An official website of the United States government
Here's how you know
A .mil website belongs to an official U.S. Department of Defense organization in the United States.
A lock (lock ) or https:// means you’ve safely connected to the .mil website. Share sensitive information only on official, secure websites.

Home : Media : News : News Article View
NEWS | May 24, 2023

NSA and Partners Identify China State-Sponsored Cyber Actor Using Built-in Network Tools When Targeting U.S. Critical Infrastructure Sectors

National Security Agency/Central Security Service

The National Security Agency (NSA) and partners have identified indicators of compromise (IOCs) associated with a People’s Republic of China (PRC) state-sponsored cyber actor using living off the land techniques to target networks across U.S. critical infrastructure.

“Cyber actors find it easier and more effective to use capabilities already built into critical infrastructure environments. A PRC state-sponsored actor is living off the land, using built-in network tools to evade our defenses and leaving no trace behind,” said Rob Joyce, NSA Cybersecurity Director. “That makes it imperative for us to work together to find and remove the actor from our critical networks.”

To assist network defenders to hunt and detect this type of PRC actor malicious activity on their systems, NSA is leading U.S. and Five Eyes partner agencies in publicly releasing the “People’s Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection” Cybersecurity Advisory (CSA) today. The partner agencies include:

• U.S. Cybersecurity and Infrastructure Security Agency (CISA)
• U.S. Federal Bureau of Investigation (FBI)
• Australian Cyber Security Centre (ACSC)
• Canadian Centre for Cyber Security (CCCS)
• New Zealand National Cyber Security Centre (NCSC-NZ)
• United Kingdom National Cyber Security Centre (NCSC-UK)

“For years, China has conducted operations worldwide to steal intellectual property and sensitive data from critical infrastructure organizations around the globe,” said Jen Easterly, CISA Director. “Today’s advisory, put out in conjunction with our US and international partners, reflects how China is using highly sophisticated means to target our nation’s critical infrastructure. This joint advisory will give network defenders more insights into how to detect and mitigate this malicious activity. At the same time, we must recognize the agility and capability of PRC cyber actors, and continue to focus on strong cybersecurity practices like network segmentation and ongoing investments in promoting the resilience of critical functions under all conditions. As our nation’s cyber defense agency, CISA stands ready to aid any organization affected and we encourage all organizations to visit our webpage for guidance and resources to make their networks more resilient.”

“The FBI continues to warn against China engaging in malicious activity with the intent to target critical infrastructure organizations and use identified techniques to mask their detection,” said Bryan Vorndran, the FBI’s Cyber Division Assistant Director. “We, along with our federal and international partners, will not allow the PRC to continue to use these unacceptable tactics. The FBI strives to share information with our private sector partners and the public to ensure they can better protect themselves from this targeted malicious activity.”

“It is vital that operators of critical national infrastructure take action to prevent attackers hiding on their systems, as described in this joint advisory with our international partners,” said Paul Chichester, NCSC Director of Operations“We strongly encourage UK essential service providers to follow our guidance to help detect this malicious activity and prevent persistent compromise.”

“The Canadian Centre for Cyber Security joins its international partners in sharing this newly identified threat and accompanying mitigation measures with critical infrastructure sectors,” said Sami Khoury, Head of the Canadian Centre for Cyber Security. “The interconnected nature of our infrastructures and economies highlights the importance of working together with our allies to identify and share real-time threat information.

The CSA provides an overview of hunting guidance and associated best practices. It includes examples of the actor’s commands and detection signatures. The authoring agencies also includes a summary of indicators of compromise (IOC) values, such as unique command-line strings, hashes, file paths, exploitation of CVE-2021-40539 and CVE-2021-27860 vulnerabilities, and file names commonly used by this actor.

As one of their primary tactics, techniques, and procedures (TTP) of living off the land, the PRC actor uses tools already installed or built into a target’s system. This allows the actor to evade detection by blending in with normal Windows systems and network activities, avoiding endpoint detection and response (EDR) products, and limiting the amount of activity that is captured in default logging configurations.

NSA recommends network defenders apply the detection and hunting guidance in the CSA, such as logging and monitoring of command line execution and WMI events, as well as ensuring log integrity by using a hardened centralized logging server, preferably on a segmented network.

Defenders should also monitor logs for Event ID 1102, which is generated when the audit log is cleared.

The behavioral indicators noted in the CSA can also be legitimate system administration commands that appear in benign activity. Defenders must evaluate matches to determine the significance, applying their knowledge of the system and baseline behavior.

Read the full report here.

Visit our full library for more cybersecurity information and technical guidance.


NSA Media Relations
MediaRelations@nsa.gov
443-634-0721

CONNECT WITH USINDOPACOM
Facebook

Like Us
Twitter
342,728
Follow Us

ENGAGE & CONNECT MORE WITH PACOM

                                                 

IN THE USINDOPACOM NEWS
PACAF RQ-4 Global Hawks arrive at Yokota Air Base
An RQ-4 Global Hawk, assigned to the 4th Reconnaissance Squadron, 319th Operation Group, Andersen Air Force Base, Guam, sits on the flightline at Yokota Air Base, Japan, May 2, 2023. U.S. Pacific Air Forces began positioning RQ-4 Global Hawks at Yokota Air Base, Japan, from Andersen Air Force Base, Guam, on May 15 to provide theater-wide enduring operations in support of maintaining a free and open Indo-Pacific. (U.S, Air Force photo by Yasuo Osakabe)
May 25, 2023 - YOKOTA AIR BASE, Japan -- U.S. Pacific Air Forces began positioning RQ-4 Global Hawks at Yokota Air Base, Japan, from Andersen Air Force Base, Guam, on May 15 to provide theater-wide enduring operations in support of...

U.S. Partnership with U.K., Australia Enhances Security
U.S. Marines with 3d Battalion, 7th Marine Regiment, Ground Combat Element, Marine Rotational Force-Darwin 22, establish defensive positions as MV-22 Ospreys approach for landing during an airfield seizure event as part of exercise Koolendong 22 at Royal Australian Air Force Base Curtin, WA, Australia, July 18, 2022. Exercise Koolendong 22 is a combined and joint force exercise focused on expeditionary advanced base operations conducted by U.S. Marines, U.S. Soldiers, U.S. Airmen, and Australian Defence Force personnel. (U.S. Marine Corps photo by Cpl. Cedar Barnes)
May 25, 2023 - WASHINGTON -- In September 2021, the U.S., Australia and the U.K. announced a new partnership, AUKUS, meant to strengthen alliances and security, especially in the Indo-Pacific. In March, plans for moving forward on the first...

Enduring PACE Exercise Bolsters Communications Readiness throughout South Korea
U.S. Air Force Senior Airman James Angeley, left, 607th Air Communications Squadron, radio maintenance technician, and U.S. Air Force Senior Airman Carlos Perez Ortiz, right, 607 ACOMS, radio frequency transmission system technician sets up a ground multiband terminal during exercise Enduring PACE, May 18, 2023, at Osan Air Base, South Korea. Exercise Enduring PACE put communication equipment to the test and involved communications Airmen from the 8th Fighter Wing at Kunsan AB, the 51st Fighter Wing, the 607th Air Operations Center at Osan AB and other communications units dispersed throughout South Korea. (U.S. Air Force photo by Master Sgt. Kenneth W. Norman)
May 25, 2023 - OSAN AIR BASE, South Korea -- In modern warfare, the ability to communicate rapidly and effectively can be the difference between victory and defeat. To effectively maintain Fight Tonight readiness and provide the best...

USS SHOUP Completes First Forward-Deployed Naval Patrol March 2023
May 25, 2023 - The Arleigh Burke-class guided-missile destroyer USS SHOUP (DDG 86) returned to Combined Fleet Activity Yokosuka, Japan, following the completion of its first Forward-Deployed Naval Forces (FDNF) patrol in the U.S. 7th Fleet...

U.S. Coast Guard Post-Typhoon Mawar Update 1
Station Apra Harbor 45-foot Response Boats weather the residual storm as U.S. Coast Guard crews in Guam begin assessments and reconstitution efforts on May 25, 2023, after Typhoon Mawar devastated the island. Crews are working to resume operations and reopen the ports. (U.S. Coast Guard photo Lt. j.g. Drew Lovullo)
May 25, 2023 - SANTA RITA, Guam -- Following the devastating impact of Typhoon Mawar, U.S. Coast Guard Forces Micronesia Sector Guam, MAT/WAT Guam, and USCGC Sequoia (WLB 215) crews are actively assessing the situation and coordinating...