Chinese APT 'Flea' Targets US Institutions with Backdoor Malware
Researchers have discovered that a Chinese state-sponsored actor called Flea conducted a targeted campaign against foreign affairs ministries in the Americas between late 2022 and early 2023. According to the researchers, the cyber attacks involved the use of a new backdoor named Graphican. In addition to the ministries, the campaign targeted a government finance department, a corporation operating in the Americas, and an unspecified victim in Europe.
The report from the researchers highlighted the extensive arsenal of tools employed by Flea, describing the threat actor as well-funded and formidable. Along with the Graphican backdoor, the attackers utilized various "living-off-the-land" tools and tools previously associated with Flea.
Flea, also known as APT15, BackdoorDiplomacy, ke3chang, Nylon Typhoon (formerly Nickel), Playful Taurus, Royal APT, and Vixen Panda, is an advanced persistent threat group that has been targeting governments, diplomatic missions, and embassies since at least 2004.
Earlier this year, the group was attributed to a series of attacks on Iranian government entities between July and December 2022. Last month, it was revealed that the Kenyan government had been the focus of a three-year intelligence-gathering operation targeting key ministries and state institutions.
Flea has also been linked to multiple Android surveillance campaigns, including SilkBean and BadBazaar, which targeted Uyghurs in China and abroad.
Graphican Malware is an Update to Existing Ketrican
Graphican, the new backdoor used by Flea, is considered an evolution of a previous backdoor called Ketrican. It combines features from Ketrican and another implant called Okrum to create a new malware named Ketrum. Graphican stands out from Ketrican by utilizing the Microsoft Graph API and OneDrive to retrieve the details of the command-and-control (C&C) server.
Unlike Ketrican, Graphican does not have a hardcoded C&C server address. Instead, it connects to OneDrive via the Microsoft Graph API to obtain the encrypted C&C server address from a specific folder. It should be noted that the abuse of Microsoft Graph API and OneDrive has been observed in the past with Russian and Chinese threat actors such as APT28 and Bad Magic.
Graphican has the capability to communicate with the C&C server, receive commands, create an interactive command line, download files, and establish covert processes for data extraction.
Another notable tool used in the campaign is an updated version of the EWSTEW backdoor, which allows the extraction of sent and received emails from compromised Microsoft Exchange servers.
