China’s Digital Eye: Visual Studio Code Tunnels Turn Spies in Southern Europe
In Operation Digital Eye, a China-linked group used Visual Studio Code Remote Tunnels to spy on IT service providers in Southern Europe. By disguising malicious activities as legitimate traffic, they aimed to evade detection. This marks the first observed case of a suspected Chinese APT group exploiting Visual Studio Code for command and control operations.
Hot Take:
Looks like the Chinese APTs are taking a page out of the “How to Spy Without Really Trying” handbook. Who knew Visual Studio Code could moonlight as a James Bond gadget for cyber espionage? Time to double-check if your IDE is packing more than just code snippets!
Key Points:
- Operation Digital Eye targeted IT service providers in Southern Europe, linked to a Chinese APT group.
- Attackers used Visual Studio Code and Microsoft Azure for command-and-control operations.
- The campaign involved lateral movement techniques and custom Mimikatz modifications.
- Threat actors leveraged public cloud infrastructure to disguise malicious activities.
- Strategic placement of infrastructure in Europe helped reduce suspicion.
Already a member? Log in here