China’s I-Soon Group Attacks 7 Entities in FishMedley Campaign

AIThis post was created with the assistance of artificial intelligence (AI).

In a bold move, China’s I-Soon Group, linked to the notorious FishMonger APT, launched a cyberattack that compromised seven diverse entities across the globe, including government agencies, NGOs, and think tanks. This operation, known as FishMedley, targeted organizations in countries like Taiwan, Hungary, Turkey, Thailand, the US, and France, showcasing the geographical reach of this cyber threat.

Before you orderOffer from Amazon

Get privacy and security gear delivered free with Prime

Fast, free delivery on millions of items
Prime Video, Amazon Music and more included
Member-only deals all year

Start your free Prime trial Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.

You need to recognize that these attacks aren’t random; they reflect China’s strategic interests and aim to gather sensitive information.

The attackers used sophisticated malware implants such as ShadowPad, SodaMaster, and Spyder for data theft and surveillance. By employing advanced techniques, they gained privileged access through domain administrator credentials, allowing them to navigate networks with ease.

You’ll find it alarming that they utilized tools like Impacket to facilitate lateral movement, ensuring they could move undetected within the compromised systems. Credential theft was another critical aspect, as they exploited LSASS process dumps to obtain valuable credentials, paving the way for further infiltration.

FishMonger is seen as an operational arm of I-Soon, which is based in Chengdu, China. The US Department of Justice has even indicted I-Soon employees for espionage, highlighting the serious implications of their actions. Furthermore, this campaign underscores the ongoing threats posed by China-aligned APT groups, as they continue to target sensitive sectors globally.

Individuals associated with I-Soon have found themselves on the FBI’s Most Wanted list, further underscoring the risks posed by such groups. The Winnti Group umbrella, under which FishMonger operates, adds another layer of complexity to the ongoing threat landscape.

The tools employed in this attack are worth noting. ShadowPad, a modular backdoor, was used alongside ScatterBee packing, while Spyder utilized AES-CBC encryption to maintain stealth. SodaMaster, previously linked to APT10, was instrumental in password stealing.

Newly identified tools like RPipeCommander, a reverse shell, also played a role in executing commands. Network scanning tools like fscan and NetBIOS scanner demonstrated the attackers’ thorough approach.

Operation FishMedley serves as a stark reminder of the ongoing threat posed by China-aligned APT groups. Their sophisticated tactics and adaptability to changing circumstances emphasize the need for robust cybersecurity measures.

Operation FishMedley highlights the persistent danger from China-aligned APT groups, underscoring the critical need for enhanced cybersecurity measures.

The DOJ indictment marks a significant legal response to their actions, but it also highlights the urgency for organizations to bolster their defenses against such persistent threats. Understanding the implications of these attacks is crucial in today’s interconnected world, as the landscape of cyber espionage continues to evolve.