# Chinese APTs target US critical infrastructure amid tensions

Published: 2025-06-20 · Severity: high · Sectors: defense, healthcare, financial-services, energy, government-national, manufacturing, telecommunications, technology, education
Canonical: https://vorant.io/reports/a6e409df-3627-5d38-8fb2-13fc07ae56d0/chinese-apts-target-us-critical-infrastructure-amid-tensions

> CISA warns of Chinese state-sponsored cyber threat to US critical infrastructure; recommends heightened awareness and patching known exploited vulnerabilities.

CISA issued a cybersecurity alert in October 2020 regarding potential Chinese cyber response to heightened US–China tensions. The advisory documents Chinese state-sponsored cyber activity targeting US critical infrastructure, intellectual property, and sensitive government and military information. Chinese threat actors, primarily operating under PLA Unit 61398 and Ministry of State Security direction, have demonstrated sustained capability to infiltrate networks across healthcare, financial services, defense industrial base, energy, government facilities, critical manufacturing, communications, IT, education, and law enforcement sectors.

The alert details common TTPs employed by Chinese APTs including APT1, APT3, APT10, APT19, APT40, and APT41. Attack vectors include exploitation of known vulnerabilities in internet-facing systems (particularly Citrix, BIG-IP, and Microsoft products), phishing and spearphishing campaigns, compromised managed service providers, password spraying, and deployment of commodity tools such as Cobalt Strike, Mimikatz, and China Chopper webshells. The advisory references multiple high-profile incidents including the 2017 Equifax breach, targeting of COVID-19 research organizations via large-scale password spraying, and systematic IP theft from companies in 12+ countries.

CISA recommends immediate patching of critical vulnerabilities, implementation of rigorous configuration management, network monitoring for C2 activity, enhanced email security, and endpoint protection capabilities. Organizations are advised to increase vigilance, exercise incident response plans, and maintain heightened personnel availability.

## Mentioned in this report

- Vulnerabilities: CVE-2012-0158 (KEV), CVE-2019-19781 (KEV), CVE-2020-5902 (KEV)
- Threat actors: APT1, APT19, APT3, APT41, Leviathan, menuPass
- Malware: Cobalt Strike Beacon, Mimikatz

## Detection guidance (public sample)

### Cobalt Strike Default Named Pipe Created

ATT&CK: T1071.001

Detects creation of named pipes matching default Cobalt Strike beacon/post-exploitation pipe names (WkSvcPipeMgr_, MSSE-*-server, hashdump, 334485, 461092). Cobalt Strike is named in the report as a commodity tool used by Chinese APTs. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Cobalt Strike Default Named Pipe Created
description: Detects creation of named pipes that match default Cobalt Strike SMB
  beacon and post-exploitation pipe names. Cobalt Strike is named in the report as
  a commodity tool used by Chinese APTs. Operators who change the malleable profile
  will evade this rule.
tags:
- attack.command-and-control
- attack.t1071.001
logsource:
  category: pipe_created
  product: windows
detection:
  selection_prefix:
    PipeName|startswith: \WkSvcPipeMgr_
  selection_msse:
    PipeName|re: ^\\MSSE-.*-server$
  selection_exact:
    PipeName:
    - \hashdump
    - \334485
    - \461092
  condition: 1 of selection_*
falsepositives:
- Legitimate software that coincidentally uses a pipe name beginning with MSSE- and
  ending in -server
- Red team or penetration test exercises using default Cobalt Strike profiles
level: high
id: db07611e-e5f7-54c6-bf4d-34b5df5a82a8
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-275a
```

### Mimikatz-Named Pipe Created

ATT&CK: T1003.001

Detects named pipes with 'mimikatz' in the name, indicating Mimikatz credential-theft tooling, which the report names as used by Chinese APTs. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Mimikatz-Named Pipe Created
description: Detects creation of a named pipe whose name contains mimikatz, indicating
  use of Mimikatz or a derivative (for example remote execution modules). Mimikatz
  is named in the report as a commodity tool used by Chinese APTs.
tags:
- attack.credential-access
- attack.t1003.001
logsource:
  category: pipe_created
  product: windows
detection:
  selection:
    PipeName|contains: mimikatz
  condition: selection
falsepositives:
- Security testing and red team exercises that run Mimikatz
level: high
id: 466676e5-88c7-5c38-adda-95c0b08a954c
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-275a
```

### PowerShell Base64 Decode Combined with In-Memory Execution

ATT&CK: T1059.001

Detects PowerShell command lines that decode Base64 content and execute it via IEX/Invoke-Expression or a download cradle, a common loader pattern for commodity tooling. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: PowerShell Base64 Decode Combined with In-Memory Execution
description: Detects PowerShell command lines that decode Base64 data with FromBase64String
  and then execute it through IEX, Invoke-Expression or a download cradle. This is
  a typical loader pattern for commodity post-exploitation tooling such as Cobalt
  Strike stagers.
tags:
- attack.execution
- attack.t1059.001
- attack.stealth
- attack.t1140
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
  selection_decode:
    CommandLine|contains: FromBase64String
  selection_exec:
    CommandLine|contains:
    - IEX
    - Invoke-Expression
    - DownloadString
    - Net.WebClient
  condition: selection_img and selection_decode and selection_exec
falsepositives:
- Administrative deployment scripts that decode embedded Base64 payloads and invoke
  them
- Software installers that bootstrap via PowerShell
level: medium
id: 375097de-17d2-5f4a-9c73-151395fc189b
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-275a
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-275a

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/a6e409df-3627-5d38-8fb2-13fc07ae56d0/chinese-apts-target-us-critical-infrastructure-amid-tensions.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup