In 2017, FireEye announced that they have observed APT32 conducting cyberespionage operations targeting foreign companies with a vested interest in Vietnam’s manufacturing, consumer products, and hospitality sectors. The campaign has gone about since 2013. There are indicators that APT32 actors are targeting peripheral network security and technological infrastructure corporations. Some of the targets have included government agencies in Cambodia, oil companies from China, and maritime construction firms. The affected economies have included Australia, Brunei, Cambodia, China, Germany, Indonesia, Laos, Malaysia, Myanmar, Philippines, Singapore, Thailand, USA and Vietnam. The objectives are likely to be diverse, ranging from political objectives to stealing sensitive business information.

In 2017, FireEye announced that they have observed APT32 conducting cyberespionage operations targeting foreign companies with a vested interest in Vietnam’s manufacturing, consumer products, and hospitality sectors. The campaign has gone about since 2013. There are indicators that APT32 actors are targeting peripheral network security and technological infrastructure corporations. Some of the targets have included government agencies in Cambodia, oil companies from China, and maritime construction firms. The affected economies have included Australia, Brunei, Cambodia, China, Germany, Indonesia, Laos, Malaysia, Myanmar, Philippines, Singapore, Thailand, USA and Vietnam. The objectives are likely to be diverse, ranging from political objectives to stealing sensitive business information

FireEye(Mandiant), Volexity, ESET

None

‍

High Confidence (10 out of 12)

• Private entities are a majority of known sectors targeted in the intrusion (2 points)
• Commercial data are known to be the dominant targets of intrusion (3 points)
• APT actor is strongly associated with economic espionage operations, with motivations strongly tied to certain states’ industrial policy objectives (3 points)
• No concrete evidence that data stolen was used to aid domestic private businesses of malign state, but data stolen likely aligns with malign state’s industrial policies (2 points)

From January 2020 until 2021, cybersecurity firms detected a massive cyberespionage campaign targeting private entities. These campaigns were conducted in three clusters. First, from January to March 2020, there was a broad campaign against 75 private entities in 20 countries, with a focus on industries ranging from petrochemicals to defense industrial base. Mandiant notes that while it’s unclear if APT41 scanned the Internet and attempted exploitation en masse or selected a subset of specific organizations to target, the victims appear to be more targeted in nature. The economies affected were Australia, Canada, Denmark, Finland, France, India, Italy, Japan, Malaysia, Mexico, Philippines, Poland, Qatar, Saudi Arabia, Singapore, Sweden, Switzerland, UAE, UK and USA.

Second, in September 2020, hackers associated with APT41 were charged by the U.S. Department of Justice in connection with computer intrusion campaigns against more than 100 victims globally, including in Indonesia, Malaysia, Thailand, and Vietnam. The entities affected were those that specialize in software development, manufacturers, telecommunications, non-profit, universities, and civil society organizations.

Third, from July 2020 until August 2021 (ongoing as of then), Trend Micro observed an espionage campaign against victims in India, m, Malaysia, Philippines, Taiwan, and Vietnam in the airline, computer hardware, automotive, infrastructure, publishing, media, and IT industries.

US Government, Mandiant; Trend Micro

In second incident, U.S. Department of Justice indicts seven individuals (two arrested, five remaining)

High Confidence (9 out of 12)

• Private entities are a majority of known sectors targeted in the intrusion (2 points)
• Commercial data are likely to have been targeted (2 points)
• APT actor is strongly associated with economic espionage operations, with motivations strongly tied to certain states’ industrial policy objectives (3 points)
• No concrete evidence that data stolen was used to aid domestic private businesses of malign state, but data stolen likely aligns with malign state’s industrial policies (2 points)

Nine officials belonging to the Iranian company, Mabna Institute, were indicted by the U.S. Department of Justice for conducting state-sponsored cyber operations on behalf of the Iranian Revolutionary Guards from at least 2013 to 2018. The campaign had targeted 4,230 academics and researchers in 176 universities in 21 countries, with an additional set (3,768 academics in 144 universities) targeted against the U.S. They had also targeted 36 private companies in the U.S., 11 foreign companies, 5 U.S. government agencies (energy, state governments), United Nations, and UNICEF. The campaign had sought to obtain usernames and password for the accounts of academics and researchers in order to obtain propriety academic information.

Valuable intellectual property and data from hundreds of universities in the US and other countries, and a media company was stolen for private financial gain. The Mabna Institute reportedly stole more than 31 terabytes of academic data and intellectual property from universities, and email accounts of employees at private sector companies, government agencies, and non-governmental organisations. The data stolen were likely used for the benefit of Iran’s Islamic Revolutionary Guard Corps, though they were also sold through two websites: Megapaper.ir and Gigapaper.ir. These websites sold stolen research materials and academic credentials to customers in Iran.

The cyber campaign coincided with ”ario’s developments in Iran’s foreign policy and economy, including negotiations over the failed Iran nuclear deal and the subsequent imposition of harsh US sanctions, placing Iran under “maximum economic pressure”.

U.S. government

U.S. charged nine Iranian nationals linked with the program.

High Confidence (9 out of 12)

• Private entities are a majority of known sectors targeted in the intrusion (2 points)
• Commercial data are known to be the dominant targets of intrusion (3 points)
• APT actor is strongly associated with economic espionage operations, with motivations strongly tied to certain states’ industrial policy objectives (3 points)
• There is not enough information to conclude whether stolen data was used to aid domestic private businesses (1 point)

In February 2020, MyCERT announced that a cyber campaign had been targeting Malaysian government officials with spear-phishing attacks aiming to steal confidential documents from government networks. The campaign was attributed to APT40, a hacking group with known interests in engineering, transportation, and defence industry, especially when these sectors overlap with maritime technologies. The exact government agencies targeted are not known. The cyber campaign coincided with the Trump administration’s tightening of rules to prevent China from obtaining advanced technology from the US for commercial purposes and then repurposing it for military use, including radar equipment and semiconductors.

MyCERT

MyCERT made a technical attribution. But no further attribution by the Malaysian government.

Moderate Confidence (7 out of 12)

• Organizations with commercial data have been targeted in intrusions (1 point)
• No clear information if commercial data is targeted (1 point)
• APT actor is strongly associated with economic espionage operations, with motivations strongly tied to certain states’ industrial policy objectives (3 points)
• No concrete evidence that data stolen was used to aid domestic private businesses of malign state, but data stolen likely aligns with malign state's industrial policies (2 points)

From March 2021 until September 2021, the hacking campaign consisted of phishing attacks targeting users in Australia and Malaysia.

On 2 June 2021, phishing emails were sent out to several offshore energy companies operating in the Kasawari gas field, off the coast of Sarawak in Malaysia. The campaign’s focus was primarily on companies engaged in the engineering, extraction of natural gas, or export of natural gas products, with four of the eight entities associated with the project. There were additional operations targeting several institutions in Australia, including defense universities and a consumer healthcare firm.

Given its strategic and economic importance, the Kasawari gas project has been subject to a series of grey zone tactics in 2021. On June 1 of that year, when the assembly of the wellhead platform was underway, 16 Chinese aircrafts were spotted off the coast of Sarawak, prompting Malaysia to scramble its fighter jets to intercept the transport lanes. The first phase of the phishing campaign had begun one day after the aircraft incident. The South China Sea disputes is a major security flashpoint in the Indo-Pacific, hosting six different claimant states, including China and four Southeast Asian states. With the waters being heavily contested and many major oil companies competing to win contracts and extract energy sources, there is plenty of room for potential uses of cyber tools.

Through joint technical work by Proofpoint and PwC Threat Intelligence, investigators are moderately confident that the campaign has been perpetrated by TA423 / Red Ladon, a China-based hacking group that has traditionally targeted organizations with operations associated with the South China Sea.

Proofpoint and PwC

None

High Confidence (10 out of 12)

• Private entities are either the sole or the primary targets of intrusion (3 points)
• Commercial data are known to be the dominant targets of intrusion (3 points)
• APT actor has some history of stealing IP and other commercially valuable data (2 points)
• No concrete evidence that data stolen was used to aid domestic private businesses of malign state, but data stolen likely aligns with malign state's industrial policies (2 points)