A sophisticated Chinese-speaking threat actor has been targeting critical infrastructure across Asia for several years, deploying a mix of custom malware, open-source tools, and living-off-the-land (LOTL) binaries to compromise both Windows and Linux systems.
Tracked under the cluster name CL-UNK-1068, this actor has focused attacks on aviation, energy, government, law enforcement, pharmaceuticals, technology, and telecommunications sectors across South, Southeast, and East Asia since at least 2020, according to a report by Palo Alto Networks’ Unit 42.
“Using primarily open-source tools, community-shared malware, and batch scripts, the group has successfully maintained stealthy operations while infiltrating critical organizations,” said Tom Fakterman of Unit 42.
Attack Methodology
The actor typically gains initial access by exploiting vulnerable web servers and deploying various web shells, including GodZilla and a modified version of AntSword. Once inside, these shells allow lateral movement across hosts and SQL servers.
The attacks primarily aim at credential theft and sensitive data exfiltration. Unit 42 attributes the group to China based on language usage, tool origins, and consistent targeting of Asian critical infrastructure.
Cross-Platform Capabilities
CL-UNK-1068 demonstrates high versatility, operating on both Windows and Linux platforms with OS-specific versions of its tools. While espionage appears to be the primary goal, the possibility of financial or criminal motives has not been fully ruled out.
The actor employs reconnaissance and privilege escalation techniques using web shells, then performs credential theft using tools such as Mimikatz, LsaRecorder, and DumpIt, often combined with the Volatility Framework to extract password hashes. Additionally, the actor uses a custom Go-based network scanning tool named ScanPortPlus, available for both Windows and Linux.
Persistence and Evasion
To maintain a foothold, CL-UNK-1068 uses DLL side-loading with legitimate Python executables, allowing malicious code to run under trusted processes. It also uses modified Fast Reverse Proxy (FRP) builds and the Xnote Linux backdoor for command-and-control (C2) communication while bypassing network security controls.
Defending Against CL-UNK-1068
Although Unit 42 has not definitively identified the threat actor, its activities resemble the notorious Chinese threat actor Salt Typhoon, known for long-term espionage against US telecommunications firms. Other Chinese state-backed actors, such as the newly documented spinoff of APT41 called Silver Dragon, are also actively targeting Asia.
To defend against such advanced persistent threats (APTs), security teams should monitor for behavioral anomalies rather than only signatures. Key indicators of compromise (IoCs) include:
- Misuse of legitimate Python binaries for DLL side-loading
- Deployment of unauthorized tunneling tools like FRP
- Execution of custom reconnaissance batch scripts
- Evidence of credential-dumping tools like Mimikatz
- Unusual RAR compression or Base64 encoding activity
- Hardening of internet-facing web servers and monitoring web shell deployments
Read More: Trump says Iran war will be over ‘pretty quickly’ but US hasn’t ‘won enough’ yet
FAQs
Who is behind CL-UNK-1068?
The exact identity remains unknown, but the group’s language, toolset, and targeting patterns suggest a Chinese-speaking actor, possibly linked to state-sponsored operations.
Which sectors are most affected?
CL-UNK-1068 has primarily targeted aviation, energy, government, law enforcement, pharmaceuticals, technology, and telecommunications sectors across Asia.
How do these attacks work?
The actor exploits web servers and deploys web shells for lateral movement. They steal credentials using tools like Mimikatz and extract sensitive data through custom malware and open-source utilities.
What makes this threat so dangerous?
The group operates stealthily across Windows and Linux platforms, uses legitimate tools for evasion, and maintains long-term persistence, making detection and mitigation extremely challenging.
How can organizations protect themselves?
Organizations should monitor for abnormal system behaviors, secure web servers, detect unauthorized tunneling tools, track credential-dumping attempts, and follow IoCs provided by security researchers.
Conclusion
The prolonged cyber campaign by CL-UNK-1068 highlights the growing sophistication of espionage-focused cyber threats in Asia. Organizations in critical sectors must remain vigilant, adopting proactive detection and response strategies. By understanding the actor’s tactics, techniques, and procedures (TTPs), security teams can better anticipate attacks, protect sensitive data, and mitigate potential damage.
