Same targets, new playbooks: East Asia threat actors employ unique methods

Gingham Typhoon targets government, IT, and multinational entities across the South Pacific Islands

During the summer of 2023, Microsoft Threat Intelligence observed extensive activity from China-based espionage group Gingham Typhoon that targeted nearly every South Pacific Island country. Gingham Typhoon is the most active actor in this region, hitting international organizations, government entities, and the IT sector with complex phishing campaigns. Victims also included vocal critics of the Chinese government.

Diplomatic allies of China who were victims of recent Gingham Typhoon activity include executive offices in government, trade-related departments, internet service providers, as well as a transportation entity.

Heightened geopolitical and diplomatic competition in the region may be motivations for these offensive cyber activities. China pursues strategic partnerships with South Pacific Island nations to expand economic ties and broker diplomatic and security agreements. Chinese cyber espionage in this region also follows economic partners.

For example, Chinese actors engaged in largescale targeting of multinational organizations in Papua New Guinea, a longtime diplomatic partner that is benefiting from multiple Belt and Road Initiative (BRI) projects including the construction of a major highway which links a Papua New Guinea government building to the capital city’s main road.¹

Chinese threat actors retain focus on South China Sea amid Western military exercises

China-based threat actors continued to target entities related to China’s economic and military interests in and around the South China Sea. These actors opportunistically compromised government and telecommunications victims in the Association of Southeast Asian Nations (ASEAN). Chinese state-affiliated cyber actors appeared particularly interested in targets related to the numerous US military drills conducted in the region. In June 2023, Raspberry Typhoon, a nation-state activity group based out of China, successfully targeted military and executive entities in Indonesia and a Malaysian maritime system in the weeks prior to a rare multilateral naval exercise involving Indonesia, China, and the United States.

Similarly, entities related to US-Philippines military exercises were targeted by another Chinese cyber actor, Flax Typhoon. Meanwhile, Granite Typhoon, yet another China-based threat actor, primarily compromised telecommunication entities in the region during this period, with victims in Indonesia, Malaysia, the Philippines, Cambodia, and Taiwan.

Since the publication of Microsoft’s blog on Flax Typhoon, Microsoft has observed new Flax Typhoon targets in the Philippines, Hong Kong, India, and the United States in the early fall and winter of 2023.² This actor also frequently attacks the telecommunications sector, often leading to many downstream effects.

North Korean cyber threat actors stole hundreds of millions of dollars in cryptocurrency, conducted software supply chain attacks, and targeted their perceived national security adversaries in 2023. Their operations generate revenue for the North Korean government—particularly its weapons program—and collect intelligence on the United States, South Korea, and Japan.¹⁶

North Korean cyber actors loot a record-setting amount of cryptocurrency to generate revenue for state.

The United Nations estimates that North Korean cyber actors have stolen over USD$3 billion in cryptocurrency since 2017.¹⁷ Heists totaling between USD$600 million and USD$1 billion occurred in 2023 alone. These stolen funds reportedly finance over half of the country’s nuclear and missile program, enabling North Korea’s weapons proliferation and testing despite sanctions.¹⁸ North Korea conducted numerous missile tests and military drills over the past year and even successfully launched a military reconnaissance satellite into space on November 21, 2023.¹⁹

Three threat actors tracked by Microsoft— Jade Sleet, Sapphire Sleet, and Citrine Sleet— focused the most on cryptocurrency targets since June 2023. Jade Sleet conducted large cryptocurrency heists, while Sapphire Sleet conducted smaller yet more frequent cryptocurrency theft operations. Microsoft attributed the theft of at least USD$35 million from an Estonia-based cryptocurrency firm in early June 2023 to Jade Sleet. Microsoft also attributed the heist of over USD$125 million from a Singapore-based cryptocurrency platform to Jade Sleet a month later. Jade Sleet started compromising online cryptocurrency casinos in August 2023.

Sapphire Sleet consistently compromised numerous employees, including executives and developers at cryptocurrency, venture capital, and other financial organizations. Sapphire Sleet also developed new techniques, such as sending fake virtual meeting invitations containing links to an attacker domain and registering fake job recruiting websites. Citrine Sleet followed up on the March 2023 3CX supply chain attack by compromising a downstream Türkiye-based cryptocurrency and digital assets firm. The victim hosted a vulnerable version of the 3CX application linked to the supply chain compromise.

North Korean cyber actors menace the IT sector with spear-phishing and software supply chain attacks

North Korean threat actors also conducted software supply chain attacks on IT firms, resulting in access to downstream customers. Jade Sleet used GitHub repos and weaponized npm packages in a social engineering spear-phishing campaign that targeted employees of cryptocurrency and technology organizations.²⁰ The attackers impersonated developers or recruiters, invited targets to collaborate on a GitHub repository, and convinced them to clone and execute its contents, which contained malicious npm packages. Diamond Sleet conducted a supply chain compromise of a Germany-based IT company in August 2023 and weaponized an application from a Taiwan-based IT firm to conduct a supply chain attack in November 2023. Both Diamond Sleet and Onyx Sleet exploited the TeamCity CVE-2023- 42793 vulnerability in October 2023, which enables an attacker to perform a remote code execution attack and gain administrative control of the server. Diamond Sleet used this technique to compromise hundreds of victims in various industries in the United States and European countries including the United Kingdom, Denmark, Ireland, and Germany. Onyx Sleet exploited that same vulnerability to compromise at least 10 victims—including a software provider in Australia and a government agency in Norway—and used post-compromise tooling to execute additional payloads.

North Korean cyber actors targeted the United States, South Korea, and their allies

North Korean threat actors continued to target their perceived national security adversaries. This cyber activity exemplified North Korea’s geopolitical objective of countering the trilateral alliance among the United States, South Korea, and Japan. The three countries’ leaders solidified this partnership during the Camp David summit in August 2023.²¹ Ruby Sleet and Onyx Sleet continued their trends of targeting aerospace and defense organizations in the United States and South Korea. Emerald Sleet maintained its reconnaissance and spear-phishing campaign targeting diplomats and Korean Peninsula experts in government, think tanks/NGOs, media, and education. Pearl Sleet continued its operations targeting South Korean entities that engage with North Korean defectors and activists focused on North Korean human rights issues in June 2023. Microsoft assesses that the motive behind these activities is intelligence collection.

North Korean actors implement backdoors in legitimate software

North Korean threat actors also utilized backdoors to legitimate software, capitalizing on vulnerabilities in existing software. For the first half of 2023, Diamond Sleet frequently used weaponized VNC malware to compromise victims. Diamond Sleet also resumed using weaponized PDF reader malware in July 2023, techniques that Microsoft Threat Intelligence analyzed in a September 2022 blog post.²² Ruby Sleet also likely utilized a backdoored installer of a South Korean electronic document program in December 2023.

North Korea utilized AI tools to enable malicious cyber activities

North Korean threat actors are adapting to the age of AI. They are learning to use tools powered by AI large-language models (LLM) to make their operations more efficient and effective. For example, Microsoft and OpenAI observed Emerald Sleet utilizing LLMs to enhance spearphishing campaigns targeting Korean Peninsula experts.²³ Emerald Sleet used LLMs to research vulnerabilities and conduct reconnaissance on organizations and experts focused on North Korea. Emerald Sleet also employed LLMs to troubleshoot technical issues, conduct basic scripting tasks, and draft content for spear-phishing messages. Microsoft partnered with OpenAI to disable accounts and assets associated with Emerald Sleet.