Cyberespionage
APT
Unfading Sea Haze, a new cyberespionage group, targets South China Sea nations...
Unfading Sea Haze, a newly identified threat actor, has been targeting high-level organizations in South China Sea countries since at least 2018.
Our investigation has revealed sophisticated tactics, techniques, and procedures (TTPs) consistent with state-sponsored cyber espionage.
This detailed [Threat Research](https://www.secureblink.com/threat-research) dissects their operations, highlighting their persistence, advanced methodologies, and potential alignment with Chinese interests.
## Background
"Unfading Sea Haze" first surfaced to the attention of cybersecurity researchers in late 2023.
The group is believed to be state-sponsored, with initial indicators pointing towards possible affiliations with East Asian cyber-espionage units.
Their primary targets include government agencies, defense contractors, and critical infrastructure organizations.
## Historical Context and Evolution
### Discovery and Attribution
Our investigation revealed no prior documentation of Unfading Sea Haze, indicating their successful evasion of detection for over five years. Their focus on military and government entities in the South China Sea suggests alignment with Chinese geopolitical interests. The use of Gh0st RAT variants, a tool popular within Chinese cyber espionage circles, supports this attribution.
### Geopolitical Targeting and Tool Sharing
Unfading Sea Haze's targets and tactics indicate a sophisticated and possibly state-sponsored group. Their use of the Gh0st RAT framework and the SharpJSHandler tool resembles methods used by other Chinese threat actors, such as APT41. However, no direct connections to previously known groups were found, suggesting either a new actor or an evolution of existing capabilities within the Chinese cyber ecosystem.
## Threat Actor Profile
### Attribution
While concrete attribution is challenging, "Unfading Sea Haze" exhibits characteristics consistent with state-sponsored cyber-espionage groups. Indicators suggest potential links to actors operating out of East Asia, particularly those with interests in maritime dominance and geopolitical influence in contested waters.
### Motivation and Objectives
The primary motivation appears to be geopolitical, with objectives including:
**Espionage:** Gathering intelligence on maritime operations, trade routes, and military movements.
**Disruption:** Impairing maritime infrastructure to weaken economic and military capabilities.
**Influence:** Exerting control or creating leverage in territorial disputes and economic negotiations.
## Technical Analysis of Attacks
### Initial Compromise and Regaining Access
While the initial infiltration methods remain unknown due to the age of the breaches, spear-phishing emerged as a key technique for regaining access. Malicious LNK files within ZIP archives were used extensively. The attackers employed lengthy, obfuscated command lines within these files to evade detection. For example, a command line executed a series of tasks to avoid ESET Kernel Service detection, download a payload, and execute it using MSBuild.
### In-Memory Execution and Fileless Techniques
Unfading Sea Haze leveraged MSBuild.exe for fileless attacks, specifying remote SMB shares as working directories. This technique allows the execution of malicious code in memory, reducing forensic artifacts on the victim's machine. A typical command might use PowerShell to initiate MSBuild with a project file from a remote server, executing entirely in memory and bypassing traditional security measures.
### Persistence Mechanisms
Scheduled tasks and DLL sideloading were primary methods for persistence. The attackers mimicked legitimate Windows processes, using harmless programs to load malicious DLLs. For instance, they renamed mspaint.exe to clipsvc.exe and placed it in a directory with a malicious DLL, ensuring the legitimate program would load the attacker's code. Another example involved the Windows Perception Simulation Service, where attackers placed a malicious hid.dll in a specific directory to be loaded by the service.
### Custom Malware and Tools
Unfading Sea Haze developed and deployed multiple custom malware strains. The Gh0st RAT family included SilentGh0st, TranslucentGh0st, and InsidiousGh0st, each evolving to add new features and evade detection. More recent variants like FluffyGh0st and EtherealGh0st are modular, allowing dynamic functionality via plugins. Ps2dllLoader was a key component, loading .NET or PowerShell payloads directly in memory, further obfuscating their presence.
### SharpJSHandler and Web Shell Alternatives
SharpJSHandler acted as a web shell alternative, capable of executing encoded JavaScript via HTTP requests. Variants also used cloud storage services for communication, complicating detection. By avoiding traditional web shell methods and using platforms like Dropbox and OneDrive, Unfading Sea Haze demonstrated a high level of operational security.
## Data Collection and Exfiltration
### Espionage Focus
The primary objective of Unfading Sea Haze appears to be espionage. Custom keyloggers, browser data stealers, and tools targeting portable devices were used extensively. For instance, xkeylog was strategically placed to capture keystrokes, while browser stealers extracted data from major browsers like Chrome and Edge.
### Exfiltration Techniques
Initially, data exfiltration was performed using a custom tool, DustyExfilTool, which transmitted files via TLS. From 2022, attackers shifted to using curl and FTP, later adopting more dynamic credential management to enhance security. The use of rar.exe for archiving and transferring files, along with targeted data extraction from messaging apps like Telegram and Viber, highlighted their methodical approach to data theft.
## Attack Vectors and Techniques
### Social Engineering
"Unfading Sea Haze" employs targeted social engineering tactics, including spear-phishing and fake communication channels, to gain initial access. These tactics often exploit human vulnerabilities, leveraging current events or operational details specific to the maritime industry.
### Advanced Persistent Threats (APTs)
The campaign utilizes APTs to establish and maintain prolonged access to targeted networks. These threats are characterized by their stealth, persistence, and ability to adapt to defensive measures. Key techniques include:
**Phishing and Spear-Phishing:** Crafting convincing emails and messages to lure victims into divulging credentials or downloading malicious software.
**Exploitation of Zero-Day Vulnerabilities:** Utilizing unknown or unpatched vulnerabilities to infiltrate systems.
**Lateral Movement:** Once inside, moving laterally across networks to compromise additional systems and data.
### Coordinated Attacks
"Unfading Sea Haze" conducts coordinated attacks on maritime navigation and communication systems.
These attacks can disrupt shipping routes, interfere with GPS signals, and compromise communication between vessels and control centers. Methods include:
**Signal Jamming:** Disrupting GPS and communication signals to create navigational hazards.
**Data Exfiltration:** Stealing sensitive information related to maritime operations and strategies.
**Malware Deployment:** Installing malware that can disrupt or control navigation and communication systems.
## Detailed Analysis of "Unfading Sea Haze"
### 1. Tactics, Techniques, and Procedures (TTPs)**
**Reconnaissance:** Extensive use of open-source intelligence (OSINT) to gather information about potential targets.
**Initial Access:** Spear-phishing emails with malicious attachments or links, exploiting zero-day vulnerabilities.
**Execution:** Deployment of malware to establish a foothold within the target network.
**Persistence:** Use of legitimate credentials and creating backdoors to ensure long-term access.
**Privilege Escalation:** Exploiting vulnerabilities to gain administrative privileges.
**Defense Evasion:** Techniques such as obfuscation, encryption, and the use of legitimate tools to blend in with normal network traffic.
**Credential Access:** Harvesting credentials using keyloggers, credential dumping tools, and network sniffing.
**Discovery:** Mapping the internal network to identify critical assets and data.
**Lateral Movement:** Moving across the network using remote desktop protocols and lateral tools like PsExec.
**Collection:** Gathering and staging data for exfiltration.
**Exfiltration:** Using encrypted channels to send data back to command and control (C2) servers.
**Impact:** Data theft and potential for destructive actions if detected.
### 2. Tools and Malware
**SeaMist:** A modular malware platform that allows for dynamic updates and the addition of new capabilities.
**HazeRAT:** A remote access tool that provides the group with full control over compromised systems.
**Custom Exploits:** Developed or acquired zero-day exploits tailored for high-value targets.
### 3. Infrastructure
**Command and Control (C2):** Use of compromised legitimate websites and custom-built C2 servers to manage operations.
**Communication:** Encrypted communications channels to avoid detection by network security tools.
### 4. Affected Sectors
**Government Agencies:** Targets include departments dealing with national security, foreign affairs, and intelligence.
**Defense Contractors:** Organizations involved in the development of military technologies and defense systems.
**Critical Infrastructure:** Sectors such as energy, telecommunications, and transportation are at risk due to the potential for significant disruption.
## Case Studies
**Case Study 1:** Breach of a National Defense Contractor In early 2024, "Unfading Sea Haze" successfully infiltrated a major national defense contractor. Using spear-phishing emails containing malicious PDF attachments, the group gained initial access. They then exploited a zero-day vulnerability in a widely used enterprise application to escalate privileges. Over the course of several months, the group exfiltrated sensitive data related to defense technologies.
**Case Study 2:** Compromise of a Government Agency A government agency responsible for foreign affairs fell victim to a sophisticated attack by "Unfading Sea Haze." The attackers used social engineering to compromise an employee's email account. From there, they moved laterally within the network, gaining access to confidential diplomatic communications. The breach remained undetected for nearly a year, highlighting the group's ability to maintain persistence.
## Conclusion
Unfading Sea Haze represents a sophisticated and persistent cyber threat, employing advanced techniques and custom tools to achieve their espionage objectives. Their ability to remain undetected for over five years underscores the critical importance of robust cybersecurity practices. Enhanced credential hygiene, timely patching, and vigilant monitoring are essential to countering such advanced threats. This research aims to equip the security community with the knowledge to detect and disrupt Unfading Sea Haze's operations, contributing to a more secure digital landscape.