minsta

Chinese Hackers Use This Open Source VPN to Hide Spying Activities

Pabio November 16, 2024

Chinese hackers rely on legitimate VPN services to hide their illegal activities and, for the first time, a European Union diplomatic organization is among their targets.

These results come from the last ESET report on the activities of APT (Advanced Persistent Threat) groups between April and September 2024.

All the best VPN The apps encrypt Internet connections to prevent third-party access while spoofing users’ real IP addresses for maximum online anonymity. But what if those using these services are professional government-backed hackers?

“A trend we have noticed among several China-aligned threat actors is the use of SoftEther VPN instead of their usual implants or backdoors”, Mathieu Tartare, senior malware researcher at ESET, says Cyberscoop.

SoftEther VPN is open source software virtual private network (VPN) which can use HTTPS connections to establish a VPN tunnel. This allows its users to bypass a company’s firewall, for example, while blending in with legitimate traffic.

Experts have observed Webworm APT Group, a China-linked cyberespionage group, abandoning comprehensive backdoors (such as Trochilus RAT) to the SoftEther VPN bridge on compromised machines of several EU government organizations.

“Such a VPN bridge allows the attacker to establish direct communication between the infrastructure controlled by the attacker and the victim’s local network, bypassing port filtering and accessing resources that might be blocked on the external router or firewall of the targeted organization,” the researchers noted.

#ESETresearch has published its latest APT activity report covering the period April to September 2024 (Q2 2024 – Q3 2024). This period has seen China-aligned APT groups increasingly rely on VPN platforms – particularly the open source SoftEther VPN – to maintain access to victims’ networks. 1/2 pic.twitter.com/HazCFT55UsNovember 7, 2024

Webworm wasn’t the only group regularly deploying SoftEther VPN, either. GALLIUM, Flax Typhoon and MirrorFace all used the VPN service during the research period, with the latter using it regularly since late 2023.

For the first time ever, the MirrorFace group has also expanded its list of targets outside of Japan, including a European diplomatic organization alongside its usual targets.

The researchers did not name the compromised organization. However, the attack still seems linked to Japanese affairs since the hackers sent the victim a phishing email regarding the World EXPO 2025 exhibition, which will be held in Osaka.

Speaking to Cyberscoop, Tartare said that organizations should consider all SoftEther VPN executables deployed on the network as suspicious and block them if they are not needed. You should be especially wary of SoftEther VPN executables that don’t have the correct file name, he added.

For more tips and tools on how to secure your organizations, I recommend checking out our dedicated pages of the best Professional VPNs And endpoint protection software currently on the market.

Mondor Festival

Mondor Festival

Chinese Hackers Use This Open Source VPN to Hide Spying Activities

Pabio

Philippe Coutinho opens up on Liverpool transfer and Jurgen Klopp statue warning

Some say it’s time for Canada to criminalize residential school denial

Auch Josi et Suter mit Toren – Fiala trifft et siegt im Schweizer Duell, Devils gehen unter – Sport

Defense technology companies create AI-focused consortium

Chinese Hackers Use This Open Source VPN to Hide Spying Activities

Pabio

You Might Also Like

Philippe Coutinho opens up on Liverpool transfer and Jurgen Klopp statue warning

Some say it’s time for Canada to criminalize residential school denial

Auch Josi et Suter mit Toren – Fiala trifft et siegt im Schweizer Duell, Devils gehen unter – Sport

Defense technology companies create AI-focused consortium