FishMedley

Executive Summary

FishMedley (also known as FishMonger, Earth Lusca, Aquatic Panda and other aliases) is a China‑aligned cyber‑espionage actor linked to the I‑SOON contractor and the Winnti Group umbrella. The group executed Operation FishMedley, targeting governments, NGOs and think‑tanks across Asia, Europe and the United States with sophisticated implants such as ShadowPad, SodaMaster and Spyder, leveraging watering‑hole attacks, privileged credentials and Dropbox for exfiltration. Their campaign demonstrates advanced persistence techniques, credential theft and broad geographic reach.

Goals & Targeting

FishMedley’s strategic objectives appear to be focused on gathering high‑value political and commercial intelligence from sovereign states, NGOs, think‑tanks and critical infrastructure providers. By compromising privileged accounts and utilizing persistent implants, the group seeks to maintain long‑term presence for continuous data exfiltration and surveillance, thereby supporting broader state intelligence or destabilization goals across multiple target nations.

Key Capabilities

• Acquire domains and infrastructure
• Deploy implants via PowerShell and Windows command shell scripts
• Persist through Windows services and DLL side‑loading
• Dump LSASS memory and SAM hives using rundll32
• Extract credentials from web browsers and password filters
• Leverage privileged domain‑administrator accounts for lateral movement
• Conduct watering‑hole attacks on public web assets
• Scan networks with fscan and NetBIOS detectors
• Exfiltrate data via Dropbox or custom exfiltration tools

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Operation FishMedley represents a large‑scale, multi‑phase intrusion that began in early 2023 and continued into late 2023. The actor targeted governments, NGOs, think‑tanks and other high‑profile organizations across Asia, Europe and the United States. Typical patterns include initial watering‑hole compromise via compromised public web servers or GlassFish applications, followed by rapid lateral movement using stolen domain‑admin credentials, the installation of ShadowPad/SodaMaster/Spyder backdoors, and the deployment of Dropbox‑based exfiltration channels. The campaign’s tempo was high, with multiple compromised accounts observed each week, indicating robust operational capacity and coordination. These tactics also suggest a preference for leveraging existing, widely used software ecosystems (e.g., Windows services, PowerShell) to avoid triggering defensive controls early on, while maintaining stealthy persistence through DLL side‑loading and registry manipulation. The combination of credential dumping, privileged account usage and exfiltration via cloud services demonstrates a sophisticated threat actor capable of adapting its toolkit to evade detection across diverse environments.

IOC Patterns

• Domain
• Server
• Injectable implant indicators (ShadowPad/SodaMaster/Spyder)
• Cobalt Strike beacon artifacts
• Dropbox exfiltration patterns
• Network service scanning signatures (fscan, NetBIOS)
• Privileged domain administrator usage indicators

Recommended Actions

• Monitor inbound and outbound traffic to known ShadowPad and SodaMaster C&C domains
• Detect DLL side‑loading of malicious DLLs such as log.dll into legitimate executables like Bitdefender
• Restrict PowerShell usage that downloads binaries from external sources
• Audit LSASS memory dump activity via rundll32 and registry export of SAM hives
• Segment networks to limit lateral movement of domain admin accounts
• Deploy IDS/UEBA sensors for fscan and NetBIOS scanning activity
• Implement file‑integrity monitoring for known implant binary patterns
• Block or scrutinize outbound traffic through Dropbox unless a business exception exists
• Track and filter Cobalt Strike beacon traffic via Web Protocols (T1071.001)
• Enforce least privilege and MFA for domain administrator accounts
• Maintain endpoint protection platforms up‑to‑date and apply critical patches

Suggested Tags