In today’s digital age, cybersecurity is a critical concern, especially with the emergence of state-sponsored cyber-espionage actors tied to the Chinese government. Utilizing various civilian and military groups to execute increasingly sophisticated attacks, Chinese advanced persistent threat (APT) groups are equipped with significant resources, posing a global threat as they grow their capabilities and expand their range of targets. Over time, Chinese APT groups have been implicated in cyber-espionage attacks against the likes of Google, Adobe, and Dow Chemical, as well as other military, commercial, research, and industrial corporations.
While these attacks are alarming and difficult to prevent, they suffer from a fundamental weakness that can be leveraged by defenders to maintain the upper hand.
One More Tool in the Cyber-Espionage Toolbox
By nature, cyber espionage is designed to be clandestine. The goal is to covertly access and retrieve sensitive information without alerting the targeted organization or nation of the intrusion. If the attacks were noticeable or overt, targets would likely detect the breach, leading to immediate steps to terminate the attack and secure the system. This would prevent the attacker from achieving their objectives and would allow the target to identify and manage the risk coming from already exposed secrets. The stealthier an attack, the more time attackers can spend within the system, thus allowing for more data extraction. Advanced actors can persist within a network for years before being uncovered (if they are caught at all). Operating in stealth mode also helps maintain the attacker’s anonymity, which is crucial to avoiding retribution, legal consequences, or geopolitical fallout.
A highly effective method in the cyber-espionage toolbox, especially for Chinese APT groups, is the supply chain attack. Here, hackers compromise a trusted third-party supplier of the targeted organization. Subsequently, they leverage this foothold to infiltrate the victim’s network. Successfully breaking into these types of organizations (which are usually highly secured) often requires advanced offensive capabilities. However, once this access is achieved, these attacks become notoriously challenging to defend against. They offer a single point of access to several potential targets, making them a preferred modus operandi for state-sponsored adversaries seeking prolonged, stealthy access.
Storm-0558: A Wake-up Call for Cybersecurity
The recent exploit by China-based threat actor Storm-0558 highlights the need for constant vigilance. In May 2023, the Microsoft research team unveiled a supply chain attack by Storm-0558, a group believed to be backed by China. The group exploited a zero-day vulnerability in Microsoft’s code, allowing actors to create and use invalid tokens. Utilizing this capability, the group was able to gain unauthorized access to email data from approximately 25 organizations. The association with China is inferred from the group’s operational espionage tactics and methods bearing similarities to other Chinese threat actors, and the nature of the targets, hinting at China’s broader geopolitical intentions.
Microsoft recently published an exhaustive research study on the activities of Storm-0558. Based on the available indicators of compromise provided, it’s highly recommended that security teams proactively look for potential signs of past or ongoing intrusion of this actor to their network. Any unauthorized access to user emails serves as a glaring red flag and requires immediate action. Irregular email patterns, such as receiving emails from unknown senders or observing unexpected email forwarding, are also strong indications of a possible breach by this group. Lastly, any alterations to account settings, especially concerning passwords or security questions, could signify that your account’s integrity is at risk.
Forensic Data Lakes: Digital Footprints Exposing State-Sponsored Cyber Espionage
Preventing cyber-espionage attacks, especially those from state-sponsored threat actors like China’s Storm-0558, can be challenging. However, these attacks have a critical Achilles’ heel: their reliance on stealth. They can’t afford to leave forensic traces, fearing exposure of their operations and tools. Understanding this gives defenders a distinct advantage. An environment equipped with comprehensive forensic logging and storage capabilities poses a significant risk to these actors. Even a minor oversight by the attacker could trigger a forensic investigation. A rich and well-maintained forensic data lake, properly utilized, can not only uncover an attack in progress but create a cascading effect. Exposing one set of tools and methods can aid in the detection of past, ongoing, and future attacks not only on the initial target but also on other potential targets. Consequently, building and maintaining a robust and efficient forensic data lake represents one of the most effective strategies for combating actors such as Storm-0558.
As the digital landscape becomes increasingly integrated, state-sponsored cyber espionage activities, particularly by Chinese entities like Storm-0558, pose substantial global security risks. Adopting a robust and efficient forensic approach is paramount, providing potential countermeasures that can both expose and combat such sophisticated threats.
