# Chinese actors targeted US gas pipelines 2011-2013

Published: 2025-06-20 · Severity: routine · Sectors: energy, infrastructure
Canonical: https://vorant.io/reports/ed5017fa-bf82-56c9-97c6-3871b5b77f5e/chinese-actors-targeted-us-gas-pipelines-2011-2013

> Chinese state-sponsored actors conducted spearphishing against 23 US natural gas pipeline operators, compromising at least 13 and exfiltrating SCADA access credentials.

From December 2011 through 2013, Chinese state-sponsored cyber actors conducted a sustained campaign against US oil and natural gas pipeline infrastructure. The campaign employed spearphishing emails with malicious attachments targeting pipeline company employees, followed by social engineering via phone calls requesting network security information. Of 23 tracked targeted entities, 13 were confirmed compromised, 3 were near misses, and 7 had unknown intrusion depth due to inadequate logging.

The attackers specifically sought and exfiltrated information critical to ICS/SCADA access: SCADA documentation, personnel lists, usernames and passwords, dial-up modem phone numbers and credentials, remote terminal unit (RTU) site information, and compromised jump points between corporate and OT networks. Evidence shows Chinese actors accessed SCADA networks at multiple pipeline companies and gathered sufficient intelligence to enable remote unauthorized operations. A honeypot experiment demonstrated attackers prioritized SCADA-related decoy content, extracting it within 15 minutes while ignoring financial data, confirming targeting intent.

CISA and FBI assess the intrusions were conducted to develop cyberattack capabilities for potential physical damage or operational disruption of US pipelines rather than intellectual property theft. No actual pipeline operational modifications were observed during the campaign. The advisory emphasizes network segmentation between IT and ICS networks, multi-factor authentication for remote access, spearphishing defenses, and robust ICS asset inventory and monitoring as key mitigations.

## Mentioned in this report

- Threat actors: China-nexus activity (unattributed)

## Detection guidance (public sample)

### Office Application Spawning Script Interpreter or LOLBin

ATT&CK: T1204.002

Office apps or Outlook spawning shells, script hosts or download/proxy-execution binaries, consistent with a user opening a spearphished malicious attachment. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Office Application Spawning Script Interpreter or LOLBin
description: Detects Word, Excel, PowerPoint or Outlook spawning command shells, script
  hosts or common proxy-execution binaries. Matches the user-execution step after
  a spearphishing attachment is opened, as in the pipeline-targeting campaign.
tags:
- attack.execution
- attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \WINWORD.EXE
    - \EXCEL.EXE
    - \POWERPNT.EXE
    - \OUTLOOK.EXE
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
  condition: selection
falsepositives:
- Excel or Word macros and add-ins in finance or engineering teams that legitimately
  call cmd.exe or PowerShell
- Software deployment or reporting tools that automate Office through scripts
level: medium
id: b75e060d-22a6-53ae-9574-0476b607a18f
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-201a
```

### Executable Launched from Outlook Attachment Cache

ATT&CK: T1204.002

A process started directly from the Outlook temporary attachment folder, indicating a user ran an emailed attachment. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Executable Launched from Outlook Attachment Cache
description: Detects processes whose image path is in the Outlook secure temp attachment
  cache (Content.Outlook). This indicates a user executed a file directly from an
  email attachment, as in spearphishing with malicious attachments.
tags:
- attack.execution
- attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains: \Content.Outlook\
  condition: selection
falsepositives:
- Users opening legitimate installer or self-extracting attachments from trusted senders
level: high
id: fe94d2ee-4186-5440-b625-941877552cb7
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-201a
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

1 more detection for this report is in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-201a

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/ed5017fa-bf82-56c9-97c6-3871b5b77f5e/chinese-actors-targeted-us-gas-pipelines-2011-2013.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup