- Symantec researchers observed Chinese state-sponsored threat actors running ransomware against an Asian software and service company
- They claim that it is very unusual activity for state attack
- The attackers demanded $ 2 million in ransom
Emperor Dragonfly, a well -known Chinese state -sponsored threat actor, recently did something unusual – it implemented a ransomware encryption on a target network.
A report from Symantec’s threat Hunter -Team, who observed the attack by the end of 2024, noticed how on several occasions they had observed that the group does what it usually does -side -loading malicious DLL files (via a legitimate toshiba executable) to drop the back doors and establish persistence. The goal was, as is usual with state-sponsored attackers, cyber-spyage.
The victims were mostly foreign ministries in Eastern European countries and similar state agencies. But by the end of 2024, Emperor Dragonfly was seen using the same method of establishing persistence – and then dropping a ransomware – nytle load – against an Asian software and service business. The group used the Ra World Ransomware variant and demanded $ 2 million in ransom ($ 1 million if paid within three days).
A distraction
For Chinese state -sponsored threat actors, this is very unusual, says Symantec. North Korean actors are often engaged in ransomware and use the stolen money to finance their state agencies and weapons programs. However, the Chinese are more interested in cyber espionage. That said, Symantec suspects that Ransomware attacks in this case may have been a distraction to hide the traces of a major operation – probably a espionage.
The initial attack vector was not revealed, but the hackers stated that they abused a well-known Palo Alto Pan-OS vulnerability (CVE-2024-0012) to violate the infrastructure. “The striker then said that administrative credentials were obtained from the company’s intranet before stole the Amazon S3 Cloud Legitimation information from his VEAM SERVER, where they used them to steal data from its S3 bucket before encrypted computers,” researchers explained .
The last step was to use the same DLL Side loading methodology.
