An elusive and sophisticated cyberespionage campaign orchestrated by the China-backed Winnti group has managed to fly under the radar since at least 2019.
Dubbed “Operation CuckooBees” by Israeli cybersecurity company Cybereason, the massive intellectual property theft operation enabled the threat actor to exfiltrate hundreds of gigabytes of information.
Targets included technology and manufacturing companies primarily located in East Asia, Western Europe, and North America.
“The attackers targeted intellectual property developed by the victims, including sensitive documents, blueprints, diagrams, formulas, and manufacturing-related proprietary data,” the researchers said.
“In additional, attackers collected data that could have been used in future cyberattacks. This included details about target companies’ business units, network architectures, user accounts, credentials, emails from employees, customer information, and even email addresses. “
Winnti, also tracked by other cybersecurity vendors under the names APT41, Axiom, Barium, and Bronze Atlas, is known to be active since at least 2007.
“The group’s intent is towards theft of intellectual property from organizations in developed economies, and with moderate confidence that this is on behalf of China to support decision making in a range of Chinese economic sectors,” Secureworks notes in a threat profile of the actor.
Cybereason documented a multi-phased infiltration chain that involved the exploit of web-facing servers to create a web shell for reconnaissance, lateral movement and data exfiltration.
It’s complex but also intricate. The killchain is built using a house of cards approach. Each component depends on the other modules to perform its function. This makes analysis extremely difficult.
“This demonstrates the thought and effort that was put into both the malware and operational security considerations, making it almost impossible to analyze unless all pieces of the puzzle are assembled in the correct order,” the researchers explained.
The data harvesting is facilitated by means of a modular loader called Spyder, which is used to decrypt and load additional payloads. Four payloads, STASHLOG SPARKLOG PRIVATELOG and DEPLOYLOG are used to sequentially drop the kernel-level rootkit WINNKIT.
Crucial to the stealthiness of the campaign is the use of “rarely seen” techniques such as the abuse of Windows Common Log File System (CLFS) mechanism to stash the payloads, enabling the hacking group to conceal their payloads and evade detection by traditional security products.
Interestingly, parts of the attack sequence were previously detailed by Mandiant in September 2021, while pointing out the misuse of CLFS to hide second-stage payloads in an attempt to circumvent detection.
The cybersecurity firm attributed the malware to an unknown actor, but cautioned that it could have been deployed as part of a highly targeted activity.
“Because the file format is not widely used or documented, there are no available tools that can parse CLFS log files,” Mandiant said at the time. “This provides attackers with an opportunity to hide their data as log records in a convenient way, because these are accessible through API functions. “
WINNKIT, for its part, has a compilation timestamp of May 2019 and has almost zero detection rate in VirusTotal, highlighting the evasive nature of the malware that enabled the authors to stay undiscovered for years.
The ultimate goal of intrusions, according to researchers, was to siphon proprietary data, research documents and source code as well as blueprints for different technologies.
“Winnti is one of the most industrious groups operating on behalf of Chinese state-aligned interests,” Cybereason said. “The threat [actor] employed an elaborate, multi-stage infection chain that was critical to enabling the group to remain undetected for so long. “