PurpleHaze

Executive Summary

PurpleHaze is a highly sophisticated China‑linked threat actor that blends public CVE exploitation with readily available backdoors such as GOREVERSE and ShadowPad. The group prioritizes government, critical infrastructure, finance, and telecom targets worldwide through spearphishing, living‑off‑the‑land execution, and cloud/container persistence, routinely inserting ransomware (Babuk) to monetize exfiltration efforts. Its attacks exhibit both espionage motives and clear financial gain objectives.

Goals & Targeting

PurpleHaze's strategic objectives revolve around obtaining sensitive information from high-value targets—including governmental agencies, defense contractors, critical infrastructure operators, and major financial institutions—while simultaneously seizing financial opportunities through ransomware. The actor displays a geographic focus on countries with significant economic or geopolitical importance, spanning North America, Eurasia, the Middle East, and parts of Asia. By embedding themselves in shared supply chains and exploiting public cloud resources, PurpleHaze aims to achieve persistence, stealth, and rapid lateral movement within complex enterprise environments.

Key Capabilities

• Exploitation of software vulnerabilities (CVE-based) including Ivanti Cloud Services Appliance, Biotime, MDaemon, Zimbra, and Office XSS
• Spearphishing with malicious attachments to deliver backdoors
• Use of publicly available backdoors: GOREVERSE, ShadowPad, DarkGate, BrockenDoor, Remcos, Havoc, HanifNet, NeoExpressRAT, MeshCentral Agent
• Living‑off‑the‑land execution via PowerShell, WMI, and scheduled tasks
• Persistence through malicious cloud or container images in registries
• Remote service exploitation (RDP, SSH, VPN)
• Data destruction with SDelete and backup wiping
• Deployment of Babuk ransomware for monetization
• Exfiltration over application layer protocols and public web services
• Use of tunneling tools such as plink and Ngrok for lateral movement and exfiltration
• Credential dumping with Mimikatz or custom loaders
• Injection of malicious JavaScript payloads into email clients (SpyPress chain)
• Hosting web shells on publicly accessible servers

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

PurpleHaze operates through a modular, supply‑chain‑friendly framework that allows rapid pivots between espionage and money‑making operations. Notable campaigns include ShadowPad infiltration via Ivanti CVEs, Babuk ransomware spikes targeting Russian government agencies, Sednit/SpyPress JavaScript chains harvesting email data from Horde, MDaemon, and Zimbra users, and Lemon Sandstorm’s long‑running intrusions into Middle Eastern critical infrastructure through biotime CVE exploitation and WebDAV-based delivery of the Horus agent. The actor also collaborates with MuddyWater to broker access for other Iran‑aligned groups via RMM installers (Syncro, PDQ). Campaigns span the last decade, often exhibiting a pattern of initial reconnaissance on public cloud infrastructures, followed by lateral movement through remote services, and culminating in data exfiltration or ransomware deployment.

IOC Patterns

• IP addresses
• Domain names
• File hashes/names
• CVE identifiers
• YARA rule strings
• Spearphishing attachment patterns
• Fake domain indicators
• Backdoor installation signatures (e.g., GOREVERSE, DarkGate)
• Data deletion via SDelete indicators
• Scheduled‑task persistence entries
• Web shell URLs on public servers

Recommended Actions

• Immediately patch all known CVEs affecting Ivanti Cloud Services Appliance, Biotime, MDaemon, Zimbra, and Office XSS vulnerabilities.
• Deploy endpoint detection & response (EDR) solutions with signature rules for GOREVERSE, ShadowPad, DarkGate, BrockenDoor, Remcos, Havoc, HanifNet, NeoExpressRAT, and MeshCentral Agent.
• Block or quarantine spoofed domains that mimic legitimate organizations in DNS and web traffic.
• Enforce Multi‑Factor Authentication across all administrative interfaces, remote services (RDP, SSH, VPN), and SaaS applications like Microsoft 365.
• Monitor for and neutralize scheduled‑task persistence, process injection activity, and usage of PowerShell or WMI for execution.
• Implement monitoring for SDelete or other backup‑erasure utilities to detect data wiping incidents.
• Regularly update threat intelligence feeds to block known malicious IP addresses, domain names, and file hashes associated with PurpleHaze’s tool kit.
• Restrict installation and use of remote monitoring/management (RMM) software such as Syncro and PDQ to authorized users only.
• Apply continuous vulnerability scanning and patch management across all endpoints, cloud, and container environments.
• Conduct periodic penetration tests focused on publicly exposed CVEs used by PurpleHaze.
• Block web shells from public servers through server hardening policies and runtime monitoring.

Suggested Tags