Hackers CL-UNK-1068 have launched attacks against critical infrastructure in Asia, using web server exploits and credential theft tools like Mimikatz. Researchers at Palo Alto Networks Unit 42 have attributed the attacks to Chinese threat actors targeting high-value organizations in sectors such as aviation, energy, and telecommunications.
The CL-UNK-1068 group , where “CL” refers to “cluster” and “UNK” to unknown motives, has targeted organizations in South, Southeast, and East Asia. The attacks have hit the aviation, energy, government, law enforcement, pharmaceutical, technology, and telecommunications sectors. Researchers assess with “medium to high confidence” that the primary goal of the campaign is cyberespionage .
According to security researcher Tom Fakterman, the analysis reveals a multi-layered toolkit that includes custom malware, modified open-source utilities , and living-off-the-land binaries (LOLBINs). These tools allow attackers to maintain access within targeted environments.
See also: z0Miner malware is installed via Web Server
The tools are designed to target both Windows and Linux, with the attackers relying on a mix of open-source utilities and malware families such as Godzilla, ANTSWORD, Xnote , and Fast Reverse Proxy (FRP). All of these tools have been used by various Chinese hacking groups in the past.
Attack Techniques and Tools of CL-UNK-1068
While both Godzilla and ANTSWORD operate as web shells, Xnote is a Linux backdoor that has been detected since 2015 and has been developed by an adversarial collective known as Earth Berberoka (in attacks targeting online gambling sites).
Typical attack chains include exploiting web servers to deliver web shells and lateral traffic to other hosts, followed by attempts to steal files matching specific extensions (“web.config,” “.aspx,” “.asmx,” “.asax,” and “.dll”) from the “c:\inetpub\wwwroot” directory of a Windows web server.
Other files collected by CL-UNK-1068 include web browser history and bookmarks, XLSX and CSV from desktops and USER directories, and database backup files (.bak) from MS-SQL servers. Additionally, Chinese hackers have been observed using WinRAR to archive the relevant files, encoding the files to Base64 and running the certutil -encode. They then run the type command to print the Base64 to their screen via the web shell.
See also: Hackers use CyberStrikeAI for AI-powered attacks
“ By encoding the files as text and printing them to their screen, the attackers were able to extract data without actually uploading any files ,” Unit 42 reported . The hackers likely chose this method because the shell on the host allowed them to execute commands and view the output, but not to directly transfer files.
One of the techniques used in these attacks is the use of legitimate Python (“python.exe” and “pythonw.exe”) to launch DLL side-loading attacks and secretly execute malicious DLLs, including FRP for persistent access, PrintSpoofer , and a custom scanner named ScanPortPlus.
Credential Theft Tools and Reconnaissance
CL -UNK-1068 is also said to have engaged in reconnaissance efforts using a custom .NET tool called SuperDump. However, recent attacks have switched to a new method that uses batch scripts to collect host information and map the local environment.
See also: SolarWinds: Critical RCE vulnerabilities in Web Help Desk
A wide range of tools are also used by the adversary to facilitate credential theft: Mimikatz to extract passwords from memory, LsaRecorder to hook LsaApLogonUserEx2 to record the WinLogon password, DumpItForLinux and the Volatility Framework to extract password hashes from memory, and the SQL Server Management Studio Password Export Tool to extract the contents of “sqlstudio.bin” which stores login information for Microsoft SQL Server Management Studio (SSMS).
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
This campaign is part of a broader pattern of Chinese state-sponsored cyberattacks that include exploiting routers and living-off-the-land techniques, amid heightened tensions over regional infrastructure and resources. Similar groups, such as TGR-STA-1030, have breached over 70 government organizations and critical infrastructure in 37 countries since January 2024.
“Using primarily open-source tools, community-shared malware, and batch scripts, the group has succeeded in maintaining covert operations while infiltrating critical organizations,” according to Unit 42. The discovery of this campaign highlights the need for enhanced security measures and continuous monitoring of critical infrastructure in the region.
