Telecom
Operation Crimson Palace: Chinese State-Sponsored Espionage, Expands in Southeast Asia – Sophos Report Finds
Sophos, a global leader of innovative security solutions for defeating cyberattacks, on Tuesday released its report, “Crimson Palace: New Tools, Tactics, Targets,” which details the latest developments in a nearly two-year long Chinese cyberespionage campaign in Southeast Asia.
Sophos X-Ops first reported on what they named Operation Crimson Palace in June and detailed Sophos X-Ops’ discovery of three separate clusters of Chinese nation-state activity—Cluster Alpha, Cluster Bravo and Cluster Charlie—inside a high-profile government organization.
After a brief hiatus in August 2023, Sophos X-Ops noted renewed Cluster Bravo and Cluster Charlie activity, both within the initial targeted organization and in numerous other organizations within the region.
While investigating this renewed activity, Sophos X-Ops uncovered a novel keylogger that the threat hunters named “Tattletale,” which can impersonate users who have signed into the system and gather information related to password policies, security settings, cached passwords, browser information, and storage data. Sophos X-Ops also notes in the report that, in contrast to the first wave of the operation, Cluster Charlie increasingly switched to using open-source tools rather than deploying the types of custom malware they developed in the initial wave of activity.
“We’ve been in an ongoing chess match with these adversaries. During the initial phases of the operation, Cluster Charlie was deploying various bespoke tools and malware,” said Paul Jaramillo, director, threat hunting and threat intelligence, Sophos.
“However, we were able to ‘burn’ much of their previous infrastructure, blocking their Command and Control (C2) tools and forcing them to pivot.
“This is good; however, their switch to open-source tools demonstrates just how quickly these attacker groups can adapt and remain persistent. It also appears to be an emerging trend among Chinese nation-state groups.
“As the security community works to secure our most sensitive systems from these attackers, it’s important to share the insights into this pivot.”
Cluster Charlie, which shares tactics, techniques and procedures (TTPs) with the Chinese threat group Earth Longzhi, was originally active from March to August 2023 in a high-level government organization in Southeast Asia.
While the cluster was dormant for several weeks, it re-emerged in September 2023 and was active again until at least May 2024. During this second stage of the campaign, Cluster Charlie focused on penetrating deeper into the network, evading endpoint detection and response (EDR) tools and gathering further intelligence.
In addition to switching to open-source tools, Cluster Charlie also began using tactics initially deployed by Cluster Alpha and Cluster Bravo, suggesting that the same overarching organization is directing all three activity clusters.
Sophos X-Ops has tracked ongoing Cluster Charlie activity across multiple other organizations in Southeast Asia.
Cluster Bravo, which shares TTPs with the Chinese threat group Unfading Sea Haze, was originally only active in the targeted network for a three-week span in March 2023.
However, the cluster reappeared in January 2024, only this time it was targeting at least 11 other organizations and agencies in the same region.
“Not only are we seeing all three of the ‘Crimson Palace’ clusters refine and coordinate their tactics, but they’re also expanding their operations, attempting to infiltrate other targets in Southeast Asia.
“Given how frequently Chinese nation-state groups share infrastructure and tools, and the fact that Cluster Bravo and Cluster Charlie are moving beyond the original target, we will likely continue to see this campaign evolve—and in potentially new locations. We will be monitoring it closely,” said Jaramillo.
To learn more, read “Crimson Palace: New Tools, Tactics, Targets” on Sophos.com. For details about Sophos’ threat hunting and other services for disrupting cyberattacks, go to Sophos Managed Detection and Response (MDR).
For an in-depth look at the threat hunting behind this nearly two-year long cyber espionage campaign, register for the upcoming webinar “Intrigue of the Hunt: Operation Crimson Palace: Unveiling a Multi-Headed State-Sponsored Campaign” on Sept. 24 at 2 PM ET: https://events.sophos.com/operation-crimson-palace/.
QNET, a leading global lifestyle and wellness direct selling company, has been honored with the prestigious “Direct Selling Company of the Year” award at the recent AfriTECH 4.0 Conference and Awards.
This recognition underscores QNET’s significant contributions to financial inclusion and e-commerce in Africa.
The award was presented to QNET by Mr. Chike Onwuegbuchi, Co-Convener of AfriTech & ATAEx Awards. Onwuegbuchi commended QNET for its unwavering commitment to empowering individuals and driving economic growth across the continent.
He highlighted the company’s innovative approach to direct selling, coupled with its focus on financial literacy and digital innovation.
Biram Fall, Regional Manager for QNET Sub-Saharan Africa, expressed his gratitude for the recognition.
He emphasized QNET’s dedication to innovation, entrepreneurship, and digital transformation in Africa.
Fall highlighted the company’s impact on the Nigerian economy, particularly through its advanced technology and robust e-commerce platform.
“QNET’s participation in this event further solidified its position as a key player in the region’s digital transformation journey.
“We are committed to staying in Nigeria, our biggest market in Sub-Saharan Africa, and contributing to the region’s development,” Fall stated.
During his keynote speech, Fall underscored QNET’s commitment to empowering individuals through knowledge and skill development.
He highlighted the FinGreen financial literacy program, which has already trained over 1,350 young people in Nigeria to make informed financial decisions.
Fall also emphasized the potential of direct selling to drive economic growth in Africa. “Our e-commerce-driven direct-selling model provides opportunities for income generation across more than 100 countries, helping individuals pursue their goals while contributing to community growth,” he explained.
Addressing the challenges of limited banking infrastructure and cash dependency in Africa, Fall stressed the importance of financial inclusion for e-commerce growth.
He called for collaboration to accelerate financial inclusion and e-commerce growth in Africa, fostering a financially inclusive future for the continent.
Martin Ekpeke, Managing Editor of ITPulse, a leading Nigerian online Information and Communications Technology (ICT) news platform, was awarded the prestigious Digital Reporting Excellence Award at the Africa Tech Alliance Excellence (ATAEx) Awards.
The award, presented by Tech Castle Foundation, recognizes Ekpeke’s exceptional coverage of cyber threats, digital privacy, and the evolving online security landscape.
“We are thrilled to honor Martin Ekpeke with the Digital Reporting Excellence Award.
“His insightful reporting has been instrumental in raising awareness about critical digital issues and empowering individuals and organizations to stay informed and protected,” said Chike Onwuegbuchi from Tech Castle Foundation.
Ekpeke expressed his gratitude for the recognition, stating, “I am deeply honored to receive this award.
“It is a testament to the hard work and dedication of the entire ITPulse team.
“We are committed to delivering high-quality, informative content that empowers our readers to navigate the complex digital world.”
The Africa Tech Alliance Excellence (ATAEx) Awards celebrate individuals, businesses, and institutions driving digital transformation in Africa.
This year’s event brought together tech enthusiasts, regulators, and other key stakeholders in the Nigerian ICT ecosystem.
Nigerian Communications Commission (NCC) has emphasized the judiciary’s crucial role in Nigeria’s digital transformation. During the Annual Workshop for Judges on Legal Issues in Telecommunications, Executive Vice Chairman Aminu Maida highlighted the judiciary’s reliance on digital tools to enhance justice delivery.
He stressed the need for special protections for telecommunication infrastructure, which faces disruptions from vandalism, theft, and restricted access.
Maida called for judicial support to implement the Presidential Order designating telecommunications infrastructure as Critical National Information Infrastructure.
This order prohibits unauthorized actions against such infrastructure without a lawful court order.
The judiciary’s role in protecting fundamental rights, enforcing digital contracts, and developing digital jurisprudence is vital for Nigeria’s digital transformation.
Chief Justice of Nigeria, Justice Kudirat Kekere-Ekun, commended the NCC’s efforts to protect consumers from unfair practices and emphasized the judiciary’s commitment to the telecommunications sector.
She highlighted concerns such as cybersecurity risks, consumer data protection, and the need for improved dispute resolution frameworks within the digital economy.
The workshop aims to equip judicial officers with the technical expertise required to address emerging legal challenges in telecommunications.
Nigeria’s digital economy has significant growth potential, with projected revenues of $18.30 billion by 2026, expected to create employment opportunities, reduce poverty, and promote innovation.
The NCC is working with key stakeholders to ensure the seamless implementation of the Presidential Order and to keep Nigeria competitive in the global digital economy.
QNET Named ‘Direct Selling Company of the Year’ at AfriTECH 4.0 Awards
CBN’s New Directive: Banks to Trade Foreign Currency Deposits
Newmark Group Wins PR Excellence Award at AfriTECH 2024 Summit
Martin Ekpeke Honored with Digital Reporting Excellence Award @ATAEx
Cloud Energy Solar Shines Bright with 200 Watts Street Lighting Bulb
First Bank Proposes New Name after Upgrading Banking Platforms
Moniepoint Boosts STEM Education with Unveiling of Tosin Eniolorunda Design Lab @OAU
TD Africa to Empower 400 Young Women with TecHERdemy
Edo State Launches Data Centre in Benin
GSMA, Automotive Edge Computing Consortium Partner to Drive Forward Interoperable Connected Vehicle Services
Telecom2 days agoAfriTECH 4.0 Holds in Lagos Today
E-Financial2 days agoKekere-Ekun, CJN Blames Reliance on Telecom Services for Online Banking Glitches
E-Business2 days agoinq. Nigeria Celebrates Double Win at Tech Innovation Awards (TIA) 2024
Telecom2 days agoTelcos Scale Down on Network Investments to Reduce Forex Losses
E-Financial1 day ago9PSB Promotes Financial Literacy @ World’s Savings Day 2024
E-Financial2 days agoUS Elections: Trump Wins! What Does this Mean for Nigeria?
E-Financial2 days agoZenith Bank Commends Customers After Successfully Unveiling Upgraded Enhanced Tech infrastructure
E-Financial2 days agoEcobank Serves Customers Notice of Planned Service Disruption