Between July 2024 and March 2025, SentinelLABS, observed and investigated a series of targeted intrusions and reconnaissance activities attributed to China-nexus cyberespionage groups. These campaigns, tracked under the ShadowPad and PurpleHaze clusters, represent persistent and strategic efforts to compromise high-value targets, including cybersecurity vendors like SentinelOne.
Severity Level: Critical
Incident Details
Reconnaissance Against SentinelOne
- Timeframe: October 2024
- Type: Remote reconnaissance (Activity E)
- Target: SentinelOne’s Internet-facing infrastructure
- Outcome: No breach occurred; attackers were detected early
- Goal: To evaluate accessible systems and identify weak points for potential future exploitation
Supply Chain Compromise Attempt
- Timeframe: Early 2025
- Entity Affected: An organization managing hardware logistics for SentinelOne employees
- Method: Intrusion using ShadowPad malware
- Outcome: Attack was identified and mitigated; SentinelOne was not breached
These activities were part of a broader operational campaign that involved:
- An initial compromise of a South Asian government entity (June & October 2024)
- Intrusion into a European media organization (September 2024)
- Over 70 organizations impacted globally across sectors
Threat Group Attribution
ShadowPad Cluster
- Malware Used: ShadowPad (modular backdoor), obfuscated with ScatterBrain and ScatterBee variants
- Attribution: Strong links to APT41 and other China-nexus groups
- Campaign Traits:
- Used for espionage, credential harvesting, and backdoor persistence
- Previously sold privately to Chinese actors
- Infrastructure overlaps with publicly reported campaigns
PurpleHaze Cluster
- Tools Used: GOREshell (reverse SSH backdoor), THC community tools, GOREVERSE malware
- Attribution:
- Infrastructure overlaps with APT15 (Ke3Chang / Nylon Typhoon)
- Links to UNC5174, a suspected MSS contractor
- Target Sectors: Government, media, logistics, cybersecurity
- Notable Tactics: ORB (Operational Relay Box) network usage, DLL hijacking, SSH tunneling, Linux and Windows cross-platform implants
Attack Flow
ShadowPad Chain (Activity A, B, C)
- Initial Access and Execution:
- PowerShell scripts download and execute AppSov.exe
- Nimbo-C2 agent and PowerShell exfiltration scripts used
- Sensitive files exfiltrated to: https[://]45.13.199[.]209/rss/rss.php
- Persistence & C2:
- ShadowPad configured to communicate over DNS-over-HTTPS to evade detection
- C2 domains: news.imaginerjp[.]com, dscriy.chtq[.]net
PurpleHaze Chain (Activity D, E, F)
- Vulnerabilities exploited: CVE-2024-8963, CVE-2024-8190 (Ivanti), CVE-2023-46747, CVE-2024-1709
- Deployment of webshells and THC tooling
- Deployed GOREshell backdoors (on both Windows and Linux)
- Used glib-2.0.dll via DLL hijacking in VMWare software
- SSH over WebSocket to: downloads.trendav[.]vip, 107.173.111[.]26
- Recon activities to map SentinelOne’s internet-exposed infrastructure
- DNS record mimicry using sentinelxdr[.]us and secmailbox[.]us
Recommendations
- Ensure Ivanti, F5, Check Point, Fortinet, SonicWall, and CrushFTP appliances are updated with the latest security patches.
- Implement detection rules to identify PowerShell invoking curl.exe to download executables (e.g., AppSov.exe) to directories like C:\ProgramData. Flag such behavior for immediate investigation as it often indicates malware staging via remote access tools.
- Monitor Windows services such as VGAuthService.exe for DLL loading from directories containing unsigned files (e.g., glib-2.0.dll).
- Continuously monitor /usr/lib/systemd/system/ for newly created or modified .service files that reference executables like snapd or update-notifier. Alert on any unauthorized or anomalous .service creation by non-root users or from unverified sources.
- Alert on outbound curl usage where:
– POST requests are made
– Destination domains contain .php endpoints (e.g., /rss/rss.php)
– Known C2 IPs like 45.13.199[.]209 are used - Scan for new .php files in webroot directories containing system-level commands (e.g., system(‘/bin/sudo’)).
- Watch for execution of tools associated with The Hacker’s Choice (THC), such as: dsniff, mcl, or clear13. Leverage known hashes and behavioral signatures to flag these tools even if renamed.
- Enable detection of WebSocket traffic (wss://) over port 443 to known malicious C2 IPs/domains such as downloads.trendav[.]vip or 107.173.111[.]26.
- Block the IOCs at their respective controls
https://www.virustotal.com/gui/collection/c61d33dab838b4a63a6b71edd2f40bed614aa9ae9e5b8ced340e00c829d4ceff/iocs
Source:
- https://www.sentinelone.com/labs/follow-the-smoke-china-nexus-threat-actors-hammer-at-the-doors-of-top-tier-targets/
- https://www.sentinelone.com/labs/top-tier-target-what-it-takes-to-defend-a-cybersecurity-company-from-todays-adversaries/
- https://gbhackers.com/new-report-reveals-chinese-hackers-attempted-to-breach/
Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn
No related posts found.