CYBERTHREATANALYSIS
CHINA

By Insikt Group®
June 16, 2021

Threat Activity Group RedFoxtrot
Linked to China’s PLA Unit 69010;
Targets Bordering Asian Countries

CYBER THREAT ANALYSIS | CHINA

This report profiles a suspected Chinese state-sponsored threat
activity group, RedFoxtrot, with links to PLA Unit 69010. The activity was
identified through a combination of large-scale automated network traffic
analytics and expert analysis. Data sources include the Recorded Future
Platform, SecurityTrails, DomainTools, PolySwarm, Farsight, and common
open-source tools and techniques. The report will be of most interest
to individuals engaged in strategic and operational intelligence relating
to the activities of Chinese military intelligence units in cyberspace andnetwork defenders with a presence in Central or South Asia. Analysis
cut-off date: June 1, 2021.

Executive Summary
Recorded Future’s Insikt Group has identified
ties between a suspected Chinese state-sponsoredthreat activity group we track as RedFoxtrot and theChinese military intelligence apparatus, specifically
People’s Liberation Army (PLA) Unit 69010 located inÜrümqi, Xinjiang. This activity offers a glimpse into PLA
operations following a major organizational restructure
beginning in 2015 and follows a period where public
reporting has largely concentrated on groups affiliatedwith China’s Ministry of State Security (MSS).
Unit 69010 is likely the Military Unit Cover Designator(MUCD) for a Technical Reconnaissance Bureau (TRB)
within the PLA Strategic Support Force (SSF) Network
Systems Department (NSD), an information and cyber
warfare branch of the PLA. Due to lax operational
security measures employed by a suspected RedFoxtrot
operator, Insikt Group linked the threat group to thephysical address of Unit 69010’s headquarters. Publicly
available procurement and court documents further tied
Unit 69010 both to this address and to the SSF. Multiple
academic publications also support the hypothesis that
this unit has a cyber mission.
RedFoxtrot has been active since at least 2014
and predominantly targets government, defense, andtelecommunications sectors across Central Asia, India,
and Pakistan, aligning with the likely operational remit ofUnit 69010. Of particular note, within the past 6 months,
Insikt Group detected RedFoxtrot network intrusions
targeting 3 Indian aerospace and defense contractors;
major telecommunications providers in Afghanistan,

1

CTA-CN-2021-0616

India, Kazakhstan, and Pakistan; and multiple government
agencies across the region. RedFoxtrot maintains large
amounts of operational infrastructure and has likely
employed both bespoke and publicly available malware
families commonly used by Chinese cyber espionage
groups, including Icefog, PlugX, Royal Road, Poison Ivy,
ShadowPad, and PCShare. RedFoxtrot activity overlaps
with threat groups tracked by other security vendors as
Temp.Trident and Nomad Panda.

Key Judgments• Formerly known as the Lanzhou Military Region‘s
Second Technical Reconnaissance Bureau, PLA
Unit 69010 has very likely been incorporated into
the Network Systems Department of the PLASSF following a 2015 restructure.
• We believe that RedFoxtrot is a Chinese statesponsored threat activity group based on
identified links to a specific PLA unit and the useof shared custom capabilities considered uniqueto Chinese cyber espionage groups.
• In 2020, RedFoxtrot, alongside multiple other PLA
and MSS-affiliated threat groups, likely gained
access to the ShadowPad backdoor.
• In the aftermath of the 2015 restructuring,
activity linked to previously tracked PLAaffiliated cyber espionage groups has declined,
likely due to old activity groups disbanding or
merging to form new clusters. With continued
activity from suspected PLA groups such as
Tonto Team, Tick, Naikon, and RedFoxtrot, andthe emergence of new Chinese threat activity
groups with suspected PLA links, Insikt Group
believes that PLA-affiliated groups remain
prominent within the Chinese cyber espionage
sphere despite increased attention on their MSS
counterparts.

Recorded Future ® | www.recordedfuture.com

CYBER THREAT ANALYSIS | CHINA

Figure 1: High-level RedFoxtrot TTPs and Recorded Future data sourcing graphic(Source: Recorded Future)

www.recordedfuture.com | Recorded Future ®

CTA-CN-2021-0616

2

CYBER THREAT ANALYSIS | CHINA

Threat Analysis

RedFoxtrot’s Connection to PLA Unit 69010

Insikt Group identified links between RedFoxtrot’s operational
RedFoxtrot has primarily targeted aerospace and defense,
infrastructure
and PLA Unit 69010 through the online persona
government, telecommunications, mining, and researchorganizations in Afghanistan, India, Kazakhstan, Kyrgyzstan, of a suspected RedFoxtrot threat actor. Due to lax operational
Pakistan, Tajikistan, and Uzbekistan. These targets suggest the security measures employed by this individual, we uncovered agroup is likely interested in gathering intelligence on military connection to the likely physical address of the headquarters
technology and defense. RedFoxtrot has historically employed of PLA Unit 69010, No. 553, Wenquan East Road, Shuimogou
multiple open- and closed-source tooling commonly shared District, Ürümqi, Xinjiang (新疆乌鲁木齐市水磨沟区温泉东路553
across Chinese cyber espionage groups, including PlugX, 号). Insikt Group is not publicly disclosing the identity of thisPoison Ivy, Royal Road, PCShare, and IceFog. Insikt Group also individual; however, an extensive online presence provided
identified multiple links to suspected ShadowPad command corroborating evidence indicating that this individual is locatedand control (C2) infrastructure, tracked by Recorded Future in Ürümqi, has an interest in hacking, and also has a suspected
as AXIOMATICASYMPTOTE, providing evidence of yet another historical affiliation with the PLA’s former Communications
1
Chinese group with access to the custom backdoor. Notable Command Academy (通信指挥学院) located in Wuhan.
RedFoxtrot victims over the past 6 months include multiple
Indian aerospace and defense contractors; telecommunications
companies in Afghanistan, India, Kazakhstan, and Pakistan; andseveral national and state institutions in the region. Activity over1
Also formerly known as the Communications Command College, the Communications
this period showed a particular focus on Indian targets, which Command Academy has previously been noted for its role in training former 3PLA personnel
occurred at a time of heightened border tensions between India in information and cyber warfare and military communications systems. It has now been likely
incorporated into the College of Information and Communication at the National University ofand the People’s Republic of China (PRC).
Defense Technology (国防科技大学信息通信学院).

Figure 2: Heatmap of RedFoxtrot activity targeting Central and South Asia

3

CTA-CN-2021-0616

Recorded Future ® | www.recordedfuture.com

CYBER THREAT ANALYSIS | CHINA

What is Unit 69010?
Unit 69010 is likely the MUCD for a bureau within the PLASSF headquartered in Ürümqi, Xinjiang. Formerly known as theLanzhou Military Region‘s Second TRB according to research
published in 2011 from the Project 2049 Institute, signals
intelligence (SIGINT) has long been considered to be within Unit
69010’s area of responsibility. The unit also likely has multiple
subordinate offices primarily responsible for monitoring militaryactivity along China’s western border. An analysis of academic
output attributed to the unit also provides evidence that Unit
69010 likely has a cyber mission as late as 2015 (example
publications 2,3). Prior to a restructure beginning in 2015, much
Figure 3: Entrance to suspected Unit 69010 compound located at No. 553 Wenquan East Road,
of China’s cyber espionage efforts were linked to TRBs and Ürümqi (Source: Baidu Maps)
bureaus of the PLA General Staff Department’s (GSD) Third No. 553, Wenquan East Road
Department (3PLA). 3PLA was broadly responsible for defensive
Public repor ting has indicated that Unit 69010 is
SIGINT, including monitoring Chinese communication networks,
headquarteredin Ürümqi‘s Shuimogou [水磨沟] district. We
protecting the security of Chinese domestic computer networks,
and conducting cyber espionage-oriented computer network identified that the No. 553 Wenquan East Road address, which
exploitation. Beginning in 2015, the capabilities and tasking of is situated within Shuimogou, has appeared on multiple Xinjiang
the TRBs and 3PLA were reorganized and largely moved into provincial court documents directly linking PLA Unit 69010 to
the newly formed SSF NSD. Evidence explored in the following this location. Furthermore, this address is featured on 5 SSFsection indicates that Unit 69010 was likely moved under the issued tenders for a variety of equipment over the past several
years, indicating that Unit 69010 was likely moved to the SSF
SSF NSD as part of China’s military reforms.
following PLA reforms.
The former Lanzhou Military Region was incorporated within
the new Western Theater Command of the PLA following the2015 restructure. The Western Theater Command is one of 5
theater commands of the PLA, and is almost certainly tasked
with monitoring India, Pakistan, and Central Asia. This orientation
directly aligns with observed RedFoxtrot activity. Similarly,
intelligence gathering on defense, military, telecommunications,and government targets also aligns with the expected operational
scope of a PLA unit and fits the target profile of other PLA-linked
groups (1,2,3).

Figure 4: Court document linking Unit 69010 to No. 553 Wenquan East Road address 4

Yang Ping 杨萍 and Liang Guangming 梁广明, “物联网安全问题及对策分析” [Security
Problems and Solutions for the Internet of Things], 无线互联科技 Wireless Internet
Technology 6, (2013): 13.
3
Yang Ping 杨萍 and Tian Jianchun 田建春, “Wireshark网络安全风险评估关键技术研究” [Research on Key Technologies of Wireshark Network Security Risk
Assessment], 网络安全技术与应用 Network Security Technology and Application 9(2015): 54.
4https://m.qcc[.]com/wenshuDetail/b218bb9ef2c2e2b282f8c88e098001b7.html
2

www.recordedfuture.com | Recorded Future ®

Figure 5: Recorded Future Event for SSF-issued military procurement documents for 553 Wenquan
East Road address (Source: Recorded Future)

CTA-CN-2021-0616

4

CYBER THREAT ANALYSIS | CHINA

Baidu Maps shows that this address corresponds to a large
compound facility comprising multiple buildings and a residential
area. As evident from satellite and street-level imagery, multiple
satellites are visible on the roof of the unit’s main building as wellas the hill behind the compound, while other attributes commonly
seen at PLA bases are also present, such as a parade area, arunning track and sports fields, and a large gated entrance.

Figure 6: Aerial images of suspected Unit 69010 compound located on Wenquan East Road 5

Two other properties share the same address as Unit 69010: an apartmentcomplex across the street, which we were unable to confirm is affiliated with thebase, and an electronics store directly beside the base. It is very unlikely that the
RedFoxtrot persona and related cyber espionage activity is linked to either ofthese 2 properties and the address almost certainly refers to Unit 69010 in thecontext of our investigation.
5

5

CTA-CN-2021-0616

Recorded Future ® | www.recordedfuture.com

CYBER THREAT ANALYSIS | CHINA

Figure 7: Timeline of RedFoxtrot infrastructure detection, malware detections, and NTA events in 2021 (Source: Recorded Future)

Mapping RedFoxtrot’s Sprawling Infrastructure
Using Recorded Future Network Traffic Analysis (NTA),
adversary infrastructure detection, and other common analyticaltechniques, we have tracked a large cluster of RedFoxtrot
infrastructure and associated malware samples used in active
intrusions over the past 6 months. There are strong ties between
this activity and publicly reported campaigns dating back to atleast 2014. We identified clear and consistent hosting overlaps
for domains linked to the identified infrastructure cluster, as wellas common targeting and overlapping malware use. Notably,
we identified the following high-level trends in the group’s
infrastructure tactics, techniques, and procedures (TTPs):• Use of a large number of Dynamic DNS (DDNS) domains
which form part of overlapping infrastructure clusters

As previously referenced in our reporting on the China-linked
group RedEcho, network infrastructure used in ShadowPad
infections is tracked by Insikt Group as AXIOMATICASYMPTOTE.

AXIOMATICASYMPTOTE and PlugX Clusters
Using Recorded Future adversary infrastructure detection
methods, we identified that a large proportion of the RedFoxtrot
domains are linked to AXIOMATICASYMPTOTE and PlugX C2
infrastructure. Many of these were also used as C2s for different
malware families, such as PCShare. Commonly, the group usedsingle servers to host a swath of DDNS domains, which weremoved around in bulk over time.

• DDNS domains often contain hints regarding
geographical targeting or spoof specific organizations(for example, “inbsnl.ddns[.]info”, “adtl.mywire[.]org”, and“indianmail.zyns[.]com”)• Strong preference for DigitalOcean and Choopa (Vultr)
hosting providers in recent times• Use of AXIOMATICASYMPTOTE infrastructure, indicativeof the group’s likely access to the ShadowPad backdoor

www.recordedfuture.com | Recorded Future ®

CTA-CN-2021-0616

6

CYBER THREAT ANALYSIS | CHINA

Figure 8: Partial Maltego chart of RedFoxtrot PlugX and AXIOMATICASYMPTOTE Infrastructure

7

CTA-CN-2021-0616

Recorded Future ® | www.recordedfuture.com

CYBER THREAT ANALYSIS | CHINA

Links to Historical Campaign Targeting Turkish
Language Speakers

Overlaps With Publicly Reported Activity

RedFoxtrot activity overlaps with groups tracked by othersecurity
vendors as Temp.Trident/Nomad Panda. A multitude of
4 domains linked to RedFoxtrot activity registered in mid-2019(kelimelerdunyasi[.]org, stratejibilimi[.]com, adobesupport[.] infrastructure, targeting, and malware overlaps were discovered
net, and superkelimeler[.]com) were all used by the group to between RedFoxtrot activity and 2018 to 2019 campaigns
mirror a legitimate Turkish language website for learning English, tracked by FireEye as WATERFIGHT and SKYLINE, which targeted
ingilizcem[.]org. In addition to consistent hosting overlaps and countries in Central Asia (1,2). Additionally, elements of thethe shared spoofing of ingilizcem[.]org, 3 out of the 4 domains group’s historical use of the Royal Road (also known as 8.t)
are linked to the same privacy protection registration email rich text format (RTF) weaponizer to deliver Icefog and Poison
address, stratejibilimi.com@protectdomain[.]org. While these Ivy payloads have been previously documented. Some notablewebsites no longer resolve, open-source reporting indicates overlaps with publicly reported activity include the followingthat adobesupport[.]net was used to serve the Poison Ivy non-exhaustive examples:
SKYLINE variant masquerading as an Adobe Flash installer in
mid-2019 (shortly after the registration of these 4 domains). We
believe that these domains were likely used by RedFoxtrot totarget Turkish-language speakers. Since this time, there havebeen consistent hosting overlaps between these 4 domains andmultiple additional RedFoxtrot domains. Notably, the Poison Ivy
variant served from adobesupport[.]net closely overlaps withadditional suspected RedFoxtrot activity:
Poison Ivy SKYLINE Variant
acb11d9d0652c95b16db17fda918ff5b6ee66815
6a30fe6276b0fa66f74c9720
c1e3a5e171d0de6054f4a1aeb9a46ff176ef5ba6
464304b2f2660a23396e91f4
379af30d508cdbae7eb201041d8eb815b239e18
1dd8106145d4263753df3acd9367718fd58c658dce22c995f3e10bc3a5425814
ddf221686e166e3129a53e897

1. The domain skylineqaz.crabdance[.]com has beenpreviously referenced in public reporting in relationto activity targeting Turkey and Kazakhstan, and washosted on DigitalOcean IP address 206.189.153[.]132
in September 2019. This domain features additional
temporal hosting overlaps with multiple RedFoxtrot DDNS
domains:• redhatboy.dynamic-dns[.]net• scorpio.dns04[.]com

C2 Domain• koreckaccord01.zzux[.]com
skylineqaz.crabdance[.]com• exat.dnset[.]com• macfeesyn.ns01[.]info

coreldraw.kozow[.]com• gulistan.wikaba[.]com• macfeeupdate.ddns[.]info

hostmail1[.]com• lexuz.dns05[.]com• lexuz.x24hr[.]com

capture.kozow[.]com

In addition to characteristics previously highlighted
regarding this Poison Ivy variant, there are also direct historicalhosting overlaps between the kelimelerdunyasi[.]org domain andhostmail1[.]com (45.251.241[.]13) as well as hostmail1[.]com andskylineqaz.crabdance[.]com (206.189.153[.]132).

2. The Poison Ivy C2 capture.kozow[.]com was historically
hosted on DigitalOcean IP address 45.76.197[.]157 frommid-to-late 2020, overlapping with the RedFoxtrot
PCShare C2 domain locker.camdvr[.]org. As noted inprevious reporting, the Poison Ivy sample linked to thecapture.kozow[.]com C2 is the same SKYLINE variant
used in the previously referenced campaign targeting
Turkey and Kazakhstan.
3. In mid-2020, the domain pisces.zzux[.]com wasconcurrently hosted on the DigitalOcean IP address
142.93.212[.]86 alongside a cluster of RedFoxtrot Indiathemed DDNS domains:• inbsnl.ddns[.]info• inbsnl.ddns[.]ms• indian.mefound[.]com

www.recordedfuture.com | Recorded Future ®

CTA-CN-2021-0616

8

CYBER THREAT ANALYSIS | CHINA

4. Additional links between the pisces.zzux[.]com
domain and RedFoxtrot infrastructure have also
been previously documented. Furthermore, oneof the above RedFoxtrot DDNS domains, inbsnl.
ddns[.]info, is linked to a QUICKHEAL sample(f45c6f8695fbc6e537cea15142f062a0d21c4a556c5fc1f7
a2f3ee661b036ffc), a shared custom malware family
previously used in RedFoxtrot activity.
The Maltego chart below outlines additional overlaps withpreviously publicly reported RedFoxtrot activity.

Figure 9: Overlap between 2020/2021 RedFoxtrot activity and publicly reported SKYLINE and WATERFIGHT campaigns

9

CTA-CN-2021-0616

Recorded Future ® | www.recordedfuture.com

CYBER THREAT ANALYSIS | CHINA

Mitigations

Outlook

We recommend that users conduct the following measures to
Our research uncovered cyber espionage activity attributed
detect and mitigate activity associated with RedFoxtrot activity: to RedFoxtrot, a group linked to Unit 69010 of the PLA-SSF. Of
particular note: from 2020 to 2021, the group heavily targeted• Configure your intrusion detection systems (IDS),
Indian defense contractors, telecommunications providers,
intrusion prevention systems (IPS), or any networkand government organizations at a time of heightened tension
defense mechanisms in place to alert on — and upon
between China and India. We also recently revealed a campaign
review, consider blocking connection attempts to andtargeting critical infrastructure within India that we attributed
from — the external IP addresses and domains listed in
to a group called RedEcho. While the RedEcho campaign posed
Appendix A.
pre-positioning concerns within India’s electricity system,• Multiple state-sponsored and financially motivated threat RedFoxtrot’s activity is more aligned with traditional PLAactivity groups continue to use DDNS domains in network linked activity in gathering military intelligence. These differing
intrusion activity. All TCP/UDP network traffic involving
strands of activity exemplify Beijing’s multi-pronged approach
DDNS subdomains should be blocked and logged (using
within cyberspace, using it as a tool for gathering intelligence
DNS RPZ or similar).
on military technology and national security issues as well as• Recorded Future Threat Intelligence, Third-Party
political developments and foreign relations; for monitoring
Intelligence, and SecOps Intelligence module users can
ethnic and religious minorities such as Uyghurs, Tibetans, andmonitor real-time output from NTA and Malware Analysis Catholics, and to further goals set out within strategic policy
analytics to identify suspected targeted intrusion activity such as the Belt and Road Initiative and Made in China 2025.
involving your organization or key vendors and partners.
Recent years have marked an apparent downturn in reported• Ensure Microsoft Office and Windows software are up to activity linked to previously tracked PL A-affiliated cyberdate with the latest software updates to protect against
espionage groups in the aftermath of the 2015 restructuring,
malicious documents that attempt to exploit known
likely due to old activity groups disbanding or merging to form
vulnerabilities for code execution, such as those created new clusters. In this period, Chinese cyber espionage efforts haveusing the Royal Road RTF weaponizer.
been widely characterized by activity linked to the Ministry ofState Security (MSS), China’s principal civilian foreign intelligence
service. The MSS has been frequently identified employing a
private contractor model for cyber espionage activity, according
to US government indictments and the anonymous Chinese
APT doxxing persona Intrusion Truth. However, with continued
activity from PLA-linked groups such as Tonto Team, Tick,
Naikon, and RedFoxtrot, we believe that PLA-affiliated groups
remain prominent within the Chinese cyber espionage sphere
despite increased attention on their MSS counterparts.

www.recordedfuture.com | Recorded Future ®

CTA-CN-2021-0616

10

CYBER THREAT ANALYSIS | CHINA

Appendix A — Indicators of Compromise
Readers can access the indicators listed below in our public Insikt Group Github repository: https://github.com/Insikt-Group/
Research (RedFoxtrot - June 2021).
Network Indicators:
Domains:
adobesupport[.]net
adtl.mywire[.]org
appinfo.camdvr[.]org
aries.epac[.]tobilling.epac[.]tocapture.kozow[.]com
chock.mywire[.]org
coreldraw.kozow[.]com
czconnections.ddns[.]info
drdo.dumb1[.]com
drdo.mypop3[.]net
dsgf.chickenkiller[.]com
elienceso.kozow[.]com
exat.dnset[.]com
exat.zyns[.]com
execserver.giize[.]com
exujjat.xxuz[.]com
fashget.theworkpc[.]com
fivenum.mooo[.]com
foreverlove.zzux[.]com
forum.camdvr[.]org
fukebutt.zzux[.]com
googleupdate.myz[.]info
gulistan.wikaba[.]com
hcl.sexidude[.]com
honoroftajik.dynamic-dns[.]net
hostmail1[.]com
https.dnset[.]com
https.ikwb[.]com
https.otzo[.]com
https.vizvaz[.]com
inbsnl.ddns[.]info
inbsnl.ddns[.]msindiaeducation.mefound[.]com
indian.mefound[.]com
indianmail.zyns[.]com
itsupport.firewall-gateway[.]net
jpgdowngaussip.ddns[.]info
kastygost.compress[.]tokelimelerdunyasi[.]org
koreckaccord01.zzux[.]com
laugh.toh[.]info
lexuz.dns05[.]com
lexuz.x24hr[.]com
linkedin[.]organiccrap[.]com
locker.camdvr[.]org
login.kozow[.]com
logonfaker.longmusic[.]com
macfee.webredirect[.]org
macfeesyn.ns01[.]info
macfeeupdate.ddns[.]info
mall.mywire[.]org
manual.gleeze[.]com
manuals.wikaba[.]com
menus.giize[.]com
menus.kozow[.]com
mfedownload.freetcp[.]com
mfeupdate.ddns[.]info
mfeupload.freetcp[.]com
miche.justdied[.]com
msgsober.xxuz[.]com
msn.dnsnet[.]com
nicodonald.accesscam[.]org
niteast.strangled[.]net
notice.theworkpc[.]com
nproccshow.zyns[.]com
otc[.]toythieves[.]com
pisces.zzux[.]com
prace.gleeze[.]com
pracute.camdvr[.]org
11

queryinfo.mrbonus[.]com
quickheal.firewall-gateway[.]net
randomanalyze.freetcp[.]com
rastelcs.kozow[.]com
rci.ddns[.]info
redhatboy.dynamic-dns[.]net
scorpio.zzux[.]com
secindia.mywire[.]org
secssl.ooguy[.]com
secssl.theworkpc[.]com
secupdate.kozow[.]com
skylineline.crabdance[.]com
skylineqaz.crabdance[.]com
smcupdate.mooo[.]com
srcrail.kozow[.]com
stratejibilimi[.]com
sunway2.chickenkiller[.]com
superkelimeler[.]com
supports.casacam[.]net
supports.gleeze[.]com
sysman.ddnsgeek[.]com
sysmantec.firewall-gateway[.]net
sysmantec[.]organiccrap[.]com
tajikstantravel.dynamic-dns[.]net
tele.zyns[.]com
thinkv.dynamic-dns[.]net
thinkv.epac[.]totrand.mefound[.]com
trendiis.sixth[.]biz
updateinfo.kozow[.]com
uzwatersource.dynamic-dns[.]net
water.xxuz[.]com
wawaqq.ddns[.]info
whitepages.dynamic-dns[.]net
wsliversourcecor.epac[.]toyatedo.organiccrap[.]com
IP Addresses (May 2021):
206.189.153[.]132
45.77.178[.]76
45.32.22[.]220
66.42.33[.]214
45.76.216[.]62
142.93.217[.]73
143.110.241[.]54
141.164.43[.]124
149.28.131[.]147
143.110.187[.]104
165.232.180[.]8
143.110.249[.]226
178.128.124[.]161
159.89.172[.]102
188.166.235[.]99
172.104.64[.]123
198.13.51[.]228
188.166.178[.]133
206.189.143[.]219
198.13.42[.]157
45.32.146[.]174
202.182.111[.]249

CTA-CN-2021-0616

Recorded Future ® | www.recordedfuture.com

CYBER THREAT ANALYSIS | CHINA

Malware Samples:
PCShare2723ac49d3f59b51d96f3ab3605becdef1987242ef3d9d5b8490b0c9abe45049
425d2a6416a59943428e8727d2ad6247eb8342c35c4bd1d5b80df25d6fbcae94
4c6a45d08cb649b5486d9719634f903b3561e7820eda31bd50d811a01bd3481b
b668f9e213282cd1b941ab8d6dd5f3dd3266011ae16c0795ca86d12a57c095cc
69a9e5545103b582173ed268fc5ca0014c4d2e17337a953752b0157a76cc0bcb
7f3c26b8d3087f1cc345da965bb7af1a58488c6e260f12e72d8274d949a857bd
556d34db7e60b0d25eca0d8e6b9297cd9f2174c0d2ca013c0036a067457a2d01
e8f347745b1808db185c682af87896a941b4042f5de919e2010749152bda48ad
a7a3cd98252047717f8f429d2060aa84c6ee4ed8ae60ee15ad0b2b5807158c70
e1ca30bbdea8523aec6570f1b2f59012d0899875325a9ac88f09e09c14734ecc
f0c0a9b2911ee1f1774e69e0be313eda2054d744fa547f1c64ba0f078db3fcd99f9fde45784f93c18ea998d90aa6791905c81061d974416dd722071fbd54688e
69a9e5545103b582173ed268fc5ca0014c4d2e17337a953752b0157a76cc0bcb
8afcc6a25320a28833334a413a0f395a73bacf033fe0e84fea7ed4fec7945ca4
eeef1439b17280dfd7ce821752551aee57f3d1b7f385fe9cf331f69abd35cd96
8afcc6a25320a28833334a413a0f395a73bacf033fe0e84fea7ed4fec7945ca4
QUICKHEAL
4a7910fe2c0e611be52d15798563c007aa632d47eae1f020be95fde27d963da9
f45c6f8695fbc6e537cea15142f062a0d21c4a556c5fc1f7a2f3ee661b036ffc
851010b875a2ae5c68e85c7d549082539e427b0e9f0c5efef92e1396c6d8a0ae
PlugX
c21a3a44b46e7242c0762c8ec5e8a394ddc74b747244c5b83678620ae141e59c
6cd5079a69d9a68029e37f2680f44b7ba71c2b1eecf4894c2a8b293d5f768f10
45c944889a482ae2e0e0a8e260c3be737cb612c8804164badef61e8a8713b92f
Icefog0c596299c47ce6305e07f55397fd69d49c8cab4f4b34a617bb6670dcaac9d9f2
11f38b6a69978dad95c9b1479db9a8729ca57329855998bd41befc364657d654
D096EECD60710CCF7F1658A52D54CAEF9CB26B3857B3A3DBEFA688C769E07339
087d8bee1db61273a7cd533d52b63265d3a8a8b897526d7849c48bcdba4b22ec
73bbb96e078a2ca3d55e0acffe0f9c80edf6ff0459a25c34edb4c14bb88783c1
e149E7C145D440193A0E3BF4B54C44DE00BBC3872EF18D6DA3C12F1E7ADD3053
PoisonIvy
acb11d9d0652c95b16db17fda918ff5b6ee668156a30fe6276b0fa66f74c9720
c1e3a5e171d0de6054f4a1aeb9a46ff176ef5ba6464304b2f2660a23396e91f4
379af30d508cdbae7eb201041d8eb815b239e181dd8106145d4263753df3acd9367718fd58c658dce22c995f3e10bc3a5425814ddf221686e166e3129a53e897
Royal Road
51e3f3a762ab6fb0c3db4819560c6b1607cdcd257ce375e68fdf1a17ff5c2cb5
597c0c6f397eefb06155abdf5aa9a7476c977c44ef8bd9575b01359e96273486
4e1a2f731688f9aab80b1f55d9101bb1cddec08214d4379621c434899a01efbf
a95bbc1f067783c1107566ed7897549f6504d5367b8282efe6f06dc31414c314
9d239ddd4c925d14e00b5a95827e9191bfda7d59858f141f6f5dcc52329838f0
f5365387320ae6e6907fd2700f340ba8712cb08f7e52b2ec4dccfe99b3d648ef
ecdf806bb7ac876bac8250a1f0ff40395faf7a6738df6e0f62553c4164fdf16d
5238f8d8c3d16b52d39aa722daff663a5e6307c4b46e360969d84bf409a2690f

www.recordedfuture.com | Recorded Future ®

CTA-CN-2021-0616

12

CYBER THREAT ANALYSIS | CHINA

Appendix B — Detailed Malware Analysis

Institute. This organization is a Chinese military-civilian open
innovation platform jointly established by the Dongguan Municipal
Chinese Cyber Espionage Groups Continue to Employ People’s Government and PLA-SSF Information Engineering
University. We were unable to identify any additional files signed
Shared Capabilities
by this certificate, indicating it is not in widespread use. It is
RedFoxtrot’s infrastructure is linked to an assortment of currently unclear how the threat activity group gained access to
PlugX, Poison Ivy, Royal Road, PCShare, and IceFog samples used the code signing certificate, but it provides an additional nexus
by the group. Furthermore, the use of AXIOMATICASYMPTOTE to a PLA-linked institution. In all cases, the dropper drops a
infrastructure has historically been linked to the use of the PCShare loader to the following location and executes it using
ShadowPad malware. 2 of these tools, IceFog and ShadowPad, rundll32.exe:
are shared capabilities considered unique to Chinese cyberespionage groups. While Royal Road, PCShare, PlugX, and Poison C:\{user}\AppData\Local\Microsoft\Windows\Credentials\
Ivy are available more widely, their use is also strongly linked Winload\halmacpi.slt
to multiple China-nexus threat activity groups. In recent times,
In each identified loader sample, the PCShare payload is
RedFoxtrot has increasingly favored the use of PCShare, PlugX,
injected by the loader into the legitimate process RDPclip.exe.
and ShadowPad, with the group’s use of IceFog, Poison Ivy, andEach identified PCShare payload also shares a common mutex
Royal Road declining.
(78de65b0701f3c9238a37).

PCShare RAT

One of the identified RedFoxtrot PCShare C2 domains(supports.casacam[.]net) is mentioned in a 2020 Bitdefender
The Chinese open-source remote access trojan (RAT)
report detailing a Chinese activity group targeting Southeast
PCShare is thought to have roots within the Chinese cybercriminal
Asia government institutions that details a similar PCShareunderground, with versions of the tool now freely available via
dropper and loader component. However, the researchers note
GitHub. In recent years, variants of PCShare have been used inthat this domain and other samples that inject into RDPclip.exe
suspected Chinese cyber espionage activity targeting South East
appear to be unrelated to the FunnyDream campaign analyzed
Asia governments and in campaigns attributed to the Chinese
within that report, which aligns with our findings that this is likely
group Cycldek (also known as Goblin Panda). We identified
another case of shared tooling across Chinese activity groups.
multiple PCShare samples communicating with infrastructure
within the identified RedFoxtrot infrastructure cluster. This
PlugX
consisted of a dropper and loader component which ultimately
A RedFoxtrot PlugX sample named Sys.exe (SHA256:
injects the PCShare RAT payload into the legitimate rdpclip.
exe process. We identified 3 different samples used to drop c21a3a44b46e7242c0762c8ec5e8a394ddc74b747244c5b83
678620ae141e59c) was uploaded to a malware repository
PCShareRAT loaders, as listed below:
from India in September 2020. Sys.exe is a self-extracting RAR
File NameSHA256 Hashcontaining 3 files, RasTls.exe (a legitimate Symantec executable),
RasTls.dll (malicious DLL used in DLL hijacking), and RasTls.dll.
556d34db7e60b0d25eca0d8e6b9
Sophos Systemdb (the PlugX payload), reflective of the ”triad” method of DLL
297cd9f2174c0d2ca013c0036a06
Protection Service.exe
hijacking employed by many Chinese activity groups.
7457a2d01
Upon execution, RasTls.exe sideloads the malicious
RasTls.dll (6cd5079a69d9a68029e37f2680f44b7ba71c2b1ee
osloader.exe
cf4894c2a8b293d5f768f10), which in turn decr ypts
a n d l o a d s t h e P l u g X p ay l o a d f ro m R a sT l s . d l l . d b
5802823e50e9aca0d765fa198383f ( fe 1 8 a d a e c 076 f fc e 6 3 d a 6 a 2 a 0 24 c e 9 9 b 8 a 5 5 b c 4 0 a1 f 0 6 e
security_audit_
74ca18859b1181cfc3f72f62667bc
d556e0997ba6b6d716). Once loaded, the payload contacts the
template_final.doc
a67dc2C2 domain miche.justdied[.]com over TCP port 80. This same
The Sophos System Protection Service.exe sample legitimate Symantec executable has been abused by multiple
i s s i g n e d u s i n g a d i g i t a l c o d e s i g n i n g c e r t i f i c a t e activity groups to load PlugX, and has also previously been used
i s s u e d t o 东 莞 信 大 融 合 创 新 研 究 院 ( S H A1 t h u m b p r i n t : by RedFoxtrot to load both IceFog and QuickHeal. The PlugX
8E3991D623A7FFD86516224A0B6932785EF63F9E), which samples used by RedFoxtrot all use an export function called
translates to Dongguan Xinda Integrated Innovation Research MSCORE, which uses similar methods for decoding.
B668f9e213282cd1b941ab8d6dd5f
3dd3266011ae16c0795ca86d12a5
7c095cc

13

CTA-CN-2021-0616

Recorded Future ® | www.recordedfuture.com

CYBER THREAT ANALYSIS | CHINAQUICKHEALWe also identified multiple samples related to the identified
adversary infrastructure cluster that appear to overlap with themalware variant tracked by FireEye as QUICKHEAL. All samples
share an unusual export “GetOfficeDatatal” and feature multiple
overlaps with 2 QUICKHEAL samples reported by FireEye inrelation to the WATERFIGHT and SKYLINE campaigns.
One of the notable code overlaps is a function that loads
memory addresses for SQLite and NSS functions, which are thenused to parse, decode, and decrypt username and password
combinations from the victim’s Mozilla profiles. QUICKHEAL has
also continued to use code to check if the backdoor is runningin a proxy, and shares a hardcoded User-Agent: Mozilla/4.0(compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR
2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.210.

• Another RedFoxtrot domain, water.xxuz[.]com, islinked to a historical Icefog sample (ICEFOG-P version)(SHA256: 0c596299c47ce6305e07f5
5397fd69d49c8cab4f4b34a617bb6670dcaac9d9f2). This
sample was likely used in the WATERFIGHT campaign.
• Notably, 2 Royal Road lures used by the group in 2018and 2019 specifically reference 2 telecommunications
providers in Pakistan and India. We subsequently
identified 2021 intrusions targeting both of theseorganizations. While we cannot confirm whether
these previous intrusion attempts using Royal Road
were successful, it indicates that telecommunications
providers are a long term target of the group.

Royal Road, IceFog, and Poison Ivy
Elements of RedFoxtrot’s use of the Royal Road RTF
weaponizer to load the IceFog and Poison Ivy backdoors
throughout 2018 and 2019 have been previously documented;
however, we have not observed the group load other malware
families using Royal Road other than these 2. While wider use of
the Royal Road weaponizer by some Chinese groups is ongoing,
its use by RedFoxtrot and several other China-linked groups has
dropped since early 2020, likely in response to extensive public
reporting. In addition to public reporting detailing the group’s useof these capabilities, further examples of RedFoxtrot’s historicaluse of these tools to target Central Asia, Pakistan, and India
include the following:• A RedFoxtrot Royal Road sample(51e3f3a762ab6fb0c3db4819560c6b160
7cdcd257ce375e68fdf1a17ff5c2cb5) from 2019 islinked to the identified infrastructure cluster, with theC2 domain remaining active into late 2020. The RTF
document title is “DYSL-QT_Slide_DMC_090719.doc”,
which likely corresponds to the “Defence Researchand Development Organisation (DRDO) Young Scientist
Laboratory for Quantum Technologies” (DYSL-QT)
located in Hyderabad, India. Additionally, DMC is likely
in reference to the DRDO Management Council (DMC),
suggesting the group used this lure in activity targeting
Indian defense research. The RTF document drops thesame Poison Ivy SKYLINE variant payload referenced
earlier in the report (367718fd58c658dce22c995f3e10
bc3a5425814ddf221686e166e3129a53e
897), which is configured to communicate with the C2
capture.kozow[.]com.

www.recordedfuture.com | Recorded Future ®

CTA-CN-2021-0616

14

CYBER THREAT ANALYSIS | CHINA

Recorded Future Threat Activity Group and Malware Taxonomy

Recorded Future’s research group, Insikt, tracks
threat actors and their activity, focusing on state actors
from China, Iran, Russia, and North Korea, as well as cybercriminals - individuals and groups - from Russia, CIS states,
China, Iran, and Brazil. We emphasize tracking activity
groups and where possible, attributing them to nation state
government, organizations, or affiliate institutions.

ADVERSARY

Our coverage includes:•

Government organizations and intelligenceagencies, their associated laboratories, partners,
industry collaborators, proxy entities, andindividual threat actors.

•

Recorded Future-identified, suspected nation
state activity groups, such as RedAlpha,
RedBravo, Red Delta, and BlueAlpha and manyother industry established groups.

•

Cybercriminal individuals and groups establishedand named by Recorded Future•

Newly emerging malware, as well as
prolific,persistent commodity malware

INFRASTRUCTURECAPABILITY

VICTIM

Insikt Group names a new threat activity group or
campaign when analysts have data corresponding to atleast three points on the Diamond Model of Intrusion
Analysis with at least medium confidence, derived from our
Security Intelligence Graph. We can tie this to a threat actor
only when we can point to a handle, persona, person, ororganization responsible. We will write about the activity asa campaign in the absence of this level of adversary data.
We use the most widely-utilized or recognized name for aparticular group when the public body of empirical evidence
is clear the activity corresponds to a known group.
Insikt Group utilizes a simple color and phonetic alphabet
naming convention for new nation state threat actor groups
or campaigns. The color corresponds to that nation’s flag
colors, currently represented below, with more color/nation
pairings to be added as we identify and attribute new threat
actor groups associated with new nations.
For newly identified cybercriminal groups, Insikt
Group uses a naming convention corresponding to the
Greek alphabet. Where we have identified a criminal entity
connected to a particular country, we will use the appropriate
country color, and where that group may be tied to a specificgovernment organization, tie it to that entity specifically.
Insikt Group uses mathematical terms when naming
newly identified malware.

15

CTA-CN-2021-0616

Recorded Future ® | www.recordedfuture.com

CYBER THREAT ANALYSIS | CHINA

About Recorded Future
Recorded Future is the world’s largest provider of intelligence for enterprisesecurity. By combining persistent and pervasive automated data collection and analytics
with human analysis, Recorded Future delivers intelligence that is timely, accurate,
and actionable. In a world of ever-increasing chaos and uncertainty, Recorded Futureempowers organizations with the visibility they need to identify and detect threats
faster; take proactive action to disrupt adversaries; and protect their people, systems,
and assets, so business can be conducted with confidence. Recorded Future is trusted
by more than 1,000 businesses and government organizations around the world.
Learn more at recordedfuture.com and follow us on Twitter at @RecordedFuture.

www.recordedfuture.com | Recorded Future ®

CTA-CN-2021-0616

16