Persistent Attempts at Cyberespionage Against Southeast Asian Government Target Have Links to Alloy Taurus
Alloy Taurus (GALLIUM) compromised Southeast Asian government networks from 2022 to 2023 using Exchange web shells and undocumented .NET backdoors Reshell and Zapoa.
Unit 42 tracked persistent multiwave intrusions at a Southeast Asian government starting in early 2022 and continuing through 2023, attributing the activity with moderate confidence to Alloy Taurus (aka GALLIUM), a Chinese state-aligned espionage group. Attackers exploited Exchange Server vulnerabilities to deploy web shells including China Chopper, then ran reconnaissance with Fscan and WebScan, created administrative accounts, and installed undocumented .NET backdoors named Reshell and Zapoa. They established resilience by installing SoftEther VPN, brute-forced Active Directory credentials with Kerbrute, and dumped credential stores with GoDumpLsass and LsassUnhooker. The campaign reflects long-term espionage tradecraft to maintain a foothold.
- Activity cluster CL-STA-0045 attributed to Alloy Taurus/GALLIUM
- Initial access via exploited Exchange Servers and China Chopper web shells
- Undocumented .NET backdoors Reshell and Zapoa enable remote command execution
- SoftEther VPN, Kerbrute, and LSASS dumping tools used for foothold and lateral movement
- Intrusions persisted from early 2022 through 2023
- ATT&CK
- T1505.003 Server Software Component: Web ShellT1190 Exploit Public-Facing ApplicationT1110.003 Password SprayingT1219 Remote Access Software
- Vendors
- Microsoft
- Threat actors
- Alloy TaurusGALLIUMSoftcell
- Victims
- Southeast Asian government
- Organizations
- Palo Alto NetworksUnit 42
- Countries
- Southeast AsiaChina
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | cdn-sina.tw | ckers attempted to create a connection to the domain images.cdn-sina[.]tw to download a file named scvhost.txt . This file was a Co |
| ipv4 | 154.55.128.129 | use HTran ( lcx.111 ) to tunnel RDP connections to its C2 ( 154.55.128[.]129 , as shown in Figure 10). In an attempt to overcome the m |
| ipv4 | 156.251.162.29 | ironment, the attackers tried to tunnel to both that IP and 156.251.162[.]29 . The attackers kept using those tools, sometimes with th |
| ipv4 | 159.223.85.37 | ronment, the attackers attempted to create an SSH tunnel to 159.223.85[.]37 . In another compromised environment, the attackers tried |
| ipv4 | 196.216.136.139 | was to an infrastructure that overlaps with the IP address 196.216.136[.]139 that we mentioned in our post Chinese Alloy Taurus Update |
| ipv4 | 23.106.122.46 | vely straightforward and simple, to communicate with the IP 23.106.122[.]46 . This gave the attackers an easy way to execute arbitrar |
| ipv4 | 78.142.246.117 | used another subdomain ( Shell.cdn-sina[.]tw , resolved to 78.142.246[.]117 ). Attackers used it to store additional tools including |
From the original article
13 min read at unit42.paloaltonetworks.com
We observed a series of intrusions directed at a Southeast Asian government target, a cluster of activity that we attribute with a moderate level of confidence to Alloy Taurus, a group believed to be operating on behalf of Chinese state interests.
By Lior Rochberger, Tom Fakterman, Robert Falcone · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.