Cybersecurity researchers have discovered a Chinese state-sponsored threat actor who spent more than four years inside a major Asian telecom company’s networks. The attack started when the company’s publicly available application was breached to drop web shells on its networks.
The breach was discovered by cybersecurity incident response firm Sygnia, which chose not to disclose the telecom company’s name. The threat actor, however, has been dubbed Weaver Ant and described as “stealthy and highly persistent.” Weaver Ant maintained persistent access and enabled lateral movement inside the company’s network using web shells and tunneling.
Two different web shells were initially dropped — an encrypted variant of China Chopper and a novel malicious tool called INMemory. Chine Chopper is a 4 kb web shell and backdoor which, as the name suggests, has previously been used by many Chinese hacking groups. It offers features like file management, command execution, and data extraction, all while keeping its file size small and actively avoiding detection.
INMemory, on the other hand, is a C# webshell contained within a portable DLL file, which delivers the final malicious payload via an HTTP request, claims Sygnia’s report. The tool decodes a hardcoded and GZipped Base64 string and functions entirely in system memory to evade detection.
Weaver Ant was also active during their entire intrusion period, adapting their TTPs as the compromised firm’s network environment changed to regain lost and persistent access. Even when Sygnia revoked the hackers’ access from the compromised servers, the threat group was detected attempting to regain access to the victim’s network.
The threat actor exhibits characteristics in usual Chinese hacking groups, including selecting a focused industry and geographic location aligning with China’s cyber strategy, well-defined objectives, attack times, and web shell and malicious DLL deployment. Chinese threat groups often share tools, infrastructure, and sometimes even manpower, making attribution difficult.
In the News: 23andMe going bankrupt is bad news for user data
