Chinese Redfly Hacked National Power Grid & Maintained Access for 6 Months

Cybersecurity researchers at Symantec’s Threat Hunter Team recently discovered that the Redfly threat actor group used ShadowPad Trojan to breach an Asian national grid for 6 months.

Artificial intelligence-driven cyber threats grow as technology advances, significantly influencing and boosting threat actor sophistication.

Persistent espionage attacks by threat actors on critical national infrastructure (CNI) raise global concerns among governments and CNI entities.

In this security breach, the threat actors successfully stole the credentials and compromised computers.

The latest attack is part of the ongoing global CNI espionage wave, with the following countries on high alert after the Volt Typhoon’s U.S. infiltration:-

  • The U.S.
  • The UK
  • Australia
  • Canada
  • New Zealand

ShadowPad is initially a modular, short-lived underground RAT, now tied to espionage groups like APT41. Recent power grid attacks linked to Redfly, distinct from Blackfly and Grayfly.

Tools used

Here below, we have mentioned all the tools that the threat actors use in these attacks:-

Document
Get a Demo

Start protecting your SaaS data in just a few minutes!

With DoControl, you can keep your SaaS applications and data safe and secure by creating workflows tailored to your needs. It’s an easy and efficient way to identify and manage risks. You can mitigate the risk and exposure of your organization’s SaaS applications in just a few simple steps.

Technical analysis

Initial intrusion on February 28, 2023, followed by ShadowPad execution on May 17, confirming attackers’ presence. A suspicious 1.bat file ran on May 16, leading to PackerLoader execution in the %TEMP% directory.

Next, all-user access is granted to dump_diskfs.sys driver, potentially for file system dumps and exfiltration. From the following Windows registry, the credentials were dumped:-

  • reg save HKLM\SYSTEM system.save
  • reg save HKLM\SAM sam.sav
  • reg save HKLM\SECURITY security.save

On May 19, attackers returned, running PackerLoader and 1.bat, then with the help of a sneaky “displayswitch.exe” file, Redfly launched their malicious payload. 

While besides this, they later used PowerShell to spy on the writable drives. Apart from this, the displayswitch.exe was triggered in %TEMP% on May 26 and swiftly dumped the registry credentials and erased the security logs.

Next, the attackers used ProcDump on May 29 and Oleview on May 31 for malicious activities and possibly leveraged the stolen credentials for lateral movement.

Over the past year, threat actors have actively targeted and attacked the CNI organizations. Even their attack frequency has also significantly increased, which is now a concerning factor.

Threat actors maintaining a long-term presence on grids pose the risk of disruptive attacks in nation-states during political tension.

IOCs

IOCs (Source – Symantec)

Keep informed about the latest Cyber Security News by following us on Google NewsLinkedinTwitter, and Facebook.

Tushar Subhra

Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Recent Posts

Hackers Target Mobile Users Using PWA JavaScript to Bypass Browser Security

A sophisticated new injection campaign has been uncovered, targeting mobile users through malicious third-party JavaScript…

30 minutes ago

Docker Zombie Malware Infects Containers for Crypto Mining and Self-Replication

A novel malware campaign targeting containerized infrastructures has emerged, exploiting insecurely exposed Docker APIs to…

38 minutes ago

Hackers Masquerade as Organizations to Steal Payroll Logins and Redirect Payments from Employees

ReliaQuest, hackers have deployed a cunning search engine optimization (SEO) poisoning scheme to orchestrate payroll…

46 minutes ago

PupkinStealer Exploits Web Browser Passwords and App Tokens to Exfiltrate Data Through Telegram

A newly identified .NET-based information-stealing malware, dubbed PupkinStealer (also known as PumpkinStealer in some reports),…

2 hours ago

71 Fake Websites Impersonating German Retailer to Steal Payment Information

Recorded Future Payment Fraud Intelligence has uncovered a sprawling network of 71 fraudulent e-commerce domains…

2 hours ago

New Scan Uncovers 150K Industrial Systems Worldwide Vulnerable to Cyberattacks

A groundbreaking study leveraging advanced application-layer scanning has exposed approximately 150,000 industrial control systems (ICS)…

2 hours ago