Curious Gorge

Executive Summary

Curious Gorge (aka UNC3742), attributed to China's PLA SSF, targets government and defense sectors in Ukraine, Russia, Kazakhstan, and Mongolia. The group conducts prolonged campaigns focusing on情报 gathering and infrastructure compromise. While specifics like TTPs and tools remain unclear, their activity indicates a nation-state level of sophistication with significant operational reach.

Goals & Targeting

Curious Gorge's primary objectives appear to be intelligence collection and disruption of key infrastructure in target countries. Their focus on government and defense sectors suggests a desire to gather sensitive information and undermine national security capabilities. The actor's targeting strategy reflects a long-term commitment to specific regions, indicating operational patience and strategic planning.

Curious Gorge is a state-sponsored threat actor linked to China's People's Liberation Army (PLA) Strategic Support Force (SSF). The group has been actively targeting government, military, logistics, and defense organizations in Eastern Europe and Central Asia. Campaigns have included targeted compromises of Russian defense contractors, manufacturers, and logistics companies. Curious Gorge employs persistent cyber operations, often focusing on long-term access to maintain a foothold in victim networks. Despite limited public reporting on their specific tactics, indicators suggest they are highly sophisticated, likely utilizing custom malware and advanced persistence techniques. Their geographic focus on Russia, Ukraine, and Central Asian countries aligns with potential geopolitical interests, possibly aimed at gathering intel for strategic advantage.

Key Capabilities

• State-sponsored cyber operations
• Persistent network presence
• Targeted compromise of critical infrastructure
• Intelligence gathering on defense and government activities

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Curious Gorge has demonstrated a sustained operational tempo, with campaigns spanning multiple years. Their focus on Russia and Ukraine suggests a regional strategy aimed at destabilization or intelligence collection targets. Notable operations include compromises of the Russian Ministry of Foreign Affairs and defense contractors in Ukraine.

IOC Patterns

• Spear-phishing emails targeting government/military employees
• Domain generation activity (likely C2)
• Network traffic anomalies in government/defense networks
• Artifacts in compromised systems aligning with APT activity

Recommended Actions

• Implement robust email filtering to detect spear-phishing attempts.
• Monitor network traffic for signs of C2 communication patterns.
• Conduct regular audits of critical infrastructure for unauthorized access.
• Adopt MFA (Multi-Factor Authentication) where possible.

Suggested Tags