, domains, hashes), and understanding the broader landscape of Chinese APT activities. The talk explicitly mentioned how external blogs helped connect dots.
• Dynamic C2 Infrastructure Monitoring: Adversaries are agile with their C2 infrastructure. Defenders should:
• Monitor SSL certificate changes and pivot on certificate hashes to identify related infrastructure using tools like Shodan and Validin.
• Implement egress filtering to restrict outbound connections to known malicious IPs and domains, and proactively block newly identified infrastructure.
• Be wary of C2 over legitimate services (e.g., Google Calendar/Sheets) and ensure monitoring for such communications.
• Focus on Behavioral Detections: Due to shared TTPs and attribution challenges, focusing on attacker behaviors rather than solely on static IOCs is critical. Detect suspicious sequences of events, such as an email attachment leading to a VBS script, followed by DLL sideloading and an unknown outbound connection.
• Incident Response Readiness: Ensure a well-defined incident response plan is in place. This includes clear communication channels, forensic capabilities, and the ability to quickly implement blocking measures based on newly discovered IOCs, even if the full infection chain is not yet understood.
• Supply Chain Security: Semiconductor companies are often targets due to their position in the global supply chain. Implement robust security measures for third-party vendors and partners, as supply chain compromises can be an entry point.

Key Takeaways

• Persistent Targeting: Chinese APTs continue to aggressively target the semiconductor industry, particularly in South Asian countries, aligning with strategic national goals to advance technological capabilities.
• Overlapping Adversaries: Multiple, potentially distinct, Chinese threat groups utilize strikingly similar TTPs and may even share resources or code, making definitive attribution and tracking of individual campaigns exceptionally challenging.
• Common Attack Vectors: The primary initial access vector observed involves email-borne password-protected archives, leading to sophisticated DLL sideloading techniques and the deployment of advanced backdoors like Cobalt Strike and Bladabindi.
• Dynamic Evasion: Adversaries employ dynamic C2 infrastructure, frequently rotating SSL certificates and domains (e.g., from slack.com to go.com) to evade detection and maintain persistence.
• Telemetry Gaps & Hunting Reliance: Limited telemetry data often hinders complete incident reconstruction, underscoring the critical need for proactive, intelligence-led threat hunting and the use of OSINT tools like Shodan and Validin to uncover adversary infrastructure.
• Collaborative Intelligence: The complex nature of these attacks necessitates collaborative threat intelligence sharing among security vendors and researchers to piece together a comprehensive understanding of the evolving threat landscape.

About the Speaker(s)

Niranjan Jayanand is the Director of Threat Hunting Service at CyberProof. He presented this talk at Virus Bulletin, sharing insights from his team's ongoing investigations into sophisticated cyber threats. His expertise lies in proactive threat detection and analysis within complex enterprise environments.

Deepak Nayak is the CTI Lead at CyberProof. He was primarily responsible for investigating the attack story discussed in the talk. Although unable to attend the conference, his detailed threat intelligence work formed the foundation of the presentation's findings.