Using stolen Web session cookies, Evasive Panda, a China-sponsored hacking team, has unveiled CloudScout, a sleek and professional toolset created to recover data from compromised cloud services.
ESET researchers have discovered CloudScout through an investigation into a couple of past breaches in Taiwan (both targeting religious institutions and government organizations), which brought them to the attention of the company.
The CloudScout application is written in .NET and was designed to offer seamless integration with MgBot, Evasive Panda's proprietary malware framework.
In a step-by-step process, MgBot feeds CloudScout previously stolen cookies, then uses the pass-the-cookie technique to use the stolen cookies to access and infiltrate data on the cloud - a method that allows hacker to hijack authenticated Web browser sessions by hijacking the cookies.
There are several names given to the "evasive Panda" group, including the "BRONZE HIGHLAND," the "Daggerfly," and the "StormBamboo" group. This group has operated at least since 2012.
The objective of Evasive Panda is to engage in cyberespionage campaigns against countries, institutions, and individuals that oppose China's interests through the preparation and dissemination of spies, such as those in the Tibetan diaspora, religious and academic groups in Taiwan, Hong Kong, and groups supporting democracy within the Chinese society. As well as being observed in certain instances, its cyberespionage activities have the tendency to extend to other countries such as Vietnam, Myanmar, and South Korea at times.
Evasive Panda has accumulated several attack vectors, which makes it an impressive attack strategy. There have been instances in which its operators have conducted sophisticated TTPs and exploits such as supply-chain and watering-hole attacks, DNS hijacking and other forms of attack; in addition, they have used the latest CVEs that affect Microsoft Office, Confluence, and web server applications to exploit the system.
In addition to this, the group is demonstrating to be capable of creating sophisticated malware, which is shown by its collection of multi-platform backdoors for Windows, macOS, and Android, which are all well documented.
It is most commonly used on Windows by hackers, mainly MgBot (a custom malware framework built with eight plugins, detailed in our previous blog post in which we explain its features), and Nightdoor, which was developed only recently. The backdoor, described in another blog post of ours, is a sophisticated backdoor that uses a public cloud to communicate with the command and control servers.
CloudScout is designed with the internal framework allowing it to process complex tasks, such as configuring, managing, and decrypting cookies that are required to make web requests to the modules.
As part of the CommonUtilities package, CloudScout can also manage HTTP requests and cookies, which allows the tool to adapt to the varied structures of each service being targeted, making it an effective tool for aggressive monitoring. During a period, the malware would monitor directories for new configuration files, calling for new extraction cycles that would then remove any evidence of activity. This would occur regularly.
CloudScout employs a number of targeted methods that appear to have been designed for Taiwanese users, which is evident by the language preferences and region-specific configurations embedded within its modules that appear to be tailored for Taiwanese users.
As a result of our analysis, it seems that CloudScout may have additional modules targeting social media, such as Facebook and Twitter, but we are not aware of these modules in active deployments at this time.
The CloudScout tool set is a .NET toolset that Evasive Panda uses to steal data stored in cloud storage services, Ho explained. Using the pass-the-cookie technique, it hijacks authenticated sessions from web browsers that have been registered using a pass-the-cookie extension to the MgBot service.
There is an alarming development in Canadian cyberspace as the Government of Canada has accused a "sophisticated state-sponsored threat actor" from China of conducting a broad, extensive reconnaissance campaign spanning several months, against a variety of domains within the country.
In a recent statement, it was revealed that a majority of the targeted organizations were Canadian government departments and agencies, including federal political parties, as well as key legislative bodies such as the House of Commons and the Senate. Additionally, Evasive Panda, an advanced persistent threat (APT) group, targeted dozens of other entities spanning democratic institutions, critical infrastructure, defence sectors, media organizations, think tanks, and non-governmental organizations (NGOs). This broad reach underscores the serious nature of the ongoing cyber threat.
Known by various aliases such as Bronze Highland, Daggerfly, and StormBamboo, Evasive Panda has been actively engaged in cyber espionage since at least 2012.
Its primary focus has been civil society targets, especially those associated with independence movements and democratic advocacy. ESET researchers note that this APT group is particularly focused on independence movements within the Tibetan diaspora, religious and academic organizations in Taiwan and Hong Kong, and democracy supporters within China. In recent years, Evasive Panda's operations have extended internationally, reaching regions such as Vietnam, Myanmar, South Korea, and, to a lesser extent, Nigeria.
According to the researchers, Evasive Panda is known for continually evolving its cyberattack techniques.
The latest attacks have demonstrated a marked increase in sophistication, signaling the group’s commitment to refining its approach and adapting to cybersecurity defenses. This new level of sophistication adds urgency for both national and international stakeholders to heighten their defenses and remain vigilant against this persistent and increasingly advanced cyber espionage threat.
