{"id":823,"date":"2023-12-19T15:12:31","date_gmt":"2023-12-19T20:12:31","guid":{"rendered":"https:\/\/domainsure.com\/?p=823"},"modified":"2023-12-19T15:12:31","modified_gmt":"2023-12-19T20:12:31","slug":"china-vs-the-cia-digital-potshots-ramp-up-cyber-threats-for-private-organizations","status":"publish","type":"post","link":"https:\/\/domainsure.com\/articles\/china-vs-the-cia-digital-potshots-ramp-up-cyber-threats-for-private-organizations\/","title":{"rendered":"China vs. the CIA: Digital Potshots Ramp Up Cyber Threats for Private Organizations"},"content":{"rendered":"
\u201cChina\u2019s cyber pursuits and its industry\u2019s export of related technologies increase the threats of aggressive cyber operations against the U.S. homeland. . . \u201c <\/span><\/i><\/p>\n
– <\/span><\/i>The US Office of the Director of National Intelligence\u2019s 2023 Annual Threat Assessment<\/span><\/p><\/blockquote>\n
International espionage, digital warfare, and cyber threats for private corporations on the periphery\u2026 It\u2019s all unfolding with unprecedented intensity. In the past few years, revelations about China’s sophisticated cyber-espionage operations and the Central Intelligence Agency’s (CIA) expansive digital intrusions on enemies, allies and friends reveal a stark reality: the cyber battleground is more active than we may realize. The escalating cyber conflict between two of the world’s most formidable powers \u2013 China and the United States, particularly its CIA \u2013 as they engage in a high-stakes digital warfare.<\/span><\/p>\n
The transformation of China’s cyber capabilities from legacy tactics to a formidable, state-of-the-art arsenal marks a significant shift in global cybersecurity dynamics. Under the direction of President Xi Jinping, China has not only intensified its cyber operations but has also emerged as a cyber superpower, rivaling even the United States. The use of advanced malware like Daxin, undetected for over a decade, in global espionage operations, is a testament to China’s growing prowess in the digital domain.<\/span><\/p>\n
On the other side of the digital divide, the CIA\u2019s long history of covert operations, has been implicated in a series of cyberattacks targeting various countries, including China. Investigations have unearthed the agency’s use of sophisticated tools and techniques, pointing to a comprehensive and well-funded state-backed hacking initiative.<\/span><\/p>\n
As the digital potshots from China and the United States(CIA) ramp up, we\u2019ll analyze their strategies and tactics, and assess the broader implications of their digital confrontations on cybersecurity and geopolitics.<\/span><\/p>\n
China’s Growing Cyber Capabilities<\/b><\/h2>\n
Over the past decade, the People\u2019s Liberation Army(PLA) and other state-backed entities have shifted their focus from mere data theft and espionage to more complex operations targeting critical global infrastructure. This transition reflects China’s broader strategic goal to assert its influence and safeguard its interests in the digital domain.<\/span><\/p>\n
President Xi Jinping\u2019s regime marks a pivotal turn in China’s cyber strategy. Under his leadership, there\u2019s been a concerted effort to integrate and amplify China’s cyber capabilities. Xi\u2019s administration has overseen a reorganization of military and intelligence structures, placing a high priority on cyberwarfare. To accomplish this, China\u2019s communist government reorganized its military and civilian technological resources to match the threat from the United States.<\/span><\/p>\n
China Uses Advanced Malware Like Daxin in Global Espionage<\/b><\/h3>\n
A striking example of China’s enhanced cyber capabilities is the deployment of <\/span>Daxin<\/span><\/i>, an advanced malware tool. Described as one of the most sophisticated pieces of malware ever used by China-linked hackers, Daxin has been instrumental in espionage operations.<\/span>
\n<\/span>
\n<\/span>How does Daxin work (simplified)?<\/b><\/p>\nDaxin, a sophisticated type of malware, uses several advanced techniques to avoid detection and carry out its harmful activities. It can send disguised messages over the internet that look like regular traffic, making it hard for standard security tools to spot them.\u00a0 <\/span>At the core of a computer system, it can secretly alter how the system operates to hide itself and control certain functions, like file management. Daxin is adaptable, able to add new harmful features depending on what it needs to do, and can move stealthily within a network, mimicking normal administrative actions. It can sneakily send out stolen data in a way that looks like regular internet traffic and has tricks to keep functioning even after attempts to remove it, like setting up hidden automatic tasks. To avoid being caught by antivirus programs, it constantly changes its appearance and behavior.<\/span><\/p>\n
How does Daxin work (technical)?<\/b><\/h4>\n
\n
- Raw Socket Communication:<\/b> Daxin’s use of raw sockets for C2 communication is a key technical feature. Unlike standard TCP or UDP sockets, raw sockets allow the malware to craft and send packets that are indistinguishable from normal traffic, bypassing traditional network monitoring tools. For example, it might craft ICMP or TCP packets that are embedded with C2 data, yet appear as regular network traffic.<\/span><\/li>\n
- Kernel-Level Rootkit Techniques: <\/b>At the kernel level, Daxin likely employs hooking techniques to intercept and modify system calls, a common rootkit strategy. This could involve, for instance, hooking the \u2018<\/span>NtQueryDirectoryFile<\/b>\u2019 function in the Windows Native API to hide its presence from directory listing tools, or manipulating the <\/span>IRP_MJ_READ<\/b> and <\/span>IRP_MJ_WRITE I\/O<\/b> request packets to intercept and modify file operations.<\/span><\/li>\n
- Modular Payloads and Lateral Movement: <\/b>Daxin’s modular nature means it can dynamically load additional payloads tailored to specific environments or tasks. For example, it might use PowerShell scripts for lateral movement within a network, leveraging standard administrative tools like <\/span>WinRM<\/b> or <\/span>WMI<\/b> for execution, which helps it blend in with legitimate administrative activities.<\/span><\/li>\n
- Stealthy Data Exfiltration:<\/b> For data exfiltration, Daxin could use covert channels, such as embedding stolen data within seemingly benign network protocols. An example would be using DNS queries (a technique known as DNS tunneling) to send out small chunks of data, making it look like normal DNS traffic.<\/span><\/li>\n
- Persistence Mechanisms: <\/b>Daxin likely employs advanced persistence techniques to survive reboots and evade detection. This could involve using Windows Registry keys or scheduled tasks that are triggered to reinstate the malware if it’s detected and removed. For instance, it might create a scheduled task that periodically checks for the presence of its kernel module and reinstalls it if missing.<\/span><\/li>\n
- Evasion Tactics:<\/b> To evade detection by antivirus software or EDR solutions, Daxin might employ tactics like obfuscating its code, dynamically decrypting\/encrypting its payloads in memory, or using polymorphic code that changes its signature every time it’s deployed.<\/span><\/li>\n
- Exploiting Specific Vulnerabilities:<\/b> While not explicitly detailed in open-source descriptions of Daxin, it’s plausible that the malware exploits specific vulnerabilities for initial access or elevation of privileges. This could involve, for example, leveraging known exploits in network services or unpatched vulnerabilities in operating systems.<\/span><\/li>\n<\/ul>\n
China Exploits Zero-Day Vulnerabilities and Executes Large-Scale Hacking Campaigns<\/b><\/h3>\n
China’s cyber strategy has been increasingly aggressive in exploiting zero-day vulnerabilities \u2013 unknown flaws in software or hardware that can be exploited before a fix becomes available. The exploitation of these vulnerabilities has become a hallmark of Chinese cyber operations, allowing them to infiltrate and compromise systems globally.\u00a0<\/span><\/p>\n
For example, starting in 2020, a significant uptick in the use of such vulnerabilities was observed, indicating a more assertive stance in cyber espionage and warfare.\u00a0<\/span>The following timeline from the US Federal government\u2019s <\/span>Cybersecurity and Infrastructure Security Agency<\/span><\/i> shows the increasing amount of detected Chinese cyberthreats since 2017.<\/span><\/p>\n
CISA Timeline of Chinese Cyber Threats:<\/b><\/h3>\n
\n
- September 27, 2023:<\/b> Advisory on BlackTech cyber actors linked to China, focusing on router firmware exploitation.<\/span><\/li>\n
- May 24, 2023<\/b>: Advisory on China’s state-sponsored actors using LOTL techniques.<\/span><\/li>\n
- October 6, 2022: <\/b>Advisory on top CVEs exploited by Chinese state-sponsored actors.<\/span><\/li>\n
- June 7, 2022: <\/b>Advisory on Chinese exploitation of network providers and devices.<\/span><\/li>\n
- August 20, 2021: <\/b>Advisory on observed Chinese TTPs targeting various sectors.<\/span><\/li>\n
- July 21, 2021:<\/b> Advisory on Chinese intrusion campaign targeting U.S. oil and gas pipelines from 2011 to 2013.<\/span><\/li>\n
- July 20, 2021: <\/b>Advisory on TTPs of APT40 actors associated with China\u2019s MSS Hainan State Security Department.<\/span><\/li>\n
- July 19, 2021:<\/b> CISA Insights on Chinese cyber threats overview.<\/span><\/li>\n
- March 03, 2021:<\/b> Alert on exploitation of Microsoft Exchange Server vulnerabilities.<\/span><\/li>\n
- October 1, 2020: <\/b>Alert on potential Chinese cyber response to U.S.-China tensions.<\/span><\/li>\n
- September 14, 2020: <\/b>Advisory on Chinese MSS-affiliated cyber threat actor activity.<\/span><\/li>\n
- August 3, 2020:<\/b> MAR on Chinese Remote Access Trojan: TAIDOOR.<\/span><\/li>\n
- May 13, 2020:<\/b> Joint CISA and FBI announcement on PRC targeting COVID-19 research organizations.<\/span><\/li>\n
- February 2019: <\/b>CISA webinar on Chinese cyber activity targeting MSPs.<\/span><\/li>\n
- October 3, 2018:<\/b> Alerts addressing the CLOUD HOPPER campaign exploiting MSPs.<\/span><\/li>\n
- April 27, 2017: <\/b>Alert on intrusions affecting multiple sectors by Chinese cyber actors.<\/span><\/li>\n<\/ul>\n
The CIA’s Cyber Espionage Activities<\/b><\/h2>\n
The Central Intelligence Agency (CIA) of the United States has long been a central figure in the world of espionage and intelligence. However, recent revelations have cast a spotlight on the agency’s extensive involvement in cyber espionage. Reports indicate that the CIA has conducted a series of cyberattacks targeting not just adversaries but allies as well.<\/span><\/p>\n
A <\/span>report<\/span><\/a> came from Qihoo 360, a leading cybersecurity firm, which published a report accusing the CIA of conducting an 11-year hacking campaign targeting Chinese industries and government agencies., spanned from September 2008 to June 2019 and focused on sectors such as aviation, scientific research, petroleum, and internet companies.<\/span><\/p>\n
The CIA’s digital espionage capabilities were exposed by technical evidence linking these attacks to<\/span> the CIA’s Vault 7 hacking tools<\/span><\/a>, which were shared through WikiLeaks in 2017. The researchers from Qihoo 360 noted, “By comparing relevant sample codes, behavioral fingerprints, and other information, we can be pretty sure that the cyber weapon used by the group is the cyber weapon described in the Vault 7 leaks.”<\/span><\/p>\n
\n