Chinese actors targeted US gas pipelines 2011-2013
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Chinese state-sponsored actors conducted spearphishing against 23 US natural gas pipeline operators, compromising at least 13 and exfiltrating SCADA access credentials.
From December 2011 through 2013, Chinese state-sponsored cyber actors conducted a sustained campaign against US oil and natural gas pipeline infrastructure. The campaign employed spearphishing emails with malicious attachments targeting pipeline company employees, followed by social engineering via phone calls requesting network security information. Of 23 tracked targeted entities, 13 were confirmed compromised, 3 were near misses, and 7 had unknown intrusion depth due to inadequate logging.
The attackers specifically sought and exfiltrated information critical to ICS/SCADA access: SCADA documentation, personnel lists, usernames and passwords, dial-up modem phone numbers and credentials, remote terminal unit (RTU) site information, and compromised jump points between corporate and OT networks. Evidence shows Chinese actors accessed SCADA networks at multiple pipeline companies and gathered sufficient intelligence to enable remote unauthorized operations. A honeypot experiment demonstrated attackers prioritized SCADA-related decoy content, extracting it within 15 minutes while ignoring financial data, confirming targeting intent.
CISA and FBI assess the intrusions were conducted to develop cyberattack capabilities for potential physical damage or operational disruption of US pipelines rather than intellectual property theft. No actual pipeline operational modifications were observed during the campaign. The advisory emphasizes network segmentation between IT and ICS networks, multi-factor authentication for remote access, spearphishing defenses, and robust ICS asset inventory and monitoring as key mitigations.
Mentioned in this report
Detection guidance
Office Application Spawning Script Interpreter or LOLBin
Office apps or Outlook spawning shells, script hosts or download/proxy-execution binaries, consistent with a user opening a spearphished malicious attachment. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Office Application Spawning Script Interpreter or LOLBin
description: Detects Word, Excel, PowerPoint or Outlook spawning command shells, script
hosts or common proxy-execution binaries. Matches the user-execution step after
a spearphishing attachment is opened, as in the pipeline-targeting campaign.
tags:
- attack.execution
- attack.t1204.002
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \WINWORD.EXE
- \EXCEL.EXE
- \POWERPNT.EXE
- \OUTLOOK.EXE
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
condition: selection
falsepositives:
- Excel or Word macros and add-ins in finance or engineering teams that legitimately
call cmd.exe or PowerShell
- Software deployment or reporting tools that automate Office through scripts
level: medium
id: b75e060d-22a6-53ae-9574-0476b607a18f
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-201a
Executable Launched from Outlook Attachment Cache
A process started directly from the Outlook temporary attachment folder, indicating a user ran an emailed attachment. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Executable Launched from Outlook Attachment Cache
description: Detects processes whose image path is in the Outlook secure temp attachment
cache (Content.Outlook). This indicates a user executed a file directly from an
email attachment, as in spearphishing with malicious attachments.
tags:
- attack.execution
- attack.t1204.002
logsource:
category: process_creation
product: windows
detection:
selection:
Image|contains: \Content.Outlook\
condition: selection
falsepositives:
- Users opening legitimate installer or self-extracting attachments from trusted senders
level: high
id: fe94d2ee-4186-5440-b625-941877552cb7
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-201a
1 more detection for this report is in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-201a
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs