Government entities in the Middle East, Africa, and Asia have been under the radar of a Chinese advanced persistent threat (APT) group as part of an ongoing cyber espionage campaign known as Operation Diplomatic Specter since late 2022.
"An analysis of this threat actor's activity reveals long-term espionage operations against at least seven governmental entities," said Lior Rochberger and Daniel Frank, researchers at Palo Alto Networks Unit 42, in a report shared with The Hacker News.
The threat actor has been conducting large-scale intelligence collection efforts, leveraging rare email exfiltration techniques against compromised servers. The targets of these attacks include diplomatic and economic missions, embassies, military operations, political meetings, ministries of targeted countries, and high-ranking officials.
The cybersecurity firm, which previously tracked the activity cluster under the name CL-STA-0043, has now graduated it to a temporary actor group codenamed TGR-STA-0043. This is due to its assessment that the intrusion set is the work of a single actor operating on behalf of Chinese state-aligned interests.
Attack chains orchestrated by the group have involved a set of previously undocumented backdoors such as TunnelSpecter and SweetSpecter. Both these backdoors allow the adversary to maintain stealthy access to their targets' networks, execute arbitrary commands, exfiltrate data, and deploy further malware and tools on the infected hosts.
"The threat actor appears to closely monitor contemporary geopolitical developments, attempting to exfiltrate information daily," the researchers said. This is realized through targeted efforts to infiltrate targets' mail servers and to search them for information of interest.
The Chinese links to Operation Diplomatic Specter further stem from the use of operational infrastructure exclusively used by China-nexus groups like APT27, Mustang Panda, and Winnti, not to mention tools like the China Chopper web shell and PlugX.
"The exfiltration techniques observed as part of Operation Diplomatic Specter provide a distinct window into the possible strategic objectives of the threat actor behind the attacks," the researchers concluded. "The threat actor searched for highly sensitive information, encompassing details about military operations, diplomatic missions and embassies and foreign affairs ministries."
