# MSS-affiliated actors exploit unpatched government networks

Published: 2025-06-20 · Severity: elevated · Sectors: government-national
Canonical: https://vorant.io/reports/48ca455a-e618-51d3-864b-1530eec87312/mss-affiliated-actors-exploit-unpatched-government-networks

> Chinese Ministry of State Security actors use open-source tools and known exploits to target U.S. Government agencies; patching is the primary defense.

The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) have jointly documented a sustained pattern of cyber operations by Chinese Ministry of State Security (MSS)-affiliated threat actors targeting U.S. Government agencies over more than a decade. These actors systematically use publicly available information sources such as Shodan, CVE databases, and the National Vulnerabilities Database to identify targets and vulnerabilities, combined with readily available open-source exploitation tools found on platforms like GitHub and Exploit-DB. The operations rely on the persistence of unpatched critical vulnerabilities and configuration weaknesses rather than custom malware or zero-day exploits.

CISA analysts have observed these threat actors following a consistent operational pattern: targeting and reconnaissance using open-source scanning tools, exploitation of known CVEs within days of public disclosure, credential harvesting from internet-available repositories, and command-and-control operations using commercial proxy services and anonymity networks. When successful, actors exfiltrate data in encrypted RAR archives, obfuscate file extensions and timestamps, and frequently return to previously compromised organizations months or years later to steal additional data. The advisory identifies the most frequently exploited CVEs and emphasizes that maintaining rigorous patch management and configuration auditing programs is the most effective defense against this class of threat activity.

The report's primary finding is that sophisticated state-affiliated actors can conduct effective operations against soft targets using low-complexity, commodity techniques—a pattern that will persist as long as organizations fail to patch known vulnerabilities promptly. The advisory recommends organizations prioritize patching the identified CVEs and implement robust configuration management to force attackers to invest time and resources in researching unknown vulnerabilities.

## Mentioned in this report

- Vulnerabilities: CVE-2020-0688 (KEV)
- Threat actors: Chinese Ministry of State Security

## Detection guidance (public sample)

### Password-Protected RAR Archive Creation via Command Line

ATT&CK: T1041

Detects rar.exe/WinRAR creating an archive with a password (-hp/-p), consistent with staging data in encrypted RAR archives before exfiltration. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Password-Protected RAR Archive Creation via Command Line
description: Detects rar.exe or WinRAR creating an archive with a password switch
  (-hp or -p), consistent with actors staging stolen data in encrypted RAR archives
  before exfiltration. Generalises on the archive-add command and password flags,
  not on specific file names.
tags:
- attack.exfiltration
- attack.collection
- attack.t1041
- attack.t1560.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
  - Image|endswith:
    - \rar.exe
    - \winrar.exe
  - OriginalFileName:
    - RAR.EXE
    - WinRAR.exe
  selection_add:
    CommandLine|contains: ' a '
  selection_pw:
    CommandLine|contains:
    - ' -hp'
    - ' -p'
    - ' /hp'
    - ' /p'
  condition: all of selection_*
falsepositives:
- Administrators or backup scripts creating password-protected archives with WinRAR
- Users sending encrypted archives of documents
level: medium
id: 99606af6-5b59-59d0-a10d-fae32e043b96
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-258a
```

### RAR Archive Created with Disguised Non-Archive File Extension

ATT&CK: T1041

Detects rar.exe/WinRAR adding files to an archive whose output name ends in a non-archive extension such as an image or data extension, matching extension obfuscation of exfiltrated archives. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: RAR Archive Created with Disguised Non-Archive File Extension
description: Detects rar.exe or WinRAR creating an archive whose output file name
  ends with an image, data or temp extension rather than .rar, matching the reported
  obfuscation of file extensions on exfiltrated RAR archives.
tags:
- attack.exfiltration
- attack.stealth
- attack.t1041
- attack.t1036.008
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
  - Image|endswith:
    - \rar.exe
    - \winrar.exe
  - OriginalFileName:
    - RAR.EXE
    - WinRAR.exe
  selection_add:
    CommandLine|contains: ' a '
  selection_ext:
    CommandLine|endswith:
    - .jpg
    - .jpeg
    - .png
    - .gif
    - .dat
    - .tmp
    - .log
    - .jpg"
    - .png"
    - .gif"
    - .dat"
    - .tmp"
  condition: all of selection_*
falsepositives:
- Scripts that archive log files into a log-named output
- Backup tooling using custom archive extensions such as .dat
level: medium
id: 5968ddfc-f27f-5fec-84ff-1de97622a9b2
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-258a
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-258a

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/48ca455a-e618-51d3-864b-1530eec87312/mss-affiliated-actors-exploit-unpatched-government-networks.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup