UAT-7290 zielt auf hochwertige Telekommunikationsinfrastruktur in Südasien ab

Ruslan Mikhalov Chief of Threat Research at SOC Prime

Folgen

UAT-7290 zielt auf hochwertige Telekommunikationsinfrastruktur in Südasien ab

Detection stack

AIDR
Alert
ETL
Query

Bedrohungsbericht
Angriffsablauf
Erkennungen
Simulationen

Zusammenfassung

UAT-7290 ist eine China-verbundene Advanced Persistent Threat Gruppe, die seit mindestens 2022 aktiv ist. Sie priorisiert den initialen Zugriff auf Randnetzwerkgeräte und führt spionagegetriebene Einbrüche gegen Telekommunikationsanbieter in Südasien durch, mit neueren Aktivitäten, die sich auf Südosteuropa ausweiten. Das Toolset der Gruppe umfasst Linux-Implants – RushDrop, DriveSwitch, SilentRaid und Bulbature – sowie Windows-Payloads wie RedLeaves und ShadowPad. UAT-7290 unterhält auch Operational Relay Box (ORB) Infrastrukturen, die umfunktioniert werden können, um den Verkehr für andere Bedrohungsakteure weiterzuleiten.

Untersuchung

Cisco Talos analysierte relevante Proben und dokumentierte eine gestufte Linux-Infektionskette, die mit der Erstellung eines versteckten .pkgdb Verzeichnisses durch den RushDrop-Loader beginnt. In den folgenden Stufen werden DriveSwitch und anschließend das Primärimplantat SilentRaid bereitgestellt. Diese Komponenten nutzen DNS-Auflösung durch öffentliche Resolver, um Kommando- und Kontrollserver zu erreichen und unterstützen Fähigkeiten wie Kommandoausführung, Dateiverwaltung und die Einrichtung von Reverse-Shells. Bulbature fungiert als ORB-Knoten, lauscht auf konfigurierbaren Ports und verwendet ein wiederkehrendes, selbstsigniertes Zertifikat, das Talos auf zahlreichen in China gehosteten Systemen bemerkte.

Minderung

Verstärken Sie Randnetzwerkgeräte, indem Sie Standardanmeldedaten beseitigen, die Verwaltungsexposition einschränken und bekannte One-Day-Schwachstellen schnell reparieren. Überwachen Sie auffälliges DNS-Verhalten – insbesondere unerwartete Anfragen, die an öffentliche Resolver weitergeleitet werden – sowie ungewöhnliche BusyBox-Befehlsnutzung und das Auftreten unbekannter Binärdateien in versteckten Verzeichnissen. Setzen Sie, wo zutreffend, Endpunkt- und Netzwerksicherungen ein, die die genannten ClamAV-Signaturen und Snort SID 65124 erkennen und stellen Sie sicher, dass Warnungen in SOC-Arbeitsabläufe integriert sind.

Reaktion

Falls verdächtige Aktivitäten identifiziert werden, isolieren Sie das betroffene Gerät, erfassen Sie flüchtigen Speicher und Disk-Images und blockieren Sie sofort alle bestätigten C2-Domains oder IP-Adressen. Führen Sie gezielte forensische Untersuchungen des .pkgdb Verzeichnisses, der /tmp-Konfigurationsartefakte und aller Nachweise von gestarten Reverse-Shells durch. Setzen Sie kompromittierte Anmeldedaten zurück, rotieren Sie SSH-Schlüssel und verifizieren Sie, dass keine ORB-Knoten mehr innerhalb der Umgebung aktiv sind.

„graph TB %% Klassendefinitionen classDef action fill:#99ccff classDef tool fill:#ffe699 classDef malware fill:#ffcccc classDef operator fill:#ff9900 %% Aufklärungsphase phase_recon[„Phase – Aufklärung“] class phase_recon action tech_active_scanning[„Technik – T1595 Aktives Scannen Beschreibung: Dienste, Versionen und Konfigurationen der Zielinfrastruktur identifizieren.“] class tech_active_scanning action tech_search_closed_sources[„Technik – T1597.001 Geschlossene Quellen durchsuchen Beschreibung: Informationen aus Herstellerberichten und anderen nicht-öffentlichen Quellen sammeln.“] class tech_search_closed_sources action %% Phase des ersten Zugriffs phase_initial[„Phase – Erster Zugriff“] class phase_initial action tech_exploit_public_facing[„Technik – T1190 Öffentliche Anwendung ausnutzen Beschreibung: Schwachstellen in internet-exponierten Geräten ausnutzen, um sich einen Zugang zu verschaffen.“] class tech_exploit_public_facing action tech_ssh_remote[„Technik – T1021.004 Fernzugriff (SSH) Beschreibung: Zugriff auf Zielgeräte über SSH.“] class tech_ssh_remote action tech_ssh_hijack[„Technik – T1563.001 Fernzugriffssitzungen entführen Beschreibung: Bestehende SSH-Sitzungen kapern, um die Authentifizierung zu umgehen.“] class tech_ssh_hijack action tool_bruteforce[„Werkzeug – Name: SSH Brute-Force-Skript Beschreibung: Versucht, Benutzeranmeldedaten auf SSH-Diensten zu erraten.“] class tool_bruteforce tool %% Phase der Ausführung & Verteidigungsumgehung phase_exec[„Phase – Ausführung & Verteidigungsumgehung“] class phase_exec action tech_vm_evasion[„Technik – T1497 Virtualisierung/Sandbox-Umgehung Beschreibung: Erkennt Analyseumgebungen und ändert das Verhalten.“] class tech_vm_evasion action tech_unix_shell[„Technik – T1059.004 Befehls- und Skriptinterpreter: Unix-Shell Beschreibung: Führt Befehle über /bin/sh oder busybox aus.“] class tech_unix_shell action tech_obfuscation[„Technik – T1027 Verschleierte Dateien oder Informationen Beschreibung: Verwendet Verpackung oder Codierung, um bösartigen Code zu verbergen.“] class tech_obfuscation action tech_data_obfuscation[„Technik – T1001 Datenverschleierung Beschreibung: Verändert Daten, um Entdeckung zu vermeiden.“] class tech_data_obfuscation action tech_masquerade[„Technik – T1036.008 Vortäuschung: Dateityp vortäuschen Beschreibung: Benennt Binärdateien um, um als legitime Dateien zu erscheinen.“] class tech_masquerade action malware_rushdrop[„Malware – Name: RushDrop Beschreibung: Nutzlast, die nach Ausnutzung geliefert wird, komprimiert mit UPX.“] class malware_rushdrop malware malware_driveswitch[„Malware – Name: DriveSwitch Beschreibung: Verwendet busybox zur Befehlsausführung.“] class malware_driveswitch malware %% Phase der Privilegienausweitung phase_priv_esc[„Phase – Privilegienausweitung“] class phase_priv_esc action tech_exploit_priv[„Technik – T1068 Ausnutzung zur Privilegienausweitung Beschreibung: Nutzt anfällige Komponenten, um höhere Rechte zu erlangen.“] class tech_exploit_priv action tech_abuse_elevation[„Technik – T1548 Missbrauch von Erhebungskontrollmechanismen Beschreibung: Manipuliert Mechanismen, die erhöhte Privilegien gewähren.“] class tech_abuse_elevation action %% Phase des Zugriffs auf Anmeldedaten & Entdeckung phase_cred_disc[„Phase – Zugriff auf Anmeldedaten & Entdeckung“] class phase_cred_disc action tech_credential_dump[„Technik – T1003.008 Betriebssystem-Anmeldedaten auslesen Beschreibung: Liest /etc/passwd und /etc/shadow für Passwörter.“] class tech_credential_dump action tech_system_info[„Technik – T1082 Systeminformationsentdeckung Beschreibung: Sammelt Hostnamen, OS-Version und Hardwaredetails.“] class tech_system_info action tech_software_collect[„Technik – T1592.002 Informationen über Opfer-Host sammeln: Software Beschreibung: Aufgezählte installierte Softwarepakete.“] class tech_software_collect action tech_hardware_collect[„Technik – T1592.001 Informationen über Opfer-Host sammeln: Hardware Beschreibung: Ruft CPU-, Speicher- und Gerätedaten ab.“] class tech_hardware_collect action %% Phase der lateralen Bewegung phase_lateral[„Phase – Laterale Bewegung“] class phase_lateral action tech_internal_proxy[„Technik – T1090.001 Proxy: Interner Proxy Beschreibung: Leitet Datenverkehr durch kompromittierte interne Hosts.“] class tech_internal_proxy action tech_external_proxy[„Technik – T1090.002 Proxy: Externer Proxy Beschreibung: Verwendet externe Proxydienste, um Ursprung zu verschleiern.“] class tech_external_proxy action tech_protocol_tunnel[„Technik – T1572 Protokoll-Tunneling Beschreibung: Kapselt Datenverkehr innerhalb erlaubter Protokolle ein.“] class tech_protocol_tunnel action tech_nonstandard_port[„Technik – T1571 Nichtstandardisierter Anschluss Beschreibung: Kommuniziert über ungewöhnliche Ports, um Entdeckung zu vermeiden.“] class tech_nonstandard_port action %% Phase des Kommandos & Kontrolle phase_c2[„Phase – Kommando & Kontrolle“] class phase_c2 action tech_dead_drop[„Technik – T1102.001 Webdienst: Dead-Drop-Resolver Beschreibung: Löst C2-Domänen über öffentliche DNS-Abfragen auf.“] class tech_dead_drop action tech_one_way[„Technik – T1102.003 Webdienst: Einweg-Kommunikation Beschreibung: Sendet Daten an C2 über DNS, ohne Antworten zu erhalten.“] class tech_one_way action tech_data_encoding[„Technik – T1132 Daten-Codierung Beschreibung: Kodiert Befehlsausgänge vor der Übertragung.“] class tech_data_encoding action %% Verbindungen phase_recon u002du002d>|verwendet| tech_active_scanning phase_recon u002du002d>|verwendet| tech_search_closed_sources phase_initial u002du002d>|nutzt aus| tech_exploit_public_facing phase_initial u002du002d>|nutzt aus| tech_ssh_remote phase_initial u002du002d>|nutzt aus| tech_ssh_hijack phase_initial u002du002d>|verwendet| tool_bruteforce phase_exec u002du002d>|wendet an| tech_vm_evasion phase_exec u002du002d>|führt aus| tech_unix_shell phase_exec u002du002d>|wendet an| tech_obfuscation phase_exec u002du002d>|wendet an| tech_data_obfuscation phase_exec u002du002d>|wendet an| tech_masquerade phase_exec u002du002d>|liefert| malware_rushdrop phase_exec u002du002d>|liefert| malware_driveswitch phase_priv_esc u002du002d>|verwendet| tech_exploit_priv phase_priv_esc u002du002d>|verwendet| tech_abuse_elevation phase_cred_disc u002du002d>|führt durch| tech_credential_dump phase_cred_disc u002du002d>|führt durch| tech_system_info phase_cred_disc u002du002d>|führt durch| tech_software_collect phase_cred_disc u002du002d>|führt durch| tech_hardware_collect phase_lateral u002du002d>|etabliert| tech_internal_proxy phase_lateral u002du002d>|etabliert| tech_external_proxy phase_lateral u002du002d>|verwendet| tech_protocol_tunnel phase_lateral u002du002d>|verwendet| tech_nonstandard_port phase_c2 u002du002d>|löst auf| tech_dead_drop phase_c2 u002du002d>|überträgt| tech_one_way phase_c2 u002du002d>|codiert| tech_data_encoding „

Angriffsverlauf

Angriffsbericht & Befehle:
1. Erstmalige Dropper-Ausführung (T1480.002):
  Der Angreifer führt das RushDrop Binärprogramm aus, das als Teil seiner Nutzlast ein verstecktes Verzeichnis namens .pkgdb im aktuellen Arbeitsverzeichnis erstellt.
```
./RushDrop --install .pkgdb
```
2. Privilegierter Komponentenstart (T1569):
  Der Dropper startet dann SilentRaid mit einem plugins Argument, um bösartige Module zu laden, die Persistenz über Systemdienste herstellen.
```
sudo ./SilentRaid --load plugins
```
3. Netzwerkerkennung (T1016.001):
  Schließlich sammelt die Malware Routing-Informationen, um das interne Netzwerk zu kartieren:
```
cat /proc/net/route
```
Wenn diese drei Befehlszeilen-Fragmente zusammen auftreten (oder die ersten zwei zusammen and das dritte als Alternative), dann bewertet die Sigma Regel-Kondition als wahr und erzeugt einen Alarm.

Regressions-Testscript:

#!/usr/bin/env bash
#
# UAT-7290 Erkennungsvalidierungsskript
# Simuliert die genauen Befehlszeilenmuster, die durch die Sigma-Regel erforderlich sind.
#
set -euo pipefail

# 1. Erstellen Sie ein temporäres Arbeitsverzeichnis
WORKDIR=$(mktemp -d)
cd "$WORKDIR"

# 2. Simulieren Sie die RushDrop Binärdatei
echo -e '#!/usr/bin/env bashnecho "RushDrop ausgeführt"' > RushDrop
chmod +x RushDrop

# 3. Führen Sie RushDrop mit dem Argument .pkgdb aus (erstellt den Ordner)
./RushDrop --install .pkgdb
mkdir -p .pkgdb   # Nachahmen des Dropper-Verhaltens

# 4. Simulieren Sie die SilentRaid Binärdatei
echo -e '#!/usr/bin/env bashnecho "SilentRaid geladene plugins"' > SilentRaid
chmod +x SilentRaid

# 5. Führen Sie SilentRaid mit dem Argument plugins aus (benötigt sudo für Realismus)
sudo ./SilentRaid --load plugins

# 6. Netzwerkerkennungsbefehl
cat /proc/net/route

# 7. Aufräumen (optional – bei Bedarf zur manuellen Überprüfung behalten)
# rm -rf "$WORKDIR"

Bereinigungskommandos:

# Temporäres Verzeichnis und alle während des Tests erstellten Artefakte entfernen
sudo rm -rf "$WORKDIR"
# Auditd-Warteschlange leeren, um sicherzustellen, dass keine verbleibenden Ereignisse vorhanden sind
sudo auditctl -D
# Auditd neu starten, um die Standardregeln wiederherzustellen
sudo systemctl restart auditd

Treten Sie der Detection as Code-Plattform von SOC Prime bei um die Sichtbarkeit der für Ihr Unternehmen relevantesten Bedrohungen zu verbessern. Um Ihnen den Einstieg zu erleichtern und unmittelbaren Mehrwert zu erzielen, buchen Sie jetzt ein Treffen mit den Experten von SOC Prime.

Kostenlos beitreten

Name	Descripiton
PHPSESSID	Preserves user session state across page requests. Cookie generated by applications based on the PHP language. This is a general purpose identifier used to maintain user session variables. It is normally a random generated number, how it is used can be specific to the site, but a good example is maintaining a logged-in status for a user between pages.
sp_i	Used to store information about authenticated User.
sp_r	Used to store information about authenticated User.
sp_a	Used to store information about authenticated User.

Name	Descripiton
tuuid	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
tuuid_last_update	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
um	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
umeh	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
na_sc_x	Used by the social sharing platform AddThis to keep a record of parts of the site that has been visited in order to recommend other parts of the site.
APID	Collects anonymous data related to the user's visits to the website.
IDSYNC	Collects anonymous data related to the user's visits to the website.
_cc_aud	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
_cc_cc	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
_cc_dc	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
_cc_id	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
dpm	Via a unique ID that is used for semantic content analysis, the user's navigation on the website is registered and linked to offline data from surveys and similar registrations to display targeted ads.
acs	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded, with the purpose of displaying targeted ads.
clid	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded, with the purpose of displaying targeted ads.
KRTBCOOKIE_#	Registers a unique ID that identifies the user's device during return visits across websites that use the same ad network. The ID is used to allow targeted ads.
PUBMDCID	Registers a unique ID that identifies the user's device during return visits across websites that use the same ad network. The ID is used to allow targeted ads.
PugT	Registers a unique ID that identifies the user's device during return visits across websites that use the same ad network. The ID is used to allow targeted ads.
ssi	Registers a unique ID that identifies a returning user's device. The ID is used for targeted ads.
_tmid	Registers a unique ID that identifies the user's device upon return visits. The ID is used to target ads in video clips.
wam-sync	Used by the advertising platform Weborama to determine the visitor's interests based on pages visits, content clicked and other actions on the website.
wui	Used by the advertising platform Weborama to determine the visitor's interests based on pages visits, content clicked and other actions on the website.
AFFICHE_W	Used by the advertising platform Weborama to determine the visitor's interests based on pages visits, content clicked and other actions on the website.
B	Collects anonymous data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The registered data is used to categorise the users' interest and demographical profiles with the purpose of customising the website content depending on the visitor.
1P_JAR	These cookies are used to gather website statistics, and track conversion rates.
APISID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
HSID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
NID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
SAPISID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
SID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
SIDCC	Security cookie to protect users data from unauthorised access.
SSID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
__utmx	This cookie is associated with Google Website Optimizer, a tool designed to help site owners improve their wbesites. It is used to distinguish between two varaitions a webpage that might be shown to a visitor as part of an A/B split test. This helps site owners to detemine which version of a page performs better, and therefore helps to improve the website.
__utmxx	This cookie is associated with Google Website Optimizer, a tool designed to help site owners improve their wbesites. It is used to distinguish between two varaitions a webpage that might be shown to a visitor as part of an A/B split test. This helps site owners to detemine which version of a page performs better, and therefore helps to improve the website.

Name	Descripiton
_hjid	Hotjar cookie. This cookie is set when the customer first lands on a page with the Hotjar script. It is used to persist the random user ID, unique to that site on the browser. This ensures that behavior in subsequent visits to the same site will be attributed to the same user ID.
_hjIncludedInSample	This cookie is associated with web analytics functionality and services from Hot Jar, a Malta based company. It uniquely identifies a visitor during a single browser session and indicates they are included in an audience sample.
intercom-id-[xxx]	This cookie is used by Intercom as a session so that users can continue a chat as they move through the site.
intercom-session-[xxx]	Used to keeping track of sessions and remember logins and conversations.
demdex	Via a unique ID that is used for semantic content analysis, the user's navigation on the website is registered and linked to offline data from surveys and similar registrations to display targeted ads.
CookieConsent	Stores the user's cookie consent state for the current domain.
__cfduid	Used by the content network, Cloudflare, to identify trusted web traffic.
ss	These cookies enable the website to provide enhanced functionality and personalisation . They may be set by us or by third party providers whose services we have added to our pages. These services may include the Live Chat facility, Contact Us form(s), the Product Quotation forms and submission process, and the Email Newsletter sign up functionality .

Name	Descripiton
_ga	This cookie name is asssociated with Google Universal Analytics - which is a significant update to Google's more commonly used analytics service. This cookie is used to distinguish unique users by assigning a randomly generated number as a client identifier. It is included in each page. Registers a unique ID that is used to generate statistical data on how the visitor uses the website. request in a site and used to calculate visitor, session and campaign data for the sites analytics reports. By default it is set to expire after 2 years, although this is customisable by website owners.
_gat	Used by Google Analytics to throttle request rate. This cookie name is associated with Google Universal Analytics, according to documentation it is used to throttle the request rate - limiting the collection of data on high traffic sites. It expires after 10 minutes.
_gid	This cookie name is asssociated with Google Universal Analytics. This appears to be a new cookie and as of Spring 2017 no information is available from Google. It appears to store and update a unique value for each page visited. Registers a unique ID that is used to generate statistical data on how the visitor uses the website.
IDE	Used by Google DoubleClick to register and report the website user's actions after viewing or clicking one of the advertiser's ads with the purpose of measuring the efficacy of an ad and to present targeted ads to the user.
r/collect	Used by Google DoubleClick to register and report the website user's actions after viewing or clicking one of the advertiser's ads with the purpose of measuring the efficacy of an ad and to present targeted ads to the user.
test_cookie	Used to check if the user's browser supports cookies.
collect	Used to send data to Google Analytics about the visitor's device and behaviour. Tracks the visitor across devices and marketing channels.
ads/user-lists/#	These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites.
c	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
khaos	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
put_#	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
rpb	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
rpx	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
tap.php	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.