JSAC2026 Day 1: China-nexus APT campaigns detailed

JPCERT/CC's JSAC2026 conference detailed multiple China- and North Korea-linked APT campaigns, including Earth Krahang, Earth Kurma, Tianwu, and Konni, plus mass Ivanti exploitation.

JPCERT/CC's JSAC2026 conference (Jan 21-23, 2026) featured presentations from Trend Micro, Palo Alto Networks, Cisco Talos, TeamT5, Cycraft, IIJ, LAC, and ITOCHU covering a broad range of nation-state intrusion activity. Highlights included the PONDSNAKE and WILYCODE campaigns linked to Earth Krahang and Earth Lusca (both associated with the leaked Chinese contractor i-Soon), targeting government, financial, education, and healthcare organizations via public-facing server exploitation and spear-phishing, deploying tools such as SnakeC2, NEOBEACON, Cobalt Strike, and VShell. Palo Alto Networks presented a multi-cluster attribution case study involving CL-STA-1048 (possible Earth Estries links), CL-STA-1049 (attributed to Unfading Sea Haze), and a Stately Taurus cluster, illustrating the challenges of overlapping Chinese APT toolsets under a 'Premier Pass-as-a-Service' collaboration model.

Additional sessions detailed Earth Kurma's stealthy persistence and exfiltration techniques abusing OneDrive, Dropbox, and Webex against Southeast Asian government and telecom targets; the continued evolution of Tianwu's Pangolin8RAT and custom Cobalt Strike Beacon since 2022 with intensified activity from October 2024; and a Cycraft-analyzed Chinese state-sponsored intrusion against Taiwanese government and manufacturing sectors using Microsoft Graph API C2 laundering, dead-drop resolvers, and AD logon script abuse for malware distribution (GRAPHBROTLI, GRAPHRELOOK, RCREMARK). LAC researchers detailed GSRAT, an AutoIt-based RAT tied to North Korea's Konni group, used in spear-phishing against Korean financial-sector affiliates.

Separately, TeamT5 reported large-scale exploitation of Ivanti Connect Secure devices — over 170 compromised systems across 25 regions concentrated in Japan, Taiwan, South Korea, and the US — involving the SPAWN malware suite, the TextDoor in-memory backdoor, and DebtTheft credential theft, alongside forensic challenges from encrypted partitions and GUI-limited logging. A Tropic Trooper-attributed case demonstrated a DNS-hijacking supply-chain-style attack in which a compromised home router redirected legitimate application updates to a malicious server, underscoring risks in trusted update mechanisms.

title: Scheduled Task Creation for Malware Persistence
description: Detects schtasks.exe or PowerShell TaskScheduler cmdlet usage to create
  scheduled tasks for persistence, consistent with Chinese APT persistence patterns
  observed in PONDSNAKE, WILYCODE, and Earth Kurma campaigns.
tags:
- attack.persistence
- attack.t1053.005
logsource:
  category: process_creation
  product: windows
detection:
  selection_schtasks:
    Image|endswith: \schtasks.exe
    CommandLine|contains: /create
  selection_powershell_task:
    Image|endswith: \powershell.exe
    CommandLine|contains:
    - New-ScheduledTask
    - Register-ScheduledTask
  filter_office_admin:
    CommandLine|contains:
    - OfficeClickToRun
    - Windows Update
  condition: (selection_schtasks or selection_powershell_task) and not filter_office_admin
falsepositives:
- Legitimate Windows maintenance and update tasks
- System administrator scheduled task deployment
- Software deployment tools creating update tasks
level: medium
id: f66f7b96-33a0-5928-9e58-8a873b933e81
status: experimental
author: Vorant

title: Registry Run Key Modification for Persistence
description: Detects modifications to Registry Run/RunOnce keys (HKLM/HKCU) commonly
  used by APT groups for malware auto-start persistence. Consistent with persistence
  techniques in PONDSNAKE, WILYCODE, and AD logon script abuse patterns.
tags:
- attack.persistence
- attack.t1547.001
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
    - HKLM\Software\Microsoft\Windows\CurrentVersion\Run
    - HKCU\Software\Microsoft\Windows\CurrentVersion\Run
    - HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
    - HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
  filter_windows_components:
    Details|contains:
    - C:\Program Files
    - C:\Program Files (x86)
    - C:\Windows\System32
  condition: selection and not filter_windows_components
falsepositives:
- Third-party application installers registering legitimate startup entries
- System administration tools configuring auto-start applications
level: medium
id: b40ea48c-6df9-5950-8cbe-5cabb4706d30
status: experimental
author: Vorant

title: Cloud Storage Service Abuse for Data Exfiltration
description: Detects network connections to OneDrive, Dropbox, and Webex endpoints
  from suspicious processes, consistent with Earth Kurma and other Chinese APT exfiltration
  techniques abusing legitimate cloud services as dead-drop or C2 infrastructure.
tags:
- attack.exfiltration
- attack.t1567.002
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationHostname|contains:
    - onedrive.com
    - dropbox.com
    - webex.com
    - graph.microsoft.com
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \curl.exe
    - \wget.exe
    DestinationPort: 443
  filter_outlook_teams:
    Image|endswith:
    - \OUTLOOK.EXE
    - \Teams.exe
  condition: selection and not filter_outlook_teams
falsepositives:
- Legitimate user backup and sync software (OneDrive, Dropbox clients)
- IT administrators using cloud services for data transfers
- Microsoft Teams and Outlook legitimate cloud service connections
level: medium
id: 905135f5-bd13-5b2d-b60f-a44dadd4055c
status: experimental
author: Vorant

Source reporting: https://blogs.jpcert.or.jp/en/2026/02/jsac2026day1.html