Check Point Research (CPR) has detected an ongoing, cyber espionage operation targeting Russian defence research institutes. Attributed to Chinese nation-state actors, the operation uses spear-phishing emails sent under the guise of the Russian Ministry of Health to collect sensitive information.
Emails caught by CPR contained malicious documents that used the Western sanctions against Russia as a decoy, among other social engineering techniques. The threat actors were able to evade detection for nearly 11 months by using new and undocumented tools that CPR now details for the first time.
CPR has named the campaign “Twisted Panda” to reflect the sophistication of the tools observed and traced to China.
Russian victims belong to a holding company within the Russian state-owned defence conglomerate called Rostec Corporation, Russia’s largest holding company in the radio-electronics industry. Emails contained subject lines “List of <target institute name> persons under US sanctions for invading Ukraine” and “US Spread of Deadly Pathogens in Belarus”
The campaign bears multiple overlaps with Chinese advanced and long-standing cyber espionage actors, including APT10 and Mustang Panda
“We exposed an ongoing espionage operation against Russian defense research institutes that have been carried out by experienced and sophisticated Chinese-backed threat actors,” says Itay Cohen, head or research at Check Point Software. “Our investigation shows that this is a part of a larger operation that has been ongoing against Russia-related entities for around a year. We discovered two targeted defense research institutions in Russia and one entity in Belarus.
“Perhaps the most sophisticated part of the campaign is the social engineering component. The timing of the attacks and the lures used are clever. From a technical point of view, the quality of the tools and their obfuscation is above average, even for APT groups. I believe our findings serve as more evidence of espionage being a systematic and long-term effort in the service of China’s strategic objectives to achieve technological superiority. In this research, we saw how Chinese state-sponsored attackers are taking advantage of the ongoing war between Russia and Ukraine, unleashing advanced tools against who is considered a strategic partner — Russia.”