Houken

Executive Summary

Houken is a Chinese state‑linked intrusion set that exploited multiple zero‑day flaws in Ivanti Cloud Service Appliance devices to gain initial access into French critical infrastructure networks. The actor deploys a sophisticated rootkit and leverages a mix of commercial VPNs, dedicated servers and open‑source tools primarily authored by Chinese developers. Houken is believed to operate as an initial‑access broker, offering footholds to other threat actors while also engaging in data exfiltration and cryptomining for profit.

Goals & Targeting

Houken appears driven by dual objectives: state‑level intelligence gathering across sectors that hold strategic or financial value, and the monetization of compromised environments. By targeting French governmental agencies and critical infrastructure operators, the actor seeks valuable data while simultaneously providing footholds for broader espionage networks. The broad sector coverage—including telecommunications, media, finance, transport and energy—suggests a focus on information that can influence policy, secure economic assets or support geopolitical objectives. Geographically, Houken’s known samples and reported exploits center on France but the actor’s listed target countries (China, Russia, United States, France, Taiwan, Great Britain, India, Iran, Israel, Saudi Arabia, Ukraine, Pakistan) indicate a willingness to operate across multiple theaters. The combination of espionage and profit motives aligns with a model where initial access is sold to other actors who may pursue deeper operational goals, such as sabotage or insider threat facilitation. Typical victims are large, highly connected entities that manage sensitive data or infrastructure controls—making them attractive for both intelligence purposes and the installation of cryptomining payloads to exploit their computational resources.

Key Capabilities

• Exploitation of zero‑day vulnerabilities in IoT/edge devices
• Deployment of a sophisticated rootkit for persistence and stealth
• Use of commercial VPN services and dedicated servers as command & control infrastructure
• Leveraging open‑source tools developed by Chinese-speaking authors
• Acting as an initial‑access broker that sells compromised footholds
• Conducting data exfiltration via established C2 channels
• Deploying cryptomining payloads to monetize compromised systems
• Utilizing PowerShell scripts for post‑exploitation activity

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Houken first surfaced in September 2024 when ANSSI identified a campaign exploiting three zero‑day flaws on Ivanti Cloud Service Appliance devices that affected French government, telecommunications and transport organizations. The attack used an uncommon intrusion set, later named Houken, which relied on both state‑grade zero‐days and a suite of open‑source tools for post‑exploitation. Operational tempo appeared moderate, with multiple exploitation attempts over several weeks; the actor’s infrastructure comprised commercial VPNs and dedicated servers that masked traffic. The group also displayed elements typical of an access broker: one documented case of data exfiltration coupled with an evident interest in deploying cryptomining operations for direct profit. The linkage to UNC5174 suggests a broader network of intrusions aimed at acquiring initial footholds for resale or future exploitation. Although limited public information exists beyond the French incident, available intelligence implies that Houken is focused on critical sectors and will likely expand attacks globally if more zero‑days become available.

IOC Patterns

• Domain names mimicking legitimate government or ISP names; e.g., .fr domains used for C2 infrastructure
• Use of commercial VPN services and cloud hosting providers as staging points
• Email addresses linked to European certification authorities (e.g., cert.europa.eu) for credential theft or phishing
• Exploitation of specific Ivanti CSA devices via CVE‑level zero‑days

Recommended Actions

• Deploy timely patches or mitigations for all known Ivanti Cloud Service Appliance vulnerabilities; monitor for failed authentication attempts and exploit indicators.
• Implement endpoint detection and response (EDR) solutions that detect rootkit behavior, malicious DLL loading, and PowerShell obfuscation.
• Block outbound connections to known commercial VPN and dedicated server IP ranges used by Houken, while monitoring legitimate traffic to detect anomalous usage patterns.
• Enforce least‑privilege policies on all systems exposed to the internet; remove unnecessary administrative access and harden default credentials.
• Conduct active threat hunting for signs of data exfiltration over standard C2 channels (HTTP/S) and crypto‑mining activity, using indicators such as high CPU utilisation and unfamiliar binary processes.
• Establish a formal incident response plan that includes steps to isolate compromised devices quickly and preserve forensic evidence related to rootkits and backdoors.

Suggested Tags