TIPS#3 Operation Diànxùn: a cyberespionage campaign targeting telecommunication companies

### Overview In this talk, McAfee Advanced Threat Research team researchers Thomas Roccia and Thibault Serier analyze Operation Diànxùn (referred to in the presentation as Operation Junction / Dianxun), a cyberespionage campaign uncovered in October 2020 targeting telecommunications companies across Europe and globally. The researchers attribute the activity to Chinese threat actors, noting substantial infrastructure and technique overlaps between groups tracked as Mustang Panda and RedDelta. The suspected motivation ties into telecommunications sector intelligence and developments around Chinese 5G deployment.

### Challenges in Attribution The speakers highlight the difficulties in tracking Chinese advanced persistent threat (APT) groups due to fragmented naming conventions, shared infrastructure, code overlaps, and recruitment of new operators. They discuss their efforts to build correlation tables to map overlaps—such as bit-flipping shellcode injection into Microsoft-signed portable executables without breaking signatures. They advocate for tracking threat activity by campaign and targeted industry sector rather than continually assigning new group names.

### Technical Details & Attack Flow The attack lifecycle involved a multi-stage infection chain: - **Initial Access & Delivery:** Attackers deployed a phishing lure domain mimicking Huawei (`carrier.huawei.net`), which redirected victims to a spoofed Chinese Flash domain (`flash.cn`) to serve a fake Flash installer. - **Stage 1 (Fingerprinting):** The fake Flash executable collected machine metadata, including Windows OS version, date, geolocation, and .NET version, before requesting Stage 2. - **Stage 2 (.NET Reconnaissance Utility):** A .NET utility executed reconnaissance (such as querying active antivirus software), achieved persistence via scheduled tasks, supported re-downloading earlier stages, created permanent WMI event backdoors, injected shellcode into clipboard structures for evasion, and retrieved base64-encoded payloads stored in temporary folders (`flashupdate.txz`). - **Intermediate Payload:** An intermediate DLL verified the execution success of previous stages and assisted with persistence. - **Stage 3 (C2 & Final Payload):** Cobalt Strike payloads were injected to provide attackers full remote access.

### Evolution & Post-Disclosure Infrastructure Following McAfee's public reporting in March 2021, the threat actors modified their infrastructure and tooling through May 2021: - **Domain & C2 Updates:** Attackers rotated domains (e.g., `flashupdate.com`, `flash.com.cn`, `microsoft.cn` with typo squatted variations) and relied on Alibaba-hosted autonomous systems. - **Proxying & Tooling:** They introduced NPS (an open-source Chinese penetration testing and proxy tool) to conceal real Cobalt Strike command-and-control servers. - **Management Platform:** The actors adopted a web-based asset/victim management framework named "Cross SS Platform," which source code inspection revealed had originated from Chinese forums. - **Beacon Tracking:** Researchers tracked distinct Cobalt Strike license IDs (watermarks) embedded within beacons, enabling high-confidence attribution across newly identified C2 nodes.

### Takeaways The researchers emphasize the importance of blending technical IOCs with geopolitical context, victimology, and passive DNS/WHOIS correlation when tracking sophisticated nation-state campaigns. The observed quick rotation of tooling and infrastructure after public disclosure underscores the adaptability of espionage actors.