china-nexus

Executive Summary

China‑Nexus (UNC3886/UNC5174/UAT‑8302) is a sophisticated state-backed espionage group that targets critical infrastructure and high‑value entities worldwide. The actors employ zero‑day exploits, custom backdoors on network devices, and highly obfuscated multi‑stage loaders to gain long‑term access while remaining hidden behind covert proxy networks.

Goals & Targeting

China‑Nexus seeks to acquire highly sensitive data such as defense technologies, AI research outputs, financial intelligence, and operational details of telecommunications, transport and critical‑infrastructure sectors. Their tactics indicate an emphasis on covert reconnaissance through compromised vendor infrastructure and lateral movement within target networks, with the ultimate goal of achieving persistent footholds for ongoing spying and IP theft.

Key Capabilities

• Deploy custom backdoors on Juniper MX routers
• Exploit zero‑day vulnerabilities (Fortinet CVE‑2025‑21590, VMware vCenter, Ivanti Endpoint Manager CVE‑2025‑4428, Ivanti Connect Secure CVE‑2024‑8963/8190)
• Use of web shells and compromised web infrastructure for persistence
• Deploy PlugX RAT and Cobalt Strike derivatives
• Dropper techniques via malicious LNK and CHM files
• DLL sideloading with control‑flow obfuscation
• Timestamp manipulation (timestomping), log tampering, and rootkit deployment (REPTILE/MEDUSA, Hades HIPS/HIDS)
• Multi‑stage loaders SNOWLIGHT/SNOWRUST and Nimbo-C2
• C2 over HTTPS, WebSocket, DNS‑over‑HTTPS, TCP/UDP custom ports
• Proxy chaining via SOCKS5, ORB relay networks
• Hypervisor lateral movement using vSphere installation bundles
• Data exfiltration via encrypted archives (RC4/AES)
• Persistence through registry Run keys, Windows services and Linux systemd units

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

China‑Nexus has conducted at least two large‑scale campaigns spanning 2024–2026, targeting governments, telecom providers and critical infrastructure across the US, APJ and the Arabian Gulf region. The group frequently uses a combination of exploited zero‑days in enterprise software (Fortinet firewalls, VMware ESXi, Ivanti Connect Secure) with malicious backdoors left on routers and hypervisors for long‑term persistence. Operations often involve automated spray‑and‑scan modules that deposit staging servers at 130.94.17.180, dropping Cobalt Strike or PlugX staging loaders over multiple ports and protocols. The actors’ use of multi‑hop proxies (ORB relay) and DNS‑over‑HTTPS tunnels complicates attribution and detection, enabling them to maintain covert footholds for years while exfiltrating data through encrypted channels. Notable past operations include the September 2024 attack on a Qatar telecom with a TINYSHELL implant on Juniper routers, the March 2025 compromise of a U.S. medical research facility via an exposed web server hosting a DLL dropper, and the July 2026 breach of several Saudi government ministries using PlugX delivered through a malicious CHM file that leveraged DLL sideloading and timestomping. The group’s persistence tactics—rootkits on ESXi guests, systemd units on Linux hosts, registry Run keys, and Windows services named VGAuthService—combined with long‑term data staging in memory or encrypted archives highlight their focus on stealthy, sustained espionage rather than destructive sabotage.

IOC Patterns

• Zero-day vulnerability exploitation
• Custom backdoor on Juniper router firmware
• Web shell persistence
• Malicious LNK/CHM dropper files
• DLL sideloading and control-flow obfuscation
• RC4/AES-encrypted payloads
• Timestomping log timestamps
• Log tampering / deletion
• Rootkit deployment (REPTILE/MEDUSA/Hades)
• Multi-stage loader staging
• C2 over DNS-over-HTTPS, WebSocket, custom TCP/UDP ports
• Proxy chaining (SOCKS5, ORB), port knocking
• Hypervisor exploitation and lateral movement via vSphere bundles
• Data exfiltration to external HTTPS endpoint
• Credential dumping from LSASS, SAM, TOTP memory

Recommended Actions

• Patch Fortinet firewalls, VMware ESXi, Ivanti Endpoint Manager, and Connect Secure appliances against CVEs (CVE‑2025‑21590, CVE‑2024‑8963/8190, CVE‑2025‑4428) as soon as vendors release updates.
• Deploy firmware integrity checks on Juniper MX routers; disable logging via syslog.conf and monitor for unintended changes to snmpd/mgd configurations.
• Enable Multi-Factor Authentication (MFA) for privileged device access (Junos CLI, SSH, vSphere).
• Segregate management networks from production traffic and enforce strict RBAC on VPN accounts.
• Monitor for web shells, LNK/CHM dropper execution and DLL sideloading; block unsigned binaries via application whitelisting or S/MIME signing enforcement.
• Implement detection of rootkits REPTILE, MEDUSA, Hades driver, and abnormal driver load events.
• Enforce logging and audit trails on ESXi hosts; protect /var/log by monitoring for deletion or tampering. Use host-based IDS/EDR capable of detecting reflected DLL injection, process hollowing via rundll32, and custom RC4‑encrypted payloads. Monitor network traffic for suspicious DNS-over-HTTPS queries to known malicious domains (e.g., downloads.trendav.vip), uncommon TCP ports such as 45678 or 33512, and persistent WebSocket connections. Set up SIEM rules for C2 indicators: hardcoded SSH keys in /etc/ssh/*, use of lmpad or TINYSHELL with ICMP magic strings, non‑standard registry Run key values (e.g., BaiNetdisk), and creation of Windows services named VGAuthService. Conduct regular vulnerability scans of internet-facing VPN appliances and implement strict access control on vendor infrastructure that could be hijacked.