Anonymous64

Executive Summary

Anonymous64 is alleged by China’s Ministry of State Security to be a state-linked sabotage/cyber‑harassment group reportedly controlled by a unit in Taiwan’s defense ministry. The actor has been accused of targeting public‑facing web portals, outdoor electronic billboards and network television stations to disrupt services and influence public opinion, while also pursuing financial theft. Its operational footprint spans the United States, China, Ukraine, Europe, Southeast Asia and the Middle East across a wide array of critical infrastructure sectors.

Goals & Targeting

Anonymous64’s strategic objectives blend financial theft with sabotage of public communications. By targeting web portals, outdoor billboards and network TV stations it seeks to undermine trust in media infrastructures and generate widespread alarm—an outcome consistent with influence operations. At the same time, its use of ransomware families (e.g., BlackCat) implies a secondary objective of extortion or theft of payments from victims worldwide. Typical victims are government agencies responsible for public information, media outlets that distribute news to large audiences, as well as organizations within critical infrastructure whose disruption can cause cascading economic and societal effects. The group’s geographic focus on the United States, China, Europe, Middle East and Asia‑Pacific reflects both its alleged ties to Taiwan/China state actors and a desire to pressure adversarial governments while exploiting financial opportunities in diverse markets. The sheer breadth of targeted sectors—spanning defense, energy, healthcare, finance, telecommunications, education and manufacturing—demonstrates an intent to expose wide institutional vulnerabilities and capitalize on the global reach of the modern cyber‑economy.

Key Capabilities

• Exploitation of public-facing web services for initial access
• Use of external remote services (T1133) for lateral movement
• Execution via custom backdoors and RATs (e.g., Machete, BlackCat, Carbanak)
• Data exfiltration over web services and alternative protocols
• Deployment of ransomware and data‑encryption for impact (T1486)
• Spear‑phishing or broad phishing campaigns to distribute weaponized attachments
• Potential sabotage/defacement of public media infrastructure
• Ability to coordinate multi‑sector attacks across different industries

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Anonymous64 is linked to a variety of open‑source intelligence reports that map it onto broader state‑aligned threat families such as Deep Panda and Shell Crew. While no confirmed, publicly documented campaign solely attributed to Anonymous64 exists, the pattern suggests opportunistic use of external-remote-service exploitation against publicly accessible web infrastructure coupled with ransomware or sabotage payloads. The operational tempo appears irregular—attacks are reported sporadically but involve high‑impact targets. Victims tend to be medium to large organizations in sectors where a sudden outage can inflict significant reputational damage, and the group’s toolset indicates both rapid deployment of ready‑made malware and bespoke scripts for target‑specific sabotage. Notable past operations associated with related groups include the 2015–17 attacks against Ukrainian electric grids (Sandworm), NotPetya ransomware (also tied to Sandworm/Group 74455), and the Deep Panda intrusion into Anthem, a major U.S. health insurer. These incidents collectively demonstrate the group’s capacity for wide‑scale disruption, financial theft, and political influence. Given overlaps in tool use and attribution frameworks, Anonymous64 likely operates within an ecosystem of overlapping threat actors that share information, infrastructure and tactics to carry out financially motivated sabotage on a global stage.

IOC Patterns

• Spear‑phishing via email addresses with uncommon domain patterns (e.g., rocke@live.cn)
• Use of temporary or “TEMP.” prefixed domains for command‑and‑control traffic (e.g., TEMP.Zagros, TEMP.Akapav)
• Deployment of unknown/ custom backdoors disguised under legitimate service names
• Exfiltration via common web services such as demo-cloud.space
• Phishing campaigns leveraging macro‑laden Office documents
• Use of public-facing web portals and TV broadcast infrastructure as attack vectors

Recommended Actions

• Secure all public‑facing web applications with strict patching cycles and implement Web Application Firewalls (WAFs); Conduct regular vulnerability scanning for external remote services and ensure zero‑trust network segmentation; Deploy multi‑factor authentication on admin panels of web portals, television broadcast control systems, and electronic billboard controls; Implement endpoint detection & response solutions capable of detecting ransomware execution and unusual encryption activity; Block known malicious domains (e.g., demo-cloud.space, TEMP.* domains) via DNS filtering or UTM appliances; Conduct user awareness training focused on spear‑phishing, macro‑linked documents and suspicious email attachments; Establish incident response playbooks that include sabotage scenarios for critical communication infrastructure; Maintain up‑to‑date backups of public content and media control configurations to quickly restore after defacement.

Suggested Tags