Threat actorcritical
Chinese State-Sponsored Group TA413 Adopts New Capabilities in Pursuit of Tibetan Targets
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-1040 | Authentication Bypass Leading to Unauthenticated RCE in Sophos Firewall (SFOS) | 9.8 | 100% | KEVPoC ×2 | KEV |
| CVE-2022-30190 | MSDT URL Protocol Remote Code Execution in Microsoft Windows (Follina) | 7.8 | 99% | KEVRansomwarePoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | airjaldi.online | he recently registered Tibet-themed domains t1bet[.]net and airjaldi[.]online, which spoofs the Indian ISP AirJaldi. Notably, AirJaldi |
| domain | applestatic.com | ddress used in post-exploitation, 134.122.129[.]102, hosted applestatic[.]com at the time of activity, which has historical hosting ove |
| domain | freetibet.in | close proximity to the time this IP hosted the TA413 domain freetibet[.]in. Notably, Stowaway has also been observed in use by other |
| domain | newsindian.xyz | which has historical hosting overlaps with the TA413 domain newsindian[.]xyz. Table 1: Post-exploitation infrastructure linked to TA41 |
| domain | peopleoffreeworld.tk | tivity, and also shared C2 infrastructure overlaps with the peopleoffreeworld[.]tk domain noted in the Cisco Talos LuckyCat campaign . The i |
| domain | t1bet.net | 58 also hosted the recently registered Tibet-themed domains t1bet[.]net and airjaldi[.]online, which spoofs the Indian ISP AirJal |
| domain | tibet.bet | e Google Firebase service. The group used the sender domain tibet[.]bet, which we had previously linked to TA413 activity based o |
| domain | tibetnews.today | ooper activity and TA413 campaigns. For example, the domain tibetnews[.]today referenced in Citizen Lab and Trend Micro reporting was h |
| domain | tibetyouthcongress.com | ver port TCP 110. Notably, 45.77.45[.]222 hosted the domain tibetyouthcongress[.]com at the time of this activity, which our analysis also pre |
| domain | vaccine-icmr.net | s also align with publicly attributed TA413 domains such as vaccine-icmr[.]net, as featured in historical Proofpoint reporting . TA413 a |
| domain | web.app | main associated with the Google Firebase service, tibet-gov.web[.]app, as also referenced in subsequent open-source reporting b |
| ipv4 | 118.99.13.68 | nd Micro reporting was hosted on Forewin Telecom IP Address 118.99.13[.]68 until early 2019, which later hosted multiple Tibet-theme |
| ipv4 | 134.122.129.102 | at the time. A second IP address used in post-exploitation, 134.122.129[.]102, hosted applestatic[.]com at the time of activity, which |
| ipv4 | 134.122.129.38 | 71feeb2bfe68) configured to communicate with the IP address 134.122.129[.]38, which was uploaded to public malware repositories in clo |
| ipv4 | 172.105.35.111 | fied an open directory present on a TA413-controlled server 172.105.35[.]111 in June 2022. While this was no longer accessible at the |
| ipv4 | 192.46.213.63 | ical activity. The group used the Choopa (Vultr) IP address 192.46.213[.]63 in post-exploitation activity, which hosted multiple know |
| ipv4 | 45.77.19.75 | we track as LOWZERO and contacts a hardcoded C2 IP address 45.77.19[.]75 over TCP Port 110. Further analysis of LOWZERO is include |
| ipv4 | 45.77.45.222 | X file also loads LOWZERO and uses the Choopa C2 IP address 45.77.45[.]222 for C2 over port TCP 110. Notably, 45.77.45[.]222 hosted |
| ipv4 | 65.20.75.158 | s to retrieve an HTML file from a remote web server, http://65.20.75[.]158/poc.html . The downloaded HTML file uses the ms-msdt MSPr |
| sha256 | 028e07fa88736f405d24f0d465bc789c3bcbbc9278effb3b1b73653847e86cf8 | ated with a known Royal Road variant . The decoded payload (028e07fa88736f405d24f0d465bc789c3bcbbc9278effb3b1b73653847e86cf8) ultimately loads a custom backdoor which we track as LOWZE |
| sha256 | 5217c2a1802b0b0fe5592f9437cdfd21f87da1b6ebdc917679ed084e40096bfd | e 0524x86110.exe is UPX-packed and has the SHA256 file hash 5217c2a1802b0b0fe5592f9437cdfd21f87da1b6ebdc917679ed084e40096bfd. The unpacked UPX file also loads LOWZERO and uses the Choo |
| sha256 | 86f45f0d6778fda90a56ea8986a9124d768715af425784bbd1c371feeb2bfe68 | is is based on the identification of an ELF sample (SHA256: 86f45f0d6778fda90a56ea8986a9124d768715af425784bbd1c371feeb2bfe68) configured to communicate with the IP address 134.122.129[ |
| sha256 | b113bc93dcd87d350850b7fd643c2c5aee678c3dcb717d1296b0cf57c749f0ab | passes the EC (Elliptic Curve) Diffie-Hellman public key of b113bc93dcd87d350850b7fd643c2c5aee678c3dcb717d1296b0cf57c749f0ab . It is important to note that both of the C2s we identifie |
From the original article
12 min read at recordedfuture.com
Editor’s Note: The following post is an excerpt of a full report. To read the entire analysis, click here to download the report as a PDF. This report details multiple campaigns conducted by the likely Chinese state-sponsored threat activity group TA413.
By Insikt Group® · recordedfuture.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.