Unveiling the Shadows: Inside the Tactics and Techniques of Chinese Threat Actors

The Evolving Tactics and Techniques of Chinese Nation-State Threat Actors

Every day, thousands of experts at Microsoft dedicate their time to analyzing signals and uncovering emerging threats in order to deliver timely security insights. While much of their work is focused on criminal actors, they also pay attention to nation-state groups to understand the geopolitical context behind their activities. In this report, we will examine how Chinese nation-state tactics, techniques, and procedures (TTPs) have evolved over time, particularly in response to the COVID-19 pandemic.

Adapting to a Changing Landscape

The shift to remote work caused by the pandemic resulted in significant changes within the Chinese cyber-espionage landscape. As companies quickly transitioned their employees to remote environments, threat actors seized the opportunity to exploit the vulnerabilities that emerged. They masqueraded as remote workers to gain access to sensitive systems that had been opened up for remote access.

Furthermore, the rushed deployment of remote access policies created a gap for cybercriminals to exploit misconfigurations and vulnerabilities. This has led to a decrease in instances of desktop malware, as threat groups focus on gaining access to sensitive systems through stolen passwords and tokens. For example, the threat group Nylon Typhoon, which originated in China, leverages exploits against unpatched systems to compromise remote access services and appliances. Once they gain access, they use credential dumpers or stealers to obtain legitimate credentials and target higher-value systems.

In a recent incident, Microsoft observed Nylon Typhoon conducting intelligence collection operations against China’s Belt and Road Initiative (BRI), suggesting a mix of traditional and economic espionage. This highlights the evolving tactics and targets of Chinese nation-state groups.

Shifting Focus: Exploiting Edge Devices and Persistence

One notable trend in Chinese cyber-espionage is the shift from targeting user endpoints and using custom malware to exploiting edge devices and maintaining persistence. Threat groups are increasingly using devices such as virtual private networks (VPNs) to gain network access and remain undetected for extended periods of time.

VPNs are an attractive target because, when compromised successfully, they grant threat actors direct access without the need for malware. Additionally, Chinese nation-state groups leverage tools like Shodan and Fofa to scan the internet, catalog devices, and identify vulnerabilities. This emphasizes the need for organizations to go beyond device patching and implement granular logging and anomaly monitoring to defend against these persistent threats.

Staying Ahead of Evolving Nation-State Threats

Understanding the tactics employed by nation-state threat actors is crucial in defending against future attacks. These threat groups are constantly evolving and growing more sophisticated in their methods. By recognizing patterns and trends, organizations can better prepare themselves to mitigate the risks posed by Chinese nation-state groups.

Organizations should prioritize securing their remote access services, ensuring proper configuration and robust authentication mechanisms. Implementing multifactor authentication and strict access policies can significantly reduce the risk of unauthorized access. It is also critical to regularly patch and update devices, including VPNs and other edge devices, and closely monitor for any suspicious activity.

Furthermore, organizations should be proactive in inventorying their internet-exposed devices, understanding their network perimeters, and maintaining an up-to-date catalog of device patch levels. This comprehensive approach will help identify potential vulnerabilities and enable organizations to take preemptive measures.

In conclusion, the evolving tactics and techniques of Chinese nation-state threat actors require vigilance and adaptability from organizations and security experts. By staying informed about the latest trends and investing in robust security measures, we can better defend against these sophisticated threats.