Lilac Typhoon

Executive Summary

Lilac Typhoon, also known as DEV-0234, is a likely state-sponsored threat actor attributed to China. They exploit vulnerabilities such as CVE-2022-26134 for financial gain through cryptojacking and other malicious activities.

Goals & Targeting

It appears Lilac Typhoon targets sectors with exposed Confluence servers across various industries, leveraging these vulnerabilities to extract data or deploying cryptojacking malware for profit. The primary motivation likely revolves around financial interests, with potential secondary goals of gathering intelligence.

Lilac Typhoon has demonstrated versatility by leveraging the Atlassian Confluence RCE vulnerability, which has enabled their campaigns involving cryptojacking, espionage, and ransomware deployment. Their use of tools like Cobalt Strike suggests a capability for targeted operations, potentially indicating a high level of sophistication. The actor's exploitation activities point towards financial gain and possibly nation-state interests, given the attribution to China.

Key Capabilities

• Exploitation of CVE-2022-26134
• 部署恶意软件如Cobalt Strike、web shells和botnets
• 使用数字货币挖矿软件及勒索软件

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Known for leveraging high-profile vulnerabilities, Lilac Typhoon's campaigns often involve initial access via phishing or vulnerability exploitation followed by payload deployment. Their operational tempo is characterized by targeted and lengthy campaigns focusing on data extraction, cryptojacking, or ransom activities.

IOC Patterns

• Exploitation of CVE-2022-26134
• Spear-phishing emails
• C2 communication channels using web shells
• Unusual network traffic

Recommended Actions

• Patch Atlassian Confluence instances
• Monitor for exploitation attempts and unusual traffic
• Implement EDR solutions to detect malicious processes
• Secure remote access endpoints against known payloads

Suggested Tags