Sciextor

APT 22

APT 22 is one of the names given to a group of cyber attackers that are believed to be sponsored by the Chinese government.

They are also known as Zirconium, Hurricane Panda, or Axiom.

They have been active since at least 2009 and have targeted various sectors and organizations, such as aerospace, defense, energy, healthcare, media, and human rights groups.

APT 22 is considered to be a sophisticated and persistent threat actor that poses a significant challenge to the cyber security community. They have demonstrated a high level of technical skill, operational security, and adaptability in their attacks.

They have also shown a keen interest in exploiting zero-day vulnerabilities and using novel techniques to evade detection and attribution.

To defend against APT 22 and other similar groups, it is essential to have a robust and layered security posture, as well as a proactive and collaborative approach to threat intelligence and incident response.

History

• Operation SMN: A global campaign that compromised over 43,000 computers in 2014, using a malware family called Hikit that allowed the attackers to steal sensitive data and maintain persistent access to the infected systems.
• Operation Cloud Hopper: A series of attacks that targeted managed service providers (MSPs) and their clients in multiple countries, such as Australia, Canada, Japan, and the United States, from 2016 to 2018. The attackers used a variety of tools and techniques, such as phishing, web shells, credential theft, and lateral movement, to gain access to the MSPs’ networks and then pivot to their customers’ networks.
• Operation Wocao: A long-term espionage campaign that targeted diplomatic and government entities, as well as non-governmental organizations, in Europe and Asia, from 2010 to 2019. The attackers used custom malware, such as PlugX and Poison Ivy, as well as open-source tools, such as Mimikatz and Cobalt Strike, to collect information and exfiltrate data.