MSS-affiliated actors exploit unpatched government networks

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

Chinese Ministry of State Security actors use open-source tools and known exploits to target U.S. Government agencies; patching is the primary defense.

The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) have jointly documented a sustained pattern of cyber operations by Chinese Ministry of State Security (MSS)-affiliated threat actors targeting U.S. Government agencies over more than a decade. These actors systematically use publicly available information sources such as Shodan, CVE databases, and the National Vulnerabilities Database to identify targets and vulnerabilities, combined with readily available open-source exploitation tools found on platforms like GitHub and Exploit-DB. The operations rely on the persistence of unpatched critical vulnerabilities and configuration weaknesses rather than custom malware or zero-day exploits.

CISA analysts have observed these threat actors following a consistent operational pattern: targeting and reconnaissance using open-source scanning tools, exploitation of known CVEs within days of public disclosure, credential harvesting from internet-available repositories, and command-and-control operations using commercial proxy services and anonymity networks. When successful, actors exfiltrate data in encrypted RAR archives, obfuscate file extensions and timestamps, and frequently return to previously compromised organizations months or years later to steal additional data. The advisory identifies the most frequently exploited CVEs and emphasizes that maintaining rigorous patch management and configuration auditing programs is the most effective defense against this class of threat activity.

The report's primary finding is that sophisticated state-affiliated actors can conduct effective operations against soft targets using low-complexity, commodity techniques—a pattern that will persist as long as organizations fail to patch known vulnerabilities promptly. The advisory recommends organizations prioritize patching the identified CVEs and implement robust configuration management to force attackers to invest time and resources in researching unknown vulnerabilities.

title: Password-Protected RAR Archive Creation via Command Line
description: Detects rar.exe or WinRAR creating an archive with a password switch
  (-hp or -p), consistent with actors staging stolen data in encrypted RAR archives
  before exfiltration. Generalises on the archive-add command and password flags,
  not on specific file names.
tags:
- attack.exfiltration
- attack.collection
- attack.t1041
- attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
  - Image|endswith:
    - \rar.exe
    - \winrar.exe
  - OriginalFileName:
    - RAR.EXE
    - WinRAR.exe
  selection_add:
    CommandLine|contains: ' a '
  selection_pw:
    CommandLine|contains:
    - ' -hp'
    - ' -p'
    - ' /hp'
    - ' /p'
  condition: all of selection_*
falsepositives:
- Administrators or backup scripts creating password-protected archives with WinRAR
- Users sending encrypted archives of documents
level: medium
id: 99606af6-5b59-59d0-a10d-fae32e043b96
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-258a

title: RAR Archive Created with Disguised Non-Archive File Extension
description: Detects rar.exe or WinRAR creating an archive whose output file name
  ends with an image, data or temp extension rather than .rar, matching the reported
  obfuscation of file extensions on exfiltrated RAR archives.
tags:
- attack.exfiltration
- attack.stealth
- attack.t1041
- attack.t1036.008
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
  - Image|endswith:
    - \rar.exe
    - \winrar.exe
  - OriginalFileName:
    - RAR.EXE
    - WinRAR.exe
  selection_add:
    CommandLine|contains: ' a '
  selection_ext:
    CommandLine|endswith:
    - .jpg
    - .jpeg
    - .png
    - .gif
    - .dat
    - .tmp
    - .log
    - .jpg"
    - .png"
    - .gif"
    - .dat"
    - .tmp"
  condition: all of selection_*
falsepositives:
- Scripts that archive log files into a log-named output
- Backup tooling using custom archive extensions such as .dat
level: medium
id: 5968ddfc-f27f-5fec-84ff-1de97622a9b2
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-258a

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-258a