Chinese-based Ink Dragon Compromises Asia and South America into European Government Networks

Ink Dragon, a Chinese-based espionage group, has expanded its operations from Southeast Asia and South America into European government networks. This development indicates a strategic shift, employing advanced tools that mimic standard enterprise activities.

The group has methodically established long-term access to networks while remaining undetected. Their malware campaign demonstrates a sophisticated understanding of network infrastructure and administrative processes.

The attackers target vulnerabilities in publicly accessible systems, such as web servers like Microsoft's Internet Information Services (IIS) and SharePoint platforms. These vulnerabilities often arise from configuration oversights, allowing malicious code to be planted with minimal detection risk .

Once an initial foothold is gained, the operators use stolen credentials and dormant administrative sessions to navigate compromised networks. They collect local credentials, identify active administrator sessions, and reuse shared service accounts to move laterally through systems, blending with normal administrative traffic.

Ink Dragon transforms compromised servers into relay nodes, forwarding commands and data between victims. This creates a communication mesh that obscures the attack's origin, complicating defender detection as the traffic resembles routine cross-organizational activity.

The group’s toolkit includes an updated FinalDraft backdoor variant, which integrates with Microsoft cloud services, disguising command traffic as ordinary mailbox drafts. The latest version features controlled timing mechanisms, efficient data transfer capabilities, and detailed system profiling.

Check Point researchers discovered that another threat actor, RudePanda, had also compromised several identical government networks. This overlap highlights the risk of a single unpatched vulnerability serving as an entry point for multiple advanced threat actors.

Understanding shared attack surfaces is crucial for cybersecurity professionals tasked with preventing similar incidents.

Based on reporting by Cyber Security News.