Cybersecurity incident — 2022-03-23 00:00:00
Affected organization: Rostec
Affected country: Russian Federation
Industry: Manufacturing
Event type: Exploitive
Event subtype: Exploitation of Application Server
Motive: Political-Espionage
Actor: Ministry of State Security's (MSS) Tianjin State Security Department (APT10)
Actor type: Nation-State
Actor country: China

Multiple Chinese APT groups leveraged the Russia and Ukraine war as a lure for cyberespionage operations. The APT groups have been using sanctions-related baits to attack Russian defense institutes, part of the Rostec Corporation. The hackers used new tools, which have not previously been described: a sophisticated multi-layered loader and a backdoor dubbed SPINNER. These tools use advanced evasion and anti-analysis techniques such as multi-layer in-memory loaders and compiler-level obfuscations. The operation targeted defense research institutes in Russia and possibly also in Belarus. The purpose of the backdoor and the operation is likely to collect information from targets inside the high-tech Russian defense industry to support China in its technological advancement.