Operation Soft Cell

Executive Summary

Operation Soft Cell is an advanced persistent threat group suspected of Chinese state sponsorship, targeting telecommunications providers globally since at least 2018. Their primary tactics involve multi-stage attacks aimed at network takeover and data exfiltration, leveraging tools associated with other Chinese-affiliated APTs like APT10.

Goals & Targeting

Operation Soft Cell's strategic goals align with those of typical state-sponsored actors: intelligence gathering and network compromise. Their targeting of telecommunications providers suggests an interest in securing access to communications infrastructure, potentially for mass surveillance capabilities. The group’s focus on complete network takeover indicates a desire not just to exfiltrate data but also to establish long-term persistence within targeted organizations.

Operation Soft Cell represents a sophisticated cyber espionage campaign documented by Cybereason Nocturnus in 2018. This group targeted global telecommunications providers with highly customized attacks designed to infiltrate and exfiltrate sensitive data. The operation was characterized by multiple waves of attacks, each increasingly more aggressive, leading to complete network compromise. The attackers utilized tools and techniques reminiscent of Chinese-linked APTs such as APT10, suggesting a state-sponsored or -affiliated campaign. The primary focus appears to be on acquiring high-value telecommunications data, which could be useful for surveillance, economic gain, or strategic advantage.

Key Capabilities

• Multi-stage attack framework
• Network exploration and lateral movement
• Credential dumping techniques
• Persistent access mechanisms
• Data exfiltration protocols

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Operation Soft Cell has demonstrated an operational rhythm aligned with state-sponsored campaigns, likely indicating a well-resourced and persistent threat actor. Their focus on telecommunications providers suggests an interest in targeting critical infrastructure, possibly for both economic and national security purposes. Notable operations include the complete takeover of targeted networks, leading to significant data loss or compromise.

IOC Patterns

• Spear-phishing emails with malicious links
• VBA-based macros in Office documents
• LNK files dropped via compromised websites
• Registry and file persistence mechanisms
• Unusual network traffic patterns

Recommended Actions

• Implement advanced email filtering solutions to detect phishing attempts.
• Monitor for known MITRE ATT&CK-based indicators of compromise (IOC).
• Enhance credential protection mechanisms, such as multi-factor authentication (MFA).
• Conduct regular network security audits and penetration testing exercises.
• Ingest threat intelligence feeds into SIEM tools to detect related attack patterns.

Suggested Tags