China-based Thrip hacking group targets U.S. telecoms

A Chinese cyberespionage group has been using "living off the land" techniques to hack satellite, telecom and defense companies in Southeast Asia and the United States.

According to the Security Response Attack Investigation Team at security software company Symantec Corp., the Thrip hacking group has been using legitimate admin tools and features to compromise networks -- a tactic called "living off the land."

"The purpose of living off the land is twofold," the Symantec researchers explained in a blog post. "By using such features and tools, attackers are hoping to blend in on the victim's network and hide their activity in a sea of legitimate processes. Secondly, even if malicious activity involving these tools is detected, it can make it harder to attribute attacks."

Symantec said it used its Targeted Attack Analytics tool to scan for attack patterns, which is what led the researchers to uncover these attacks in January 2018. According to the research, an attacker was using PsExec -- a free Microsoft command-line tool used to execute processes on other systems -- in a telecom company in Southeast Asia to remotely install the Trojan.Rikamanu malware, which has been previously associated with the Thrip hacking group.

From there, Symantec said, "we broadened our search to see if we could find similar patterns that indicated Thrip had been targeting other organizations. We uncovered a wide-ranging cyberespionage campaign involving powerful malware being used against targets that are a cause for concern."

Symantec researchers found three computers in China that were being used to launch targeted attacks in the communications, geospatial imaging and defense industries in both Southeast Asia and the U.S.

"Thrip's motive is likely espionage," Symantec said, noting that the Thrip hacking group took particular interest in the operation side of a satellite communications operator. "This suggests to us that Thrip's motives go beyond spying and may also include disruption."

Symantec said it has been tracking the Thrip hacking group since 2013 and had noticed its tactics have evolved over the years. Initially, Thrip used primarily custom malware; now, it uses these living-off-the-land tools and strategies. The legitimate tools Thrip uses include PsExec, PowerShell, Mimikatz, WinSCP and LogMeIn.