Chinese Hackers Go Incognito: Turning ArcGIS into a Spy Gadget for Over a Year!
Chinese state hackers turned the ArcGIS mapping tool into a covert weapon, outsmarting security for over a year. By transforming a server object extension into a sneaky web shell, the attackers, likely the Flax Typhoon group, quietly wreaked havoc. Who knew geography could be so dangerous?
Hot Take:
Who knew that the ArcGIS tool, typically used for mapping out cities, could also map out a perfect entry for state-sponsored hackers? Next time someone says they’re going to “map out a plan,” we might need to ask for clarification on whether it involves espionage!
Key Points:
- Chinese APT group allegedly used ArcGIS to hack into systems undetected for over a year.
- Attackers used a malicious Java SOE to act as a web shell, accepting base64-encoded commands.
- Persistent access was maintained by installing SoftEther VPN Bridge as a Windows service.
- The VPN allowed lateral movement, data exfiltration, and credential dumping within the network.
- ReliaQuest researchers identified the novel use of ArcGIS SOE for cyber espionage.
Already a member? Log in here