Google and friends disrupt suspected Beijing espionage op
www.theregister.com
: UNC2814 historically targets governments and telcos
  • The Chocolate Factory announced the Google Threat Intelligence Group-led actions on Wednesday and said that, in partnership with other teams, it terminated all Google Cloud Projects that had been controlled by UNC2814, a group that GTIG has tracked since 2017. They also disabled all known UNC2814 infrastructure and accounts, and revoked access to the Google Sheets API calls used by the Chinese snoops for command-and-control (C2) purposes.
  • “As of Feb. 18, GTIG’s investigation confirmed that UNC2814 has impacted 53 victims in 42 countries across four continents, and identified suspected infections in at least 20 more countries,” the threat hunters said in the report.
  • The security sleuths uncovered this campaign during a Mandiant investigation into suspicious activity in a customer’s environment. Specifically, this binary, “/var/tmp/xapt,” initiated a shell with root privileges, and then executed a command to retrieve the system’s user and group identifiers to confirm it had successfully escalated to root.
  • Google suspects the payload was named xapt, after the command-line tool in Debian and Ubuntu systems, to make it easier to hide in the victim’s environment and look like a legitimate tool.
  • The intruders also used a novel backdoor, Gridtide, that abuses legitimate Google Sheets API functionality to disguise its command-and-control (C2) traffic. Mandiant has linked Gridtide to UNC2814.
  • The intruders also used a novel backdoor, Gridtide, that abuses legitimate Google Sheets API functionality to disguise its command-and-control (C2) traffic. Mandiant has linked Gridtide to UNC2814.
  • After breaking in, the spies moved laterally via SSH, performed reconnaissance, escalated privileges, and then deployed the Gridtide backdoor using a command, “nohup ./xapt,” that allows it to run even after the user closes the session.
  • “Subsequently, SoftEther VPN Bridge was deployed to establish an outbound encrypted connection to an external IP address,” the threat intel team wrote. “VPN configuration metadata suggests UNC2814 has been leveraging this specific infrastructure since July 2018.”
  • The C-based backdoor uses Google Sheets as its C2 platform, can execute shell commands, and can upload and download files. In this case, the attacker deployed Gridtide on an endpoint containing personal information - likely to identify and track persons of interest - including full name, phone number, date and place of birth, voter ID and national ID numbers.
  • Melusine@tarte.nuage-libre.frFrançais
    243·
    2 days ago

    Can we do tge same for NSA, CIA FBI, ICE and all the other (and kill palantir in the process) if spying is wrong ? Or is it just that the US empire of doom is good in doing so ?

    • XLE@piefed.socialEnglish
      38·
      2 days ago

      What are your thoughts on the Chinese state-sponsored espionage group from this post?

      • Melusine@tarte.nuage-libre.frFrançais
        191·
        2 days ago

        Same shit as any state sponsored espionage, we would all be better getting rid of them , including CLOUD, FISA and PATRIOT acts.

        • XLE@piefed.socialEnglish
          35·
          1 day ago

          I saw when you said America Bad the first time too. Do you have any insights about the contents of this post?

          Is spying wrong, Melusine?

          • Melusine@tarte.nuage-libre.frFrançais
            42·
            12 hours ago

            About the attack ? Seems clever, but I am only a software engineer, no specialization in security. Also, further proof that relying on only a handful of software companies make the whole IT world quite unreliable

            • XLE@piefed.socialEnglish
              21·
              11 hours ago

              Are you impressed by the cleverness of Palantir too?

              It’s very strange you’d come into a thread with nothing to offer except Two Minutes Hate against the Bad Country, but can’t be bothered to think about what the thread is about. Nationalism is a cancer of the soul.

              • arnitbier@sh.itjust.worksEnglish
                12·
                18 seconds ago

                Incite shit, imply shit, derail shit Incite shit, imply shit, derail shit

                Fucking state sponsored, tactical bullshit

                Nationalism might be problematic. And can be cancer but only if its not warranted. Like for ingroup validation. But if your nation is making a real effort and you are putting in real work to be part of that effort. Its fine really

                Tell me, is ALL spying bad XLE? (Taking a page from your book to point out how disingenuous it sounded when you did that to Melusine)

                (Btw the translation in human terms is something along the lines of “now dance for me internet monkey” and it’s abuser tactics)

                • XLE@piefed.socialEnglish
                  21·
                  6 hours ago

                  Now you’re against “state sponsored bullshit” after pretending you weren’t? Okay. I’m glad to hear you’re against China’s behavior now.

                  I don’t agree with you that Melusine is state-sponsored by China, but since you accidentally replied to me instead of him, there you go.

          • arnitbier@sh.itjust.worksEnglish
            23·
            21 hours ago

            Tagging in here cause youre obtuse af

            Inherently? No. Its always a manner of why and how, whats to gain, whats done with it after, ect.

            Like literally everything else morality is a construct determined by every factor that makes it up, every influence, every refraction, of every effect it had over infinity

            Punching you in the face, moral? Idk, maybe. It depends I guess

            Do you understand a little better? Now stop the posturing games once you calm tf down plz

            • XLE@piefed.socialEnglish
              23·
              20 hours ago

              Don’t be so quick to tell off @Melusine@tarte.nuage-libre.fr for posturing! Maybe they genuinely hate all spying, including the spying committed by the CCP here.

              If they didn’t, then complaining about it would be posturing, wouldn’t it, comrade?

              Speaking of which, why don’t you tell me what you think of the state-sponsored people in this thread? I prefer on-topic discussion over virtue signaling.

  • treadful@lemmy.zipEnglish
    15·
    2 days ago

    I was confused at first, thinking that somehow Sheets’ systems were compromised.

    The C-based backdoor uses Google Sheets as its C2 platform, can execute shell commands, and can upload and download files.

    Instead, Sheets is just the command and control relay.

    Which is pretty weird, though.

    • PabloSexcrowbar@piefed.socialEnglish
      16·
      2 days ago

      I dunno, it’s very innocuous-looking from a traffic inspection standpoint, while also being a resilient way of storing an equally-innocuous-looking CSV. Kinda clever, if you ask me.