McAfee Discovers a Cyber Espionage Campaign Targeting 5G Technology Firms Using Spoofed Huawei Website

Researchers at McAfee discovered cyber espionage campaigns targeting telecommunications companies linked to 5G technology.

The campaign, dubbed Operation Diànxùn, uses Huawei-branded phishing domains to lure telecoms workers into downloading malware to their work computers.

McAfee Advanced Threat Research (ATR) Strategic Intelligence security researchers Thomas Roccia, Thibault Seret, and John Fokker noted that the tactics, techniques, and procedures (TTPs) employed were consistent with the Chinese threat actors Red Delta and Mustang Panda.

Cyber espionage campaign seeks to steal secret information on 5G technology
The report authors say that the cyber espionage campaign aims to steal secret information on 5G technology.

“In this report, we have brought to light a recent espionage operation allegedly attributed to a Chinese APT group. Regarding the targeted sector (telecoms), we believe that this campaign was used to access sensitive data and to spy on companies related to 5G technology. Additionally, the use of a fake Huawei website gives more clues about the telecom targets,” the report states.

Attackers used a fake Huawei careers website to lure telecoms workers
Threat actors impersonated Huawei by crafting a convincing fake Huawei career site to lure the victims.

“We believe with a medium level of confidence that the attackers used a phishing website masquerading as the Huawei company career page to target people working in the telecommunications industry.”

They tricked the telecoms employees into downloading malware masquerading as Flash applications. On taking the bait, the victims were directed to another site flash.cn, which resembles the official Chinese Flash download website.

The researchers observed that the downloaded flash applications connected to the attackers’ domain “hxxp://update.careerhuawei.net” which mimics Huawei careers portal, “hxxp://career.huawei.com.” The security researchers also found another domain “hxxp://update.huaweiyuncdn.com” used in the cyber espionage campaign in late 2020.

“While the initial vector for the infection is not entirely clear, we believe with a medium level of confidence that victims were lured to a domain under [the] control of the threat actor, from which they were infected with malware which the threat actor leveraged to perform additional discovery and data collection,” the report found.

Most targeted telecommunication firms operated in the U.S., Europe, and Southeast Asia. However, there was a “strong interest” in German, Vietnamese, and Indian telecommunication companies.

The researchers could not identify the initial vector employed to lure the telecoms workers to the fake Huawei careers website.

Cyber espionage campaign linked to the ban on Chinese 5G technology equipment
McAfee researchers could not establish whether Huawei was involved in the cyber espionage campaign. However, they concluded that the campaign was related to the ban on Chinese equipment in the 5G technology rollout.

Various western governments were willing to allow Chinese equipment in non-essential parts of their 5G infrastructure. However, sustained pressure by the United States has further weakened this prospect over the past year.

Some governments, such as Canada, delayed deciding whether to allow Chinese 5G technology equipment in their networks. The dilemma forced most telecommunications companies to avoid Huawei equipment altogether.

Threat actors replaced the PlugX backdoor with Cobalt Strike trojan
The report noted that the previous attacks “mainly used the PlugX backdoor using DLL side loading with legitimate software, such as Word or Acrobat, to compromise targets.” However, current cyber espionage attacks replaced the PlugX trojan with a Cobalt Strike backdoor.

“While external reports have given a new name to the group which attacked the religious institutions, we believe with a moderate level of confidence, based on the similarity of TTPs, that both attacks can be attributed to one known threat actor: Mustang Panda.”

Hacking groups RedDelta and Mustang Panda were attributed to attacks on the Vatican, the United Nations General Assembly and Security Council, Myanmar government, Hong Kong Universities, Mongolia, and Tibet Ladakh. These attacks had political motives, thus suggesting Beijing’s involvement.

Commenting on Operation Diànxùn 5G technology cyber espionage campaign, James McQuiggan, Security Awareness Advocate at KnowBe4 says:

“Cybercriminal phishing attacks will add a layer of realism by using doppelganger-style websites similar to the actual website to trick the user into believing it’s the existing website.”

McQuiggan added that “As security awareness training programs educate users to watch for misspellings or other characters, this rogue URL technique creates an actual website with a similar name to a legitimate company. The user sees the website and believes it is real.”

He advises organizations to educate their workers to spot fake domains and verify URLs and emails received to avoid becoming cyberattack victims.

Photo and Link: https://www.cpomagazine.com/cyber-security/mcafee-discovers-a-cyber-espionage-campaign-targeting-5g-technology-firms-using-spoofed-huawei-website/