Menace hunters have found a set of beforehand unreported domains, some going again to Could 2020, which might be related to China-linked menace actors Salt Storm and UNC4841.
“The domains date again a number of years, with the oldest registration exercise occurring in Could 2020, additional confirming that the 2024 Salt Storm assaults weren’t the primary exercise carried out by this group,” Silent Push mentioned in a brand new evaluation shared with The Hacker Information.
The recognized infrastructure, totaling 45 domains, has additionally been recognized as sharing some degree of overlap with one other China-associated hacking group tracked as UNC4841, which is greatest identified for its zero-day exploitation of a safety flaw in Barracuda Electronic mail Safety Gateway (ESG) home equipment (CVE-2023-2868, CVSS rating: 9.8).
Salt Storm, energetic since 2019, drew widespread consideration final yr for its concentrating on of telecommunications providers suppliers within the U.S. Believed to be operated by China’s Ministry of State Safety (MSS), the menace cluster shares similarities with actions tracked as Earth Estries, FamousSparrow, GhostEmperor, and UNC5807.
Silent Push mentioned it recognized three Proton Mail e mail addresses that had been used to register as many as 16 domains with non-existent addresses.
Additional examination of the IP addresses associated to the 45 domains has revealed that many of those domains pointed to high-density IP addresses. These confer with IP addresses to which a excessive variety of hostnames presently level, or have pointed prior to now. Of those who pointed to low-density IP addresses, the earliest exercise goes again to October 2021.
The oldest area recognized as being a part of China-backed cyber espionage campaigns is onlineeylity[.]com, registered on Could 19, 2020, by a faux persona named Monica Burch, who claims to reside at 1294 Koontz Lane in Los Angeles, California.
“As such, we strongly urge any group that believes itself to be prone to Chinese language espionage to go looking its DNS logs for the previous 5 years for requests to any of the domains in our archive feed, or their subdomains,” Silent Push mentioned.
“It might even be prudent to examine for requests to any of the listed IP addresses, notably in the course of the time durations wherein this actor operated them.”
