- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- China(high confidence)
- Sources
- 6 sources carry it
- Identifier
- GINC-APT-0308 · lilac-typhoon
ChinaWhat it is
Lilac Typhoon is a threat actor attributed to China. They have been identified as exploiting the Atlassian Confluence RCE vulnerability CVE-2022-26134, which allows for remote code execution. This vulnerability has been used in cryptojacking campaigns and is included in commercial exploit frameworks. Lilac Typhoon has also been involved in deploying various payloads such as Cobalt Strike, web shells, botnets, coin miners, and ransomware.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Microsoft
- DEV-0234
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Tools
The tools and malware families the sources tie to it.
- China Chopper
- Cobalt Strike
- Miner-C
- Remote Utilities
- RemoteCMD
- RemotePC
- Xploit
Sources
- Malpedia malpedia.caad.fkie.fraunhofer.de