VORANT. Threat Intelligence Sign in Get the full feed

IPA warns of VPN, security appliance attacks in Japan

medium threat infrastructure

IPA Japan warns of increased network-perimeter attacks targeting VPN and security appliances using zero-days and known exploits, with China Chopper webshells deployed as backdoors.

Japan's Information-Technology Promotion Agency (IPA) issued an advisory on August 1, 2023, warning organizations about APT campaigns exploiting vulnerabilities in network-perimeter devices such as routers, VPNs, and web-facing servers. The agency references recent reporting from Mandiant on Chinese cyber-espionage groups employing increasingly sophisticated detection-evasion tactics. Multiple threat-actor campaigns are highlighted, including Volt Typhoon targeting critical infrastructure, Camaro Dragon operations, and Storm-0558 exploiting public-facing application vulnerabilities.

IPA confirms a notable increase in network-perimeter compromise cases within Japan in 2023, specifically involving targeted VPN appliances and online-storage servers. In many observed intrusions, attackers deploy the China Chopper webshell as a persistence mechanism on compromised devices. The agency advises organizations to patch affected systems immediately, review access logs for anomalous activity, and consider that they may already be compromised. Some attack patterns appear region-specific to Asia, prompting IPA to conduct direct victim notifications in certain cases.

IPA urges Japanese organizations to consult vendors or system integrators for remediation guidance, apply available patches and updates, and adopt Attack Surface Management (ASM) practices per the May 2023 guidance published by Japan's Ministry of Economy, Trade and Industry. The advisory underscores that initial-access vectors have shifted from phishing and malware to direct exploitation of internet-exposed infrastructure, necessitating enhanced perimeter monitoring and asset-inventory discipline.

Mentioned in this report

Threat actors Camaro DragonStorm-0558Volt Typhoon
Malware China Chopper

Detection guidance

Web Server Process Spawning Command Shell (China Chopper Pattern)

ATT&CK T1505.003

Detects a web server process (IIS, Apache, Tomcat) spawning cmd.exe or powershell.exe, consistent with China Chopper webshell command execution on compromised perimeter devices. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Web Server Process Spawning Command Shell (China Chopper Pattern)
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \w3wp.exe
    - \httpd.exe
    - \nginx.exe
    - \tomcat.exe
    - \tomcat8.exe
    - \tomcat9.exe
    - \java.exe
    - \php-cgi.exe
  child_selection:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \powershell_ise.exe
  filter:
    CommandLine|contains:
    - iisreset
    - Get-Service
  condition: selection and child_selection and not filter
falsepositives:
- Legitimate web application administration scripts that shell out for server management
  tasks
- Monitoring or health-check agents invoking cmd.exe from application pool workers
level: high
tags:
- attack.t1505.003
- attack.t1190
id: 844e51d9-f2b1-56a0-a3b0-35a9d28b95b8
status: experimental
author: Vorant

Suspicious Recon Commands Executed via Web Server Worker Process

ATT&CK T1190

Detects reconnaissance commands (whoami, net, ipconfig, systeminfo) launched with a web server or application process as parent, indicating post-exploitation activity via a webshell on an internet-facing application. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Recon Commands Executed via Web Server Worker Process
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \w3wp.exe
    - \httpd.exe
    - \nginx.exe
    - \tomcat.exe
    - \tomcat8.exe
    - \tomcat9.exe
    - \java.exe
    - \php-cgi.exe
  selection_cmd:
    Image|endswith:
    - \whoami.exe
    - \net.exe
    - \net1.exe
    - \ipconfig.exe
    - \systeminfo.exe
    - \tasklist.exe
    - \quser.exe
  condition: selection_parent and selection_cmd
falsepositives:
- Legitimate administrative or diagnostic scripts run through custom web management
  panels
- Automated health-check tooling invoking system information commands from an application
  context
level: high
tags:
- attack.t1190
- attack.t1505.003
id: d5f53d87-564f-5646-bf7a-feb0f8021dd4
status: experimental
author: Vorant

Script File Dropped into Web-Accessible Directory by Web Server Process

ATT&CK T1505.003

Detects creation of small script files (.aspx, .asp, .jsp, .php) written by a web server process itself into a web-accessible directory, a common pattern for webshell deployment such as China Chopper following exploitation of a public-facing application. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Script File Dropped into Web-Accessible Directory by Web Server Process
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
    - \w3wp.exe
    - \httpd.exe
    - \nginx.exe
    - \tomcat.exe
    - \tomcat8.exe
    - \tomcat9.exe
    - \java.exe
    - \php-cgi.exe
    TargetFilename|endswith:
    - .aspx
    - .asp
    - .jsp
    - .jspx
    - .php
  filter:
    TargetFilename|contains:
    - \Temp\
    - \obj\
  condition: selection and not filter
falsepositives:
- Legitimate web application deployment or publish processes that write script files
  at runtime
- CMS or CI/CD pipelines that update web content directly through the web server process
level: high
tags:
- attack.t1505.003
- attack.t1190
id: 39217f19-53d7-534d-a51a-438f303d716a
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/archive/security/security-alert/2023/alert20230801.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free