Saturday, April 13, 2024

Chinese Redfly Hacked National Power Grid & Maintained Access for 6 Months

Cybersecurity researchers at Symantec’s Threat Hunter Team recently discovered that the Redfly threat actor group used ShadowPad Trojan to breach an Asian national grid for 6 months.

Artificial intelligence-driven cyber threats grow as technology advances, significantly influencing and boosting threat actor sophistication.

Persistent espionage attacks by threat actors on critical national infrastructure (CNI) raise global concerns among governments and CNI entities.

In this security breach, the threat actors successfully stole the credentials and compromised computers.

The latest attack is part of the ongoing global CNI espionage wave, with the following countries on high alert after the Volt Typhoon’s U.S. infiltration:-

  • The U.S.
  • The UK
  • Australia
  • Canada
  • New Zealand

ShadowPad is initially a modular, short-lived underground RAT, now tied to espionage groups like APT41. Recent power grid attacks linked to Redfly, distinct from Blackfly and Grayfly.

Tools used

Here below, we have mentioned all the tools that the threat actors use in these attacks:-

Get a Demo

Start protecting your SaaS data in just a few minutes!

With DoControl, you can keep your SaaS applications and data safe and secure by creating workflows tailored to your needs. It’s an easy and efficient way to identify and manage risks. You can mitigate the risk and exposure of your organization’s SaaS applications in just a few simple steps.

Technical analysis

Initial intrusion on February 28, 2023, followed by ShadowPad execution on May 17, confirming attackers’ presence. A suspicious 1.bat file ran on May 16, leading to PackerLoader execution in the %TEMP% directory.

Next, all-user access is granted to dump_diskfs.sys driver, potentially for file system dumps and exfiltration. From the following Windows registry, the credentials were dumped:-

  • reg save HKLM\SYSTEM
  • reg save HKLM\SAM sam.sav
  • reg save HKLM\SECURITY

On May 19, attackers returned, running PackerLoader and 1.bat, then with the help of a sneaky “displayswitch.exe” file, Redfly launched their malicious payload. 

While besides this, they later used PowerShell to spy on the writable drives. Apart from this, the displayswitch.exe was triggered in %TEMP% on May 26 and swiftly dumped the registry credentials and erased the security logs.

Next, the attackers used ProcDump on May 29 and Oleview on May 31 for malicious activities and possibly leveraged the stolen credentials for lateral movement.

Over the past year, threat actors have actively targeted and attacked the CNI organizations. Even their attack frequency has also significantly increased, which is now a concerning factor.

Threat actors maintaining a long-term presence on grids pose the risk of disruptive attacks in nation-states during political tension.


IOCs (Source – Symantec)

Keep informed about the latest Cyber Security News by following us on Google NewsLinkedinTwitter, and Facebook.


Latest articles

Alert! Palo Alto RCE Zero-day Vulnerability Actively Exploited in the Wild

In a recent security bulletin, Palo Alto Networks disclosed a critical vulnerability in its...

6-year-old Lighttpd Flaw Impacts Intel And Lenovo Servers

The software supply chain is filled with various challenges, such as untracked security vulnerabilities...

Hackers Employ Deepfake Technology To Impersonate as LastPass CEO

A LastPass employee recently became the target of an attempted fraud involving sophisticated audio...

Sisence Data Breach, CISA Urges To Reset Login Credentials

In response to a recent data breach at Sisense, a provider of data analytics...

DuckDuckGo Launches Privacy Pro: 3-in-1 service With VPN

DuckDuckGo has launched Privacy Pro, a new subscription service that promises to enhance user...

Cyber Attack Surge by 28%:Education Sector at High Risk

In Q1 2024, Check Point Research (CPR) witnessed a notable increase in the average...

Midnight Blizzard’s Microsoft Corporate Email Hack Threatens Federal Agencies: CISA Warns

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive concerning a...
Tushar Subhra Dutta
Tushar Subhra Dutta
Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Top 3 SME Attack Vectors

Securing the Top 3 SME Attack Vectors

Cybercriminals are laying siege to small-to-medium enterprises (SMEs) across sectors. 73% of SMEs know they were breached in 2023. The real rate could be closer to 100%.

  • Stolen credentials
  • Phishing
  • Exploitation of vulnerabilities

Related Articles