Unmasking the Shadow: Decoding the Tactics and Techniques of Chinese Threat Actors

The Evolving Tactics and Threat Activity of Chinese Nation-State Groups

Adapting Is the Name of the Game

In response to the COVID-19 pandemic, businesses around the world had to quickly adapt to remote work setups. This shift presented new challenges for companies to enable remote access to their sensitive systems and resources. Unfortunately, threat actors saw this as an opportunity and attempted to blend in with the noise by masquerading as remote workers to gain unauthorized access to these resources.

Furthermore, the rapid deployment of enterprise access policies meant that many organizations did not have adequate time to research and review best practices. This created a gap for cybercriminals to exploit system misconfigurations and vulnerabilities. As a result, Microsoft’s threat intelligence experts have observed a decrease in instances of desktop malware. Instead, threat groups are prioritizing the theft of passwords and tokens that enable them to access sensitive systems used by remote workers.

One example of a threat actor that Microsoft tracks is Nylon Typhoon (formerly NICKEL), a Chinese nation-state group that exploits unpatched systems to compromise remote access services. Once they have successfully breached a system, they use credential dumpers or stealers to obtain legitimate credentials, access victim accounts, and target higher-value systems. Recently, Microsoft observed Nylon Typhoon conducting intelligence collection operations against China’s Belt and Road Initiative (BRI), suggesting a mix of traditional and economic espionage activities.

Common Tactics, Techniques, and Procedures (TTPs) of Chinese Nation-State Groups

One significant trend among Chinese nation-state groups is the shift in focus from user endpoints and custom malware to exploiting edge devices and maintaining persistence. By using these devices to gain network access, threat groups can remain undetected for extended periods of time.

Virtual private networks (VPNs) have become attractive targets for threat actors because compromising them eliminates the need for traditional malware. Once a VPN is compromised, threat groups can grant themselves access and log in as any user. Despite organizations implementing stricter security measures such as tokens, multifactor authentication, and access policies, cybercriminals continue to find ways to navigate these defenses.

Another emerging trend is the use of scanning databases like Shodan and Fofa, which catalog devices and identify different patch levels across the internet. Nation-state groups also conduct their own scans to uncover vulnerabilities and exploit devices to gain access to networks. This means that organizations must go beyond device patching and should focus on inventorying their internet-exposed devices, understanding their network perimeters, and cataloging device patch levels. Establishing a granular logging capability and monitoring for anomalies is also crucial.

The Ever-Evolving Landscape of Nation-State Activity

The activities of Chinese nation-state groups in cyberspace are constantly evolving, and threat actors are becoming increasingly sophisticated in their attempts to compromise systems and cause damage. Understanding the attack patterns and tactics employed by these groups is essential for organizations to effectively defend against future threats.

As demonstrated by the COVID-19 pandemic, businesses need to remain vigilant and proactive in securing their networks and systems. Adequate research, review of best practices, and the implementation of stringent security measures are crucial to mitigate the risks posed by nation-state groups. Organizations should prioritize regular patching, implement multifactor authentication, and establish comprehensive logging and monitoring capabilities.

Editorial Perspective: The Need for International Cooperation and Cybersecurity Awareness

The evolving tactics of Chinese nation-state groups highlight the urgent need for international cooperation and heightened cybersecurity awareness. Cyber threats do not respect borders and require a collective and collaborative response from governments, organizations, and individuals around the world.

Governments must work together to establish and enforce international norms and agreements that deter and punish cyber espionage and other malicious activities. This includes diplomatic efforts to hold nations accountable for their actions in cyberspace and to promote responsible behavior.

Organizations of all sizes and sectors should prioritize cybersecurity education and awareness programs for their employees. Threat actors often exploit human vulnerabilities, such as social engineering attacks, to gain unauthorized access to systems. By fostering a culture of cybersecurity awareness and providing comprehensive training, organizations can empower their employees to be the first line of defense against cyber threats.

Furthermore, individuals must take responsibility for their own cybersecurity practices. This includes using strong and unique passwords, enabling multifactor authentication, keeping software and devices up to date, and being cautious of suspicious emails and links.

Advice for Individuals and Organizations

To effectively protect against the evolving tactics of Chinese nation-state groups and other cyber threats, individuals and organizations should:

1. Strengthen their cybersecurity defenses by implementing multifactor authentication, regularly patching systems and devices, and using robust intrusion detection systems.

2. Develop a comprehensive cybersecurity strategy that includes employee education and awareness programs. This will help individuals understand the risks and best practices for protecting themselves and their organizations.

3. Establish a robust logging and monitoring capability to quickly detect and respond to any anomalous activities.

4. Collaborate and share threat intelligence with trusted partners, industry groups, and government agencies to stay informed about emerging threats and increase collective resilience.

5. Advocate for international cooperation and responsible behavior in cyberspace. Encourage governments to foster dialogue, establish norms, and enforce consequences for actions that violate international cybersecurity standards.

By prioritizing cybersecurity and adopting a proactive approach, individuals and organizations can better defend against the evolving tactics and threat activity of Chinese nation-state groups and other cyber adversaries.