In a recent cyber attack, a government entity and a religious organization in Taiwan fell victim to a China-linked threat actor known as Evasive Panda. This threat actor utilized a new post-compromise toolset called CloudScout to steal data from various cloud services by exploiting stolen web session cookies. The toolset seamlessly integrates with MgBot, which is Evasive Panda’s signature malware framework.
The .NET-based CloudScout toolset was active between May 2022 and February 2023, featuring 10 different modules written in C#. Three of these modules were designed to steal data from Google Drive, Gmail, and Outlook, while the purpose of the remaining modules remains undisclosed. Evasive Panda, also known as Bronze Highland, Daggerfly, and StormBamboo, is a cyber espionage group with a history of targeting entities in Taiwan, Hong Kong, and the Tibetan diaspora.
ESET researchers revealed that CloudScout modules are programmed to hijack authenticated sessions in web browsers by stealing cookies and gaining unauthorized access to cloud services. The stolen information, including email messages and files with specific extensions, is compressed into a ZIP archive for exfiltration by MgBot or Nightdoor. However, new security measures implemented by Google, such as Device Bound Session Credentials and App-Bound Encryption, are expected to make cookie-theft malware obsolete.
The development of CloudScout by Evasive Panda highlights the ongoing threat posed by state-sponsored cyber actors. In a separate incident, the Government of Canada accused a sophisticated state-sponsored threat actor from China of conducting reconnaissance efforts against various Canadian domains, including government departments, political parties, critical infrastructure, and media organizations. It is essential for organizations to stay vigilant and implement robust cybersecurity measures to defend against such sophisticated attacks.
Source link