The Threat Actor: “UnsolicitedBooker”

The attack was carried out by an elusive cyber espionage group tracked by researchers at cybersecurity firm Check Point under the name UnsolicitedBooker. The group appears to be aligned with Chinese interests and demonstrates TTPs (tactics, techniques, and procedures) consistent with other well-documented Chinese APT clusters such as Space Pirates and threat actors previously observed deploying the Zardoor backdoor.

This campaign’s targets include a Saudi-based international organization with sensitive geopolitical relevance. Although the exact nature of the organization has not been disclosed, its persistent targeting indicates a high level of strategic value.

Phishing as the Initial Attack Vector

The initial attack chain was rooted in spear-phishing, a favored technique among espionage actors. Emails purporting to be from Saudia Airlines carried malicious Microsoft Word documents containing embedded VBA macros. These lures were cleverly disguised as flight booking confirmations, enhancing their legitimacy and increasing the likelihood of user interaction.

Upon opening the malicious attachment, the embedded macro executed a file named smssdrvhost.exe, acting as a loader that deployed the MarsSnake backdoor onto the victim’s system. Once executed, MarsSnake established communication with a Command-and-Control (C2) server hosted at contact.decenttoy[.]top.

The Malware: MarsSnake

MarsSnake is a previously undocumented malware strain tailored for covert surveillance and persistence within targeted networks. Its capabilities include:

• Collecting system information
• Downloading and executing additional payloads
• Command execution
• Maintaining long-term stealth access

MarsSnake’s design appears to focus on operational longevity and minimal detection, indicating the attackers’ intent to maintain long-term access to sensitive internal communications and resources.

Multi-Year Persistence

Evidence points to repeated intrusion attempts in 2023, 2024, and continuing into 2025, signaling a sustained espionage operation. The attackers demonstrated adaptability, modifying lures and infrastructure as needed over time. This level of persistence is typical of state-sponsored cyber actors, particularly those focused on strategic intelligence gathering rather than financial gain.

Furthermore, the infrastructure, malware characteristics, and phishing themes bear strong resemblance to previously documented Chinese campaigns in the Middle East, especially those targeting Islamic NGOs and diplomatic organizations.

Attribution and Overlaps with Known APTs

While attribution in cybersecurity is inherently complex, Check Point’s analysis places UnsolicitedBooker squarely within the Chinese cyber-espionage ecosystem. Their behavior overlaps with activity from Space Pirates, a threat group previously implicated in Middle Eastern campaigns, as well as other unnamed Chinese-affiliated clusters operating in the region.

These overlaps include:

• The use of custom backdoors
• Thematically localized phishing lures
• Reuse of infrastructure patterns
• Connections to previously burned domains

Such patterns further bolster the assessment that MarsSnake is part of a coordinated Chinese intelligence effort.

Regional and Global Implications

This campaign underscores a continued and growing cyber risk to Middle Eastern organizations, especially those with political, economic, or religious influence. The involvement of a previously undocumented malware family suggests that Chinese cyber operations are becoming increasingly specialized, with targeted malware being developed for specific regions or organizations.

From a broader perspective, this incident serves as a reminder for all global enterprises—especially those operating in geopolitically sensitive regions—to enhance their email security, endpoint monitoring, and user awareness training.

Recommendations

Security experts advise organizations to:

• Disable macro execution by default in Office applications
• Monitor unusual outbound traffic patterns
• Implement robust phishing simulation and awareness training
• Employ behavior-based threat detection tools
• Regularly update security patches and endpoint protection

As nation-state adversaries refine their tradecraft, proactive defense strategies become essential in protecting critical infrastructure and sensitive information from persistent threats like MarsSnake.

The post Chinese Hackers Deploy ‘MarsSnake’ Backdoor in Multi-Year Espionage Campaign Targeting Saudi Organization appeared first on CyberHood Sentinel.

The malicious implants, based on the TinyShell backdoor, exhibited diverse functionalities, including both active and passive backdoor operations. Notably, an embedded script was designed to disable logging mechanisms on the compromised devices, enhancing the attackers’ stealth. ​

Mandiant, a Google-owned threat intelligence firm, highlighted this development as an evolution in UNC3886’s tactics. Historically, the group has exploited zero-day vulnerabilities in devices from Fortinet, Ivanti, and VMware to infiltrate target networks and maintain persistent remote access. ​t

First identified in September 2022, UNC3886 is considered highly adept at targeting edge devices and virtualization technologies. Their primary targets include defense, technology, and telecommunication organizations across the United States and Asia. These attacks often exploit the lack of security monitoring on network perimeter devices, allowing the threat actors to operate undetected. ​

The compromise of routing devices represents a concerning trend among espionage-motivated adversaries. Such access provides long-term, high-level infiltration into critical routing infrastructure, with the potential for more disruptive actions in the future.

The latest campaign, observed in mid-2024, involved six distinct TinyShell-based backdoors, each with unique capabilities:

• appid: Supports file upload/download, interactive shell, SOCKS proxy, and configuration changes.​
• to: Similar to appid but with a different set of hard-coded command-and-control (C2) servers.​
• irad: A passive backdoor acting as a packet sniffer to extract commands from ICMP packets.​
• lmpad: Can launch external scripts to perform process injection into legitimate Junos OS processes, stalling logging.
• jdosd: Implements a UDP backdoor with file transfer and remote shell capabilities.​
• oemd: A passive backdoor communicating with the C2 server via TCP, supporting standard TinyShell commands

The attackers circumvented Junos OS’s Verified Exec (veriexec) protections, which are designed to prevent untrusted code execution. They achieved this by gaining privileged access using legitimate credentials and injecting malicious payloads into the memory of legitimate processes. ​

Organizations utilizing Juniper devices are strongly advised to upgrade to the latest firmware versions. These updates include mitigations and updated signatures for the Juniper Malware Removal Tool (JMRT), aiming to detect and remove such sophisticated threats.

This incident underscores the critical need for robust security measures and vigilant monitoring, especially for end-of-life devices that may no longer receive regular security updates.

The post Chinese Hackers Exploit Juniper Networks Routers with Advanced Backdoors and Rootkits appeared first on CyberHood Sentinel.

In a recent development, a China-linked cyber espionage group, Velvet Ant, has been exploiting a zero-day vulnerability in Cisco switches to deliver malware. This post delves into the details of the vulnerability, the implications for affected devices, and the broader context of cyber threats targeting network infrastructure.

Understanding the Vulnerability

The vulnerability, identified as CVE-2024-20399, affects Cisco NX-OS Software. It involves command injection that allows an authenticated, local attacker to execute arbitrary commands as root on the underlying operating system of an affected device. Cisco attributes this issue to insufficient validation of arguments passed to specific configuration CLI commands. This flaw, although serious, requires the attacker to have administrator credentials and access to specific configuration commands, which somewhat mitigates its severity.

Impacted Devices

The following devices are impacted by CVE-2024-20399:

• MDS 9000 Series Multilayer Switches
• Nexus 3000 Series Switches
• Nexus 5500, 5600, 6000, 7000, and 9000 Series Switches (standalone NX-OS mode)

Exploit Mechanism and Consequences

Velvet Ant’s exploitation of this vulnerability allows them to remotely connect to compromised Cisco Nexus devices, upload additional files, and execute code. This capability can be particularly dangerous as it can go undetected. The malware can operate without triggering syslog messages, which are crucial for monitoring and detecting unauthorized activities.

Discovery and Response

Sygnia, a cybersecurity firm, discovered the exploitation of CVE-2024-20399 during a broader forensic investigation. Cisco, however, only became aware of attempted exploitations in April 2024. This gap in detection underscores the challenges in monitoring network appliances, which often lack centralized logging systems.

Velvet Ant: A Persistent Threat

Velvet Ant has been active for several years, known for targeting organizations in East Asia to steal sensitive information. Their tactics involve leveraging outdated or poorly monitored devices to establish a foothold in targeted networks. The group’s operations highlight the ongoing risks posed by state-sponsored cyber espionage groups.

Preventive Measures

To mitigate the risks associated with this vulnerability, organizations should:

• Ensure all network devices are updated with the latest security patches.
• Implement robust access controls to limit administrative access.
• Regularly monitor and audit network device logs for unusual activities.
• Use centralized logging systems to detect and respond to potential threats promptly.

Conclusion

The exploitation of the CVE-2024-20399 vulnerability by Velvet Ant is a stark reminder of the importance of securing network infrastructure. As cyber threats continue to evolve, proactive measures and vigilant monitoring are essential to protect sensitive information and maintain the integrity of critical systems. Organizations must stay ahead of these threats by keeping their systems updated and employing comprehensive security strategies.

The post The rise of Velvet Ant Chinese Hackers Exploiting Cisco Zero-Day Vulnerability appeared first on CyberHood Sentinel.

Associated Groups

Comment Crew
Comment Group
Comment Panda

Command and Control Web url of APT 1

Be advised that the below web url are malicious in nature

hgcurtain.com
cultivr.com
tensins.net
decipherment.net
konamidata.com
cbssrayli.com
windowsupdote.net
ctaböe.org
gamemuster.com
kyroceras.net
nestlere.com
raylitoday.com
renewgis.com
siseau.com
bmwauto.org
t008.net
vssigma.com
hfmforum.com
checalla.com
unina2.net
anyoffice.info
it-bar.net
jjdesk.com
satelliteclub.info
space-today.info
sst1.info
stream-media.net
adomhn.com
psactel.com
eldaedu.us
na,codat.com
ptkstore.com
graceland-siu.org
xafsl5.org
feilglobe.com
creativezh.com
anfoundation.us
rwchateau.com

Hashes

4c50457c35e2033b3a03fcbb4adac7b7
38a2a6782e1af29ca8cb691cf0d29a0d
08c7b5501df060ccfc3aa5c8c41b452f
fc121db04067cffbed04d7403c1d222d376fa7ba
832d5e6ebd9808279ee3e59ba4b5b0e884b859a5
be4fbb5a4b32db20a914cad5701f5c7ba51571b7
1f70715e86a2fcc1437926ecfaeadc53ddce41c9
dd3fb2750da3e8fc889cd1611117b02d49cf17f7
583879cfaf735fa446be5bfcbcc9e580bf542c8c
ec9a9d431fd69e23a5b770bf03fe0fb5a21c0c36
d72bc671583801c3c65ac1a96bb75c6026e06a73
e5c6229825f11d5a5749d3f2fe7acbe074cba77c
9fe4bfdd258ecedb676b9de4e23b86b1695c4e1e
281a13ecb674de42f2e8fdaea5e6f46a5436c685
42192bb852d696d55da25b9178536de6365f0e68
12a9faa96ba1be8a73e73be72ef1072096d964fb
0ae167204c841bdfd3600dddf2c9c185b17ac6d4

IP Address

158.69.131.78
172.81.132.62
27.102.112.179
211.104.160.196

The post APT 1 & its IOC’s appeared first on CyberHood Sentinel.