Welcome to Spycraft, a podcast that tells gripping life and death spy stories and
the amazing devices and operations that made them possible. Now let's get started.
Sooks Sophos, a global leader of innovative security solutions for defeating cyber attacks,
released a report Operation Crimson Palace threat in Hunting. Threat Hunting unveils multiple clusters
of Chinese sponsored activity targeting Southeast Asia. Sofolks ex Ops finds links between five
well known Chinese threat groups, including APT four to one and Backdoor Diplomacy.
Chinese attackers leverage previously unseen malware for espionage and persistence. The Operation Crimson Palace
details a highly sophisticated, nearly two year long espionage campaign against a high level
government target. During sofos exops investigation, which began in two twenty twenty three,
they managed detection and response team found three distinct clusters of activity targeting the
same organization, two of which included tactics, techniques, and procedures that overlap
with well known Chinese nation state groups Backdoor Diplomacy, APT one five and the
APTE forty one subgroup earth Longzi. The attackers designed their operation to gather reconnaissance
on specific users, as well as sensitive political, economic, and military information,
using a wide variety of malware and tools throughout the campaign that SOFOS has
since dubbed Crimson Palace. This includes previously unseen malware a persistence tool that SOFOS
named Poco Proxy. The different clusters appeared to have been working in support of
Chinese state interests by gathering military and economic intelligence related to the country's strategies in
the South China Sea in this particular campaign. They believe these three clusters represented
distinct groups of attackers who are working in parallel against the same target under the
overarching directive of a central state authority. Within just one of the three clusters
that they identified, Cluster Alpha, they saw malware and TTP's overlap with four
separately reported Chinese threat groups. It's well known the Chinese attackers share infrastructure and
tooling. In this recent campaign's a reminder of just how extensively these groups share
their tools and techniques. As Western governments elevate awareness about cyber threats from China,
the overlap SOFOS is uncovered as an important reminder they're focusing too much on
any single Chinese attribution. We put organizations at risk of missing trends about how
these groups coordinate their operations. By having a bigger, broader picture, organizations
can be smarter about their defenses. There were three clusters they found. Cluster
Alpha, Cluster Bravo, and Cluster Charlie were the ones associated with this espionage
attack over in Southeast Asia. They didn't specify what countries were being hit or
anything of that sort. Well, actually, we'll look at Operation Crimson.
In May of twenty twenty three, it was a thread hunt across SOFOS Managed
Detection and Response telemetry. The SOFOS MDRS Mark Parsons uncovered a complex, long
running Chinese state sponsored cyber espionage operation that they dubbed Crimson Palace, targeting a
high profile government organization in the Southeast Asia area. They have not specified who
it was in Southeast Asia as of yet. At least that's it for now