Friday, February 21, 2025
HomeCyber AttackHackers Use HTML Smuggling Technique to Attack European Government Entities

Hackers Use HTML Smuggling Technique to Attack European Government Entities

Published on

SIEM as a Service

Follow Us on Google News

Over recent months, CPR (Check Point Research) monitored a Chinese threat actor attacking European Foreign Affairs ministries and embassies.

Check Point Research identified a broader trend of Chinese activity, specifically targeting European entities and their foreign policy.

While security analysts identified that threat actors were found using HTML Smuggling.

Since December 2022, this campaign has been ongoing and is probably a direct extension of a previously disclosed RedDelta campaign.

Several new delivery methods were used in this campaign to deploy a new variant of an implant, “PlugX,” that is linked to various Chinese threat actors.

HTML Smuggling implementation (Source -Checkpoint)

HTML Smuggling Technique

In the SmugX campaign, HTML Smuggling is applied, leading to JavaScript or ZIP file downloads.

The lure themes primarily target the governmental ministries in Eastern Europe since they are mainly focused on European domestic and foreign policies.

Targets and lures (Source -Checkpoint)

Most documents featured diplomatic content, with some directly linked to China in multiple instances. The lures include:-

  • A letter originating from the Serbian embassy in Budapest.
  • A document stating the priorities of the Swedish Presidency of the Council of the European Union.
  • An invitation to a diplomatic conference issued by Hungary’s Ministry of Foreign Affairs.
  • An article about two Chinese human rights lawyers sentenced to more than a decade in prison.
Some of the lures used in this campaign (Source -Checkpoint)

A document called “China Tries to Block Prominent Uyghur Speaker at UN.docx,” was discovered by the security analysts during their analysis, and it was uploaded to VirusTotal.

Besides this, to access the following URL, the document uses a remote image technique, and it contains a single-pixel image that it keeps hidden from the user:-

  • https://www[.]jcswcd[.]com/?wd=cqyahznz

It’s known as Pixel tracking, a common reconnaissance tool that logs the following information when the attackers’ server receives a request for the remote image:-

  • IP address
  • User-agent
  • Access time

Infection Chains

In total, there are two infection chains that stem from an HTML file that stores the second stage in the Download folder as per the browser settings of the victim.

One chain deploys a malicious LNK file inside a ZIP file, while to fetch an MSI file from a remote server, the other chain employs JavaScript.

Infection chains (Source -Checkpoint)

PlugX malware, used by Chinese threat actors since 2008, serves as the final payload, and it’s operated as a remote access tool (RAT) with a modular structure for flexible plugin integration.

For persistence, the PlugX payload duplicates and hides both the legitimate program and DLL in a newly created hidden directory.

Though none of the techniques employed in this campaign are unexplored, the blend of a wide range of tactics and infection chains with low detection rates allowed the threat actors to remain undetected for an extended period of time.

“AI-based email security measures Protect your business From Email Threats!” – .

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

SPAWNCHIMERA Malware Exploits Ivanti Buffer Overflow Vulnerability by Applying a Critical Fix

In a recent development, the SPAWNCHIMERA malware family has been identified exploiting the buffer...

Sitevision Auto-Generated Password Vulnerability Lets Hackers Steal Signing Key

A significant vulnerability in Sitevision CMS, versions 10.3.1 and earlier, has been identified, allowing...

NSA Allegedly Hacked Northwestern Polytechnical University, China Claims

Chinese cybersecurity entities have accused the U.S. National Security Agency (NSA) of orchestrating a...

ACRStealer Malware Abuses Google Docs as C2 to Steal Login Credentials

The ACRStealer malware, an infostealer disguised as illegal software such as cracks and keygens,...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

SPAWNCHIMERA Malware Exploits Ivanti Buffer Overflow Vulnerability by Applying a Critical Fix

In a recent development, the SPAWNCHIMERA malware family has been identified exploiting the buffer...

Sitevision Auto-Generated Password Vulnerability Lets Hackers Steal Signing Key

A significant vulnerability in Sitevision CMS, versions 10.3.1 and earlier, has been identified, allowing...

NSA Allegedly Hacked Northwestern Polytechnical University, China Claims

Chinese cybersecurity entities have accused the U.S. National Security Agency (NSA) of orchestrating a...